Edit tour

Windows Analysis Report
winrar-x64-701(1).exe

Overview

General Information

Sample name:	winrar-x64-701(1).exe
Analysis ID:	1530646
MD5:	46c17c999744470b689331f41eab7df1
SHA1:	b8a63127df6a87d333061c622220d6d70ed80f7c
SHA256:	c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Compliance

Score:	48
Range:	0 - 100

Signatures

Drops PE files to the user root directory

Writes a notice file (html or txt) to demand a ransom

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

EXE planting / hijacking vulnerabilities found

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Classes Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w7x64

winrar-x64-701(1).exe (PID: 3368 cmdline: "C:\Users\user\Desktop\winrar-x64-701(1).exe" MD5: 46C17C999744470B689331F41EAB7DF1)

Uninstall.exe (PID: 3688 cmdline: "C:\Users\user\uninstall.exe" /setup MD5: 4783F1A5F0BBA7A6A40CB74BC8C41217)

cleanup

Sigma Signatures

Sigma detected: Classes Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: , EventID: 13, EventType: SetValue, Image: C:\Users\user\Uninstall.exe, ProcessId: 3688, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\(Default)

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	EXE: C:\Users\user\WinRAR.exe	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	EXE: C:\Users\user\RarExtInstaller.exe	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	EXE: C:\Users\user\Rar.exe	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	EXE: C:\Users\user\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	EXE: C:\Users\user\UnRAR.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	EXE: C:\Users\user\WinRAR.exe	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	EXE: C:\Users\user\RarExtInstaller.exe	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	EXE: C:\Users\user\Rar.exe	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	EXE: C:\Users\user\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	EXE: C:\Users\user\UnRAR.exe	Jump to behavior

Creates license or readme file

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\ReadMe.txt			Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\License.txt			Jump to behavior

PE / OLE file has a valid certificate

Source: winrar-x64-701(1).exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: winrar-x64-701(1).exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, Default32.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\build\winrar64\Release\WinRAR.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, WinRAR.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\rar\build\sfxcon32\Release\sfxcon.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, WinCon32.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb. source: winrar-x64-701(1).exe
Source:	Binary string: D:\Projects\WinRAR\rarext\build\64\Release\rarext.pdb, source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, RarExt.dll.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, Zip32.SFX.0.dr
Source:	Binary string: se\uninstall.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rarext\build\64\Release\rarext.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, RarExt.dll.0.dr
Source:	Binary string: D:\Projects\WinRAR\rar\build\unrar64\Release\UnRAR.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, UnRAR.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\rar\build\sfxcon64\Release\sfxcon.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, WinCon.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\uninstall\build\uninstall64\Release\uninstall.pdb source: Uninstall.exe, 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmp, Uninstall.exe, 00000004.00000000.384135535.000000013FA72000.00000002.00000001.01000000.0000000C.sdmp, Uninstall.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, Default.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, Zip.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: Rar.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\rar\build\sfxcon64\Release\sfxcon.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, WinCon.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\rarext\Installer\x64\Release\RarExtInstaller.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, RarExtInstaller.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\rarext\build\32\Release\rarext.pdb6 source: RarExt32.dll.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: winrar-x64-701(1).exe
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: Rar.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\rarext\build\32\Release\rarext.pdb source: RarExt32.dll.0.dr

Spreading

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F791F08 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_000000013F791F08
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B9B40 FindFirstFileExW,	0_2_000000013F7B9B40
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7A34D0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,	0_2_000000013F7A34D0
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA49B10 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	4_2_000000013FA49B10
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA66DC0 FindFirstFileExW,	4_2_000000013FA66DC0

Networking

Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Rar.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: winrar-x64-701(1).exe, UnRAR.exe.0.dr, RarExtInstaller.exe.0.dr, WinRAR.exe.0.dr, Uninstall.exe.0.dr, RarExt32.dll.0.dr, RarExt.dll.0.dr, 7zxa.dll.0.dr, Rar.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Order.htm.0.dr	String found in binary or memory: https://www.rarlab.com/registration.php
Source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, WinRAR.exe.0.dr	String found in binary or memory: https://www.rarlab.com/reminder.php?language=$L&source=rarlab&architecture=$A&version=$Vorder.htmInt
Source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, WinRAR.exe.0.dr	String found in binary or memory: https://www.rarlab.com/themes.htm
Source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, Uninstall.exe, 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmp, Order.htm.0.dr, Uninstall.exe.0.dr	String found in binary or memory: https://www.win-rar.com
Source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, WinRAR.exe.0.dr	String found in binary or memory: https://www.win-rar.comIhttps://notifier.win-rar.com/buyredirect?L=0&BL=0&src=wrr&arch=64&ver=701H

Key, Mouse, Clipboard, Microphone and Screen Capturing

Creates a window with clipboard capturing capabilities

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Spam, unwanted Advertisements and Ransom Demands

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

File dropped: C:\Users\user\Rar.txt -> decrypt archive data and it cannot merge or create volumes. if no switches are specified, 'ch' command just copies the archive data without modification. if used with -amr switch to restore the saved archive name and time, other archive modification switches are ignored. example: set archive time to latest file: rar ch -tl files.rar cw write archive comment to specified file. format of output file depends on -sc switch. if output file name is not specified, comment data will be sent to stdout. examples: 1) rar cw arc comment.txt 2) rar cw -scuc arc unicode.txt 3) rar cw arc d delete files from archive. if this command removes all files from archive, the empty archive is removed. e extract files without archived paths. extract f

Jump to dropped file

System Summary

Contains functionality to call native functions

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F7A0A20 SetWindowLongPtrW,NtdllDefWindowProc_W,NtdllDefWindowProc_W,

0_2_000000013F7A0A20

Contains functionality to communicate with device drivers

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F78C4E0: CreateFileW,CloseHandle,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_000000013F78C4E0

Detected potential crypto function

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F78DE98	0_2_000000013F78DE98
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F795B4C	0_2_000000013F795B4C
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7A5ABC	0_2_000000013F7A5ABC
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F796960	0_2_000000013F796960
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7A4930	0_2_000000013F7A4930
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F785330	0_2_000000013F785330
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F79D3C0	0_2_000000013F79D3C0
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7A41D0	0_2_000000013F7A41D0
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F79EEF0	0_2_000000013F79EEF0
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F797FC8	0_2_000000013F797FC8
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7BCFAC	0_2_000000013F7BCFAC
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B7D40	0_2_000000013F7B7D40
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7A1CE8	0_2_000000013F7A1CE8
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B1D94	0_2_000000013F7B1D94
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B9B40	0_2_000000013F7B9B40
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7BCB10	0_2_000000013F7BCB10
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F788BE0	0_2_000000013F788BE0
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B1B90	0_2_000000013F7B1B90
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F79F9B0	0_2_000000013F79F9B0
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B1984	0_2_000000013F7B1984
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F798978	0_2_000000013F798978
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B2840	0_2_000000013F7B2840
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B78AC	0_2_000000013F7B78AC
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F787754	0_2_000000013F787754
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B1780	0_2_000000013F7B1780
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F784778	0_2_000000013F784778
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7C1518	0_2_000000013F7C1518
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B35D4	0_2_000000013F7B35D4
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B65C0	0_2_000000013F7B65C0
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B1574	0_2_000000013F7B1574
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7994DC	0_2_000000013F7994DC
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B83C0	0_2_000000013F7B83C0
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B1370	0_2_000000013F7B1370
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F78A1EC	0_2_000000013F78A1EC
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B31D0	0_2_000000013F7B31D0
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F79F04C	0_2_000000013F79F04C
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA6CC50	4_2_000000013FA6CC50
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA4BA0C	4_2_000000013FA4BA0C
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA48F98	4_2_000000013FA48F98
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA5C780	4_2_000000013FA5C780
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA52FD8	4_2_000000013FA52FD8
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA4C7E0	4_2_000000013FA4C7E0
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA5DFC0	4_2_000000013FA5DFC0
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA6C704	4_2_000000013FA6C704
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA5BF60	4_2_000000013FA5BF60
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA62D9C	4_2_000000013FA62D9C
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA5C57C	4_2_000000013FA5C57C
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA6F5C8	4_2_000000013FA6F5C8
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA66DC0	4_2_000000013FA66DC0
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA5BD5C	4_2_000000013FA5BD5C
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA69D30	4_2_000000013FA69D30
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA5C370	4_2_000000013FA5C370
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA5DBBC	4_2_000000013FA5DBBC
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA63230	4_2_000000013FA63230
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA5D22C	4_2_000000013FA5D22C
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA5C16C	4_2_000000013FA5C16C
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA6A1CC	4_2_000000013FA6A1CC
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA61928	4_2_000000013FA61928
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA638B0	4_2_000000013FA638B0

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\Users\user\7zxa.dll DB3D0484228ED14AD8D3763F4880D36024FB27B189C91720FF147B92D46BCB5A
Source: Joe Sandbox View	Dropped File: C:\Users\user\Default.SFX B83A105DDA4806F7AC5E9F3B6546829B37D42D85911D1C4487B1E95BFEA91E9D

Found potential string decryption / allocating functions

Source: C:\Users\user\Uninstall.exe	Code function: String function: 000000013FA41B9C appears 145 times
Source: C:\Users\user\Uninstall.exe	Code function: String function: 000000013FA4E30C appears 35 times

Sample file is different than original file name gathered from version info

Source: winrar-x64-701(1).exe	Binary or memory string: OriginalFilename vs winrar-x64-701(1).exe
Source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRarExtInstaller.exeD vs winrar-x64-701(1).exe
Source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUninstall.exeD vs winrar-x64-701(1).exe
Source: winrar-x64-701(1).exe, 00000000.00000000.351469154.000000013F7EB000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWinRAR.exeD vs winrar-x64-701(1).exe
Source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinRAR.exeD vs winrar-x64-701(1).exe
Source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zxa.dll, vs winrar-x64-701(1).exe
Source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRarExt.dllD vs winrar-x64-701(1).exe
Source: winrar-x64-701(1).exe	Binary or memory string: OriginalFilenameWinRAR.exeD vs winrar-x64-701(1).exe

Searches for the Microsoft Outlook file path

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: classification engine

Classification label: sus24.rans.winEXE@3/38@0/0

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F78BA38 GetLastError,FormatMessageW,LocalFree,

0_2_000000013F78BA38

Source: C:\Users\user\Uninstall.exe

Code function: 4_2_000000013FA4853C GetDiskFreeSpaceExW,

4_2_000000013FA4853C

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F7A02DC CLSIDFromString,CoCreateInstance,

0_2_000000013F7A02DC

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F7A1FEC FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GlobalUnlock,GlobalFree,

0_2_000000013F7A1FEC

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

File created: C:\Users\user\__tmp_rar_sfx_access_check_7330424

Jump to behavior

Source: winrar-x64-701(1).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Uninstall.exe	String found in binary or memory: -install -extall
Source: Uninstall.exe	String found in binary or memory: -install

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

File read: C:\Users\user\Desktop\winrar-x64-701(1).exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\winrar-x64-701(1).exe "C:\Users\user\Desktop\winrar-x64-701(1).exe"
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process created: C:\Users\user\Uninstall.exe "C:\Users\user\uninstall.exe" /setup
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process created: C:\Users\user\Uninstall.exe "C:\Users\user\uninstall.exe" /setup	Jump to behavior

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: cscdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Section loaded: slc.dll	Jump to behavior

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: WinRAR.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\WinRAR.exe
Source: WinRAR help.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\WinRAR.chm
Source: Console RAR manual.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\Rar.txt
Source: What is new in the latest version.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\WhatsNew.txt
Source: WinRAR.lnk0.4.dr	LNK file: ..\..\..\..\..\..\Users\user\WinRAR.exe
Source: WinRAR help.lnk0.4.dr	LNK file: ..\..\..\..\..\..\Users\user\WinRAR.chm
Source: Console RAR manual.lnk0.4.dr	LNK file: ..\..\..\..\..\..\Users\user\Rar.txt
Source: What is new in the latest version.lnk0.4.dr	LNK file: ..\..\..\..\..\..\Users\user\WhatsNew.txt

Found GUI installer (many successful clicks)

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Automated click: OK
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Automated click: Install
Source: C:\Users\user\Uninstall.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found window with many clickable UI elements (buttons, textforms, scrollbars etc)

Source: C:\Users\user\Uninstall.exe

Window detected: Number of UI elements: 33

PE / OLE file has a valid certificate

Source: winrar-x64-701(1).exe

Static PE information: certificate valid

PE file has a high image base, often used for DLLs

Source: winrar-x64-701(1).exe

Static PE information: Image base 0x140000000 > 0x60000000

Submission file is bigger than most known malware samples

Source: winrar-x64-701(1).exe

Static file information: File size 3948120 > 1048576

PE file contains a mix of data directories often seen in goodware

Source: winrar-x64-701(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: winrar-x64-701(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: winrar-x64-701(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: winrar-x64-701(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: winrar-x64-701(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: winrar-x64-701(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: winrar-x64-701(1).exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: winrar-x64-701(1).exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, Default32.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\build\winrar64\Release\WinRAR.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, WinRAR.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\rar\build\sfxcon32\Release\sfxcon.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, WinCon32.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb. source: winrar-x64-701(1).exe
Source:	Binary string: D:\Projects\WinRAR\rarext\build\64\Release\rarext.pdb, source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, RarExt.dll.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, Zip32.SFX.0.dr
Source:	Binary string: se\uninstall.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rarext\build\64\Release\rarext.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, RarExt.dll.0.dr
Source:	Binary string: D:\Projects\WinRAR\rar\build\unrar64\Release\UnRAR.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, UnRAR.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\rar\build\sfxcon64\Release\sfxcon.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, WinCon.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\uninstall\build\uninstall64\Release\uninstall.pdb source: Uninstall.exe, 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmp, Uninstall.exe, 00000004.00000000.384135535.000000013FA72000.00000002.00000001.01000000.0000000C.sdmp, Uninstall.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, Default.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, Zip.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: Rar.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\rar\build\sfxcon64\Release\sfxcon.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, WinCon.SFX.0.dr
Source:	Binary string: D:\Projects\WinRAR\rarext\Installer\x64\Release\RarExtInstaller.pdb source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, RarExtInstaller.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\rarext\build\32\Release\rarext.pdb6 source: RarExt32.dll.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: winrar-x64-701(1).exe
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: Rar.exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\rarext\build\32\Release\rarext.pdb source: RarExt32.dll.0.dr

PE file contains a valid data directory to section mapping

Source: winrar-x64-701(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: winrar-x64-701(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: winrar-x64-701(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: winrar-x64-701(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: winrar-x64-701(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

File is packed with WinRar

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

File created: C:\Users\user\__tmp_rar_sfx_access_check_7330424

Jump to behavior

PE file contains sections with non-standard names

Source: winrar-x64-701(1).exe	Static PE information: section name: .didat
Source: winrar-x64-701(1).exe	Static PE information: section name: _RDATA
Source: Rar.exe.0.dr	Static PE information: section name: _RDATA
Source: RarExtInstaller.exe.0.dr	Static PE information: section name: _RDATA
Source: Uninstall.exe.0.dr	Static PE information: section name: _RDATA
Source: UnRAR.exe.0.dr	Static PE information: section name: _RDATA
Source: WinRAR.exe.0.dr	Static PE information: section name: .didat
Source: WinRAR.exe.0.dr	Static PE information: section name: _RDATA
Source: RarExt.dll.0.dr	Static PE information: section name: _RDATA
Source: WinCon.SFX.0.dr	Static PE information: section name: .didat
Source: WinCon.SFX.0.dr	Static PE information: section name: _RDATA
Source: WinCon32.SFX.0.dr	Static PE information: section name: .didat
Source: Zip.SFX.0.dr	Static PE information: section name: .didat
Source: Zip.SFX.0.dr	Static PE information: section name: _RDATA
Source: Zip32.SFX.0.dr	Static PE information: section name: .didat
Source: Default.SFX.0.dr	Static PE information: section name: .didat
Source: Default.SFX.0.dr	Static PE information: section name: _RDATA
Source: Default32.SFX.0.dr	Static PE information: section name: .didat

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\WinRAR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\RarExtInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\WinCon.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Zip32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Default.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Default32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\RarExt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\UnRAR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\WinCon32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\7zxa.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\RarExt32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Zip.SFX	Jump to dropped file

Drops PE files to the user directory

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\WinRAR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\RarExtInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\WinCon.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Zip32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Default.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Default32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\RarExt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\UnRAR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\WinCon32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\7zxa.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\RarExt32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Zip.SFX	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\WinCon.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\WinCon32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Zip.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Zip32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Default.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Default32.SFX	Jump to dropped file

Creates license or readme file

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\ReadMe.txt			Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\License.txt			Jump to behavior

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\WinRAR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\RarExtInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\WinCon.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Zip32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Default.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Default32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\RarExt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\UnRAR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\WinCon32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\7zxa.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\RarExt32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	File created: C:\Users\user\Zip.SFX	Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Users\user\Uninstall.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR	Jump to behavior
Source: C:\Users\user\Uninstall.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk	Jump to behavior
Source: C:\Users\user\Uninstall.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk	Jump to behavior
Source: C:\Users\user\Uninstall.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk	Jump to behavior
Source: C:\Users\user\Uninstall.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk	Jump to behavior
Source: C:\Users\user\Uninstall.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR	Jump to behavior
Source: C:\Users\user\Uninstall.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk	Jump to behavior
Source: C:\Users\user\Uninstall.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk	Jump to behavior
Source: C:\Users\user\Uninstall.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk	Jump to behavior
Source: C:\Users\user\Uninstall.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Memory allocated: 2EA0000 memory commit \| memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Memory allocated: 5FE0000 memory commit \| memory reserve \| memory write watch			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\WinRAR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\RarExtInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\WinCon.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\Zip32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\Default.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\Default32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\Rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\RarExt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\UnRAR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\7zxa.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\WinCon32.SFX	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\RarExt32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Dropped PE file which has not been started: C:\Users\user\Zip.SFX	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe TID: 3444

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F791F08 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_000000013F791F08
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7B9B40 FindFirstFileExW,	0_2_000000013F7B9B40
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7A34D0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,	0_2_000000013F7A34D0
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA49B10 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	4_2_000000013FA49B10
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA66DC0 FindFirstFileExW,	4_2_000000013FA66DC0

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F7A88A0 VirtualQuery,GetSystemInfo,

0_2_000000013F7A88A0

Source: winrar-x64-701(1).exe, 00000000.00000003.383527806.000000000043E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: qEmulateIE8

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F7AFEC8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000000013F7AFEC8

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F7BB630 GetProcessHeap,

0_2_000000013F7BB630

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7A9D00 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	0_2_000000013F7A9D00
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7AFEC8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000000013F7AFEC8
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7A9458 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000000013F7A9458
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7AA354 SetUnhandledExceptionFilter,	0_2_000000013F7AA354
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Code function: 0_2_000000013F7AA170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000000013F7AA170
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA54E10 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	4_2_000000013FA54E10
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA5AE38 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_000000013FA5AE38
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA55488 SetUnhandledExceptionFilter,	4_2_000000013FA55488
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA55298 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_000000013FA55298
Source: C:\Users\user\Uninstall.exe	Code function: 4_2_000000013FA547F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_000000013FA547F8

HIPS / PFW / Operating System Protection Evasion

Contains functionality to launch a program with higher privileges

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F7A4930 SetDlgItemTextW,EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,ShowWindow,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,ShowWindow,ShowWindow,SetDlgItemTextW,ShowWindow,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SetDlgItemTextW,DeleteObject,DeleteObject,SendDlgItemMessageW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,SetForegroundWindow,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,

0_2_000000013F7A4930

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Process created: C:\Users\user\Uninstall.exe "C:\Users\user\uninstall.exe" /setup

Jump to behavior

Source: winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, WinRAR.exe.0.dr

Binary or memory string: %%=%c:%%=%c:EDITtooltips_class32CMDWNDADDCMDWNDOTHERCMDWNDCONVERTCMDWNDFINDCMDWNDBENCHCMDWNDREAD* %sHELPExecArcCmdInterface\CmdWin\%sDoneCMDMODETaskbarCreatedProgmanHELPCmdMode

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F79AEE4 cpuid

0_2_000000013F79AEE4

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: GetLocaleInfoW,

0_2_000000013F7A2954

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\winrar-x64-701(1).exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\Users\user\WinRAR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\Users\user\WinRAR.chm VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\Users\user\Rar.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\Users\user\WhatsNew.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\Users\user\WinRAR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\Users\user\Rar.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Uninstall.exe	Queries volume information: C:\Users\user\WhatsNew.txt VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F7A41D0 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,

0_2_000000013F7A41D0

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Code function: 0_2_000000013F792D64 GetVersionExW,

0_2_000000013F792D64

Source: C:\Users\user\Desktop\winrar-x64-701(1).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Exploitation for Privilege Escalation	121 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Search Order Hijacking	1 Registry Run Keys / Startup Folder	12 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Search Order Hijacking	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	36 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Search Order Hijacking	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
winrar-x64-701(1).exe	0%	Virustotal		Browse
winrar-x64-701(1).exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\7zxa.dll	0%	ReversingLabs
C:\Users\user\7zxa.dll	0%	Virustotal	Browse
C:\Users\user\Default.SFX	0%	ReversingLabs
C:\Users\user\Default.SFX	1%	Virustotal	Browse
C:\Users\user\Default32.SFX	0%	ReversingLabs
C:\Users\user\Default32.SFX	0%	Virustotal	Browse
C:\Users\user\Rar.exe	0%	ReversingLabs
C:\Users\user\Rar.exe	0%	Virustotal	Browse
C:\Users\user\RarExt.dll	0%	ReversingLabs
C:\Users\user\RarExt.dll	0%	Virustotal	Browse
C:\Users\user\RarExt32.dll	0%	ReversingLabs
C:\Users\user\RarExt32.dll	0%	Virustotal	Browse
C:\Users\user\RarExtInstaller.exe	0%	ReversingLabs
C:\Users\user\RarExtInstaller.exe	0%	Virustotal	Browse
C:\Users\user\UnRAR.exe	0%	ReversingLabs
C:\Users\user\UnRAR.exe	0%	Virustotal	Browse
C:\Users\user\Uninstall.exe	3%	ReversingLabs
C:\Users\user\Uninstall.exe	3%	Virustotal	Browse
C:\Users\user\WinCon.SFX	0%	ReversingLabs
C:\Users\user\WinCon.SFX	0%	Virustotal	Browse
C:\Users\user\WinCon32.SFX	0%	ReversingLabs
C:\Users\user\WinCon32.SFX	0%	Virustotal	Browse
C:\Users\user\WinRAR.exe	0%	ReversingLabs
C:\Users\user\WinRAR.exe	0%	Virustotal	Browse
C:\Users\user\Zip.SFX	0%	ReversingLabs
C:\Users\user\Zip.SFX	1%	Virustotal	Browse
C:\Users\user\Zip32.SFX	0%	ReversingLabs
C:\Users\user\Zip32.SFX	0%	Virustotal	Browse

Source	Detection	Scanner	Link
https://www.rarlab.com/themes.htm	0%	Virustotal	Browse
https://www.win-rar.com	1%	Virustotal	Browse
https://www.rarlab.com/reminder.php?language=$L&source=rarlab&architecture=$A&version=$Vorder.htmInt	0%	Virustotal	Browse
https://www.rarlab.com/registration.php	0%	Virustotal	Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rarlab.com/themes.htm	winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, WinRAR.exe.0.dr	false	0%, Virustotal, Browse	unknown
https://www.win-rar.comIhttps://notifier.win-rar.com/buyredirect?L=0&BL=0&src=wrr&arch=64&ver=701H	winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006FF4000.00000004.00000020.00020000.00000000.sdmp, WinRAR.exe.0.dr	false		unknown
https://www.rarlab.com/registration.php	Order.htm.0.dr	false	0%, Virustotal, Browse	unknown
https://www.win-rar.com	winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, Uninstall.exe, 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmp, Order.htm.0.dr, Uninstall.exe.0.dr	false	1%, Virustotal, Browse	unknown
https://www.rarlab.com/reminder.php?language=$L&source=rarlab&architecture=$A&version=$Vorder.htmInt	winrar-x64-701(1).exe, 00000000.00000003.383302856.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp, WinRAR.exe.0.dr	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1530646
Start date and time:	2024-10-10 10:17:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	winrar-x64-701(1).exe
Detection:	SUS
Classification:	sus24.rans.winEXE@3/38@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 117 Number of non-executed functions: 147
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.21.22.114, 2.21.22.106, 93.184.221.240
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, wu.azureedge.net, download.windowsupdate.com.edgesuite.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:18:29	API Interceptor	237x Sleep call for process: winrar-x64-701(1).exe modified
04:18:44	API Interceptor	54x Sleep call for process: Uninstall.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\7zxa.dll	nIoRMxnlzt.exe	Get hash	malicious	CobaltStrike	Browse
	nIoRMxnlzt.exe	Get hash	malicious	CobaltStrike	Browse
	XmS_Project.rar	Get hash	malicious	Unknown	Browse
	TT ViewBot v3.7.zip	Get hash	malicious	Unknown	Browse
	test.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse
	https://www.mediafire.com/file/0k1qpxynn6wl5z6/Purchase+Inquiry++Uzbekistan+&+Greece+Customers.tgz/file	Get hash	malicious	AgentTesla	Browse
C:\Users\user\Default.SFX	nIoRMxnlzt.exe	Get hash	malicious	CobaltStrike	Browse
	nIoRMxnlzt.exe	Get hash	malicious	CobaltStrike	Browse
	XmS_Project.rar	Get hash	malicious	Unknown	Browse
	TT ViewBot v3.7.zip	Get hash	malicious	Unknown	Browse
	test.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse
	https://www.mediafire.com/file/0k1qpxynn6wl5z6/Purchase+Inquiry++Uzbekistan+&+Greece+Customers.tgz/file	Get hash	malicious	AgentTesla	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk

Download File

Process:	C:\Users\user\Uninstall.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 10 07:18:43 2024, mtime=Thu Oct 10 07:18:43 2024, atime=Wed Apr 24 11:35:16 2024, length=108383, window=hide
Category:	dropped
Size (bytes):	832
Entropy (8bit):	4.7875179191521875
Encrypted:	false
SSDEEP:	12:8ZZ2v4RCrOvSpiseNMlWlEaXolZFp6NwuG3YilMMEpxRljKZTdc7y/Tdc7X:8jLRExIseNkWCqolAw3q0yW7yr
MD5:	23290A796D6B01E8596D5EBA1FEBA453
SHA1:	599D519ED8C757AF58D0D86033032E7EC17F4E1A
SHA-256:	6ED10475A1DC040602E50A384F69494C23DD45498E52A7B70FF5B225151B89A0
SHA-512:	6EC511EF4429BA9112FF93AE5A302EC00836E126A0852FF7450CC4CBFF6826FA2EB3EB18EA0C59FE331B59D3C411A027896B6438A31DC63564592EF7BCE9DEBC
Malicious:	false
Reputation:	low
Preview:	L..................F.... .....=.......=.......L.C..._............................DG..Yr?.D..U..k0.~.t...CFSF..2._....Xid .Rar.txt...t.Y^...H.g.3..(.....gVA.G..k...<......JYVBJYVB.........................R.a.r...t.x.t...B...i...............-...8...[...........Dg.v.....C:\Users\..#...................\\971342\Users.user\Rar.txt..P.r.o.c.e.s.s. .R.A.R.,. .Z.I.P. .a.n.d. .o.t.h.e.r. .a.r.c.h.i.v.e. .f.o.r.m.a.t.s.%.....\.....\.....\.....\.....\.....\.U.s.e.r.s.\.A.l.b.u.s.\.R.a.r...t.x.t...C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.e.s.k.t.o.p.........................\|....I.J.H..K..................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......971342..........D_....3N...W...9..W.e8...8.....[D_....3N...W...9..W.e8...8.....[....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk

Download File

Process:	C:\Users\user\Uninstall.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 10 07:18:43 2024, mtime=Thu Oct 10 07:18:43 2024, atime=Sun May 12 09:02:33 2024, length=46292, window=hide
Category:	dropped
Size (bytes):	863
Entropy (8bit):	4.790126072770396
Encrypted:	false
SSDEEP:	12:8GSf4BgaRaCMZzIislYMlWlEaszElZFp6NwuG3YilMMEpxRljKZTddy/TddX:8mBhaZz7slYkWCXzElAw3q0q7P
MD5:	2E6B9A14988C1987299CB72453E53290
SHA1:	DFD1316E253DE0B08AACFF3039B2E6773FD13EF7
SHA-256:	98981B824606A9993140460F03208F2F4EA6B015D47578C95DD5A19E6263B46D
SHA-512:	EB108BAAB05F1A71ACF79FB68ECF8FD2FEF96F8B1BF070703BD6533E5D5B4532640DF75A37BE66529CA2E7D2F492BED9F55F9E053429AD9EF526BCBABA8A0718
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...c.?.....c.?.......y.S...............................DG..Yr?.D..U..k0..t.".CFSF..2.....XQP .WhatsNew.txt....t.Y^...H.g.3..(.....gVA.G..k...F......JYVBJYVB.........................W.h.a.t.s.N.e.w...t.x.t...H...n...............-...8...[...........Dg.v.....C:\Users\..#...................\\971342\Users.user\WhatsNew.txt..P.r.o.c.e.s.s. .R.A.R.,. .Z.I.P. .a.n.d. .o.t.h.e.r. .a.r.c.h.i.v.e. .f.o.r.m.a.t.s.*.....\.....\.....\.....\.....\.....\.U.s.e.r.s.\.A.l.b.u.s.\.W.h.a.t.s.N.e.w...t.x.t...C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.e.s.k.t.o.p.........................\|....I.J.H..K..................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......971342..........D_....3N...W...9..W.e8...8.....[D_....3N...W...9..W.e8...8.....[....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk

Download File

Process:	C:\Users\user\Uninstall.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 10 07:18:44 2024, mtime=Thu Oct 10 07:18:44 2024, atime=Sun May 12 09:17:28 2024, length=324272, window=hide
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.816525321852148
Encrypted:	false
SSDEEP:	12:8R19p4mJHLLC75PszWis4MlWlEaUcsz3SFp6NwuG3YilMMEpxRljKZTd0Cy/Td0i:8R1oeH3w4ls4kWCy4Jw3q0at7ai
MD5:	ED0A7FAE3C8BAD80FA5A2372CEFE6A37
SHA1:	D64965072069F756EB4BD3C27758579671D7A258
SHA-256:	F76FB4A2FC1632BC423C1CB58FDE78973A9E71F2A564666A1D5AD22833395C26
SHA-512:	7A6435677447D44A30BF32FF020D7123F1C7DF48704AA886CCAFB28CAAE542A9551E1BD5D0534BFEDD44C0F57EB6B9A7FFD7C342CD897E7C498E74D83B2277D5
Malicious:	false
Reputation:	low
Preview:	L..................F.... .................E.n.U................................DG..Yr?.D..U..k0..t. .CFSF..2......X/R .WinRAR.chm....t.Y^...H.g.3..(.....gVA.G..k...B......JYWBJYWB.........................W.i.n.R.A.R...c.h.m...F...l...............-...8...[...........Dg.v.....C:\Users\..#...................\\971342\Users.user\WinRAR.chm..P.r.o.c.e.s.s. .R.A.R.,. .Z.I.P. .a.n.d. .o.t.h.e.r. .a.r.c.h.i.v.e. .f.o.r.m.a.t.s.(.....\.....\.....\.....\.....\.....\.U.s.e.r.s.\.A.l.b.u.s.\.W.i.n.R.A.R...c.h.m...C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.e.s.k.t.o.p.........................\|....I.J.H..K..................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......971342..........D_....3N...W...9..W.e8...8.....[D_....3N...W...9..W.e8...8.....[....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk

Download File

Process:	C:\Users\user\Uninstall.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 10 07:18:43 2024, mtime=Thu Oct 10 07:18:43 2024, atime=Wed May 15 06:35:22 2024, length=3286680, window=hide
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.7921618322653865
Encrypted:	false
SSDEEP:	12:8mRp4m7CwoFszAvisWMlWlEaUcszAUmTFp6NwuG3YilMMEpxRljKZTdIy/TdIX:8mkuy4bsWkWCy4fw3q057u
MD5:	EF850AC9735C9770F0CD99714FE3E04E
SHA1:	AFDB93F049961B9E0991EAC65214BD27F8C9A188
SHA-256:	43047A93F9386C76A7C2C755538C11E2C85E81D3E8AB62417995EF9F33210C25
SHA-512:	0EC29F76B4CAFFC49A0867C145BF65CD2ED2ED5D7F2EC0522480F736B855165AA084C52B1EFFC9329B74233F8777B82680AC296D69D456FFCB7BA5B0CF079B56
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...e.R.....e.R........q.....&2..........................DG..Yr?.D..U..k0..t. .CFSF..2..&2..Xl< .WinRAR.exe....t.Y^...H.g.3..(.....gVA.G..k...B......JYVBJYVB.........................W.i.n.R.A.R...e.x.e...F...l...............-...8...[...........Dg.v.....C:\Users\..#...................\\971342\Users.user\WinRAR.exe..P.r.o.c.e.s.s. .R.A.R.,. .Z.I.P. .a.n.d. .o.t.h.e.r. .a.r.c.h.i.v.e. .f.o.r.m.a.t.s.(.....\.....\.....\.....\.....\.....\.U.s.e.r.s.\.A.l.b.u.s.\.W.i.n.R.A.R...e.x.e...C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.e.s.k.t.o.p.........................\|....I.J.H..K..................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......971342..........D_....3N...W...9..W.e8...8.....[D_....3N...W...9..W.e8...8.....[....

C:\Users\user\7zxa.dll

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	226456
Entropy (8bit):	6.366028824236922
Encrypted:	false
SSDEEP:	3072:+ftOtcS7lCZc9Ltue1C+zV2zUmiRvgWDFSaRPQIDCuPK1gSBvAGfPFjaRv+PB7PT:etViwgLtun+soC1vx2Hr0/NG1E
MD5:	04D3E794624A82228A7E683FDF22E182
SHA1:	114B74E926913BB0A588E671025F9EB38E8B854B
SHA-256:	DB3D0484228ED14AD8D3763F4880D36024FB27B189C91720FF147B92D46BCB5A
SHA-512:	B5767971F9075B5E483F9E77DCB50637EB81D70DA86D655A230DA6AD3DC5337D2A08038261F32E3867FDE68FD33BF23A75B50E0381762BECB46E859404E78D82
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: nIoRMxnlzt.exe, Detection: malicious, Browse Filename: nIoRMxnlzt.exe, Detection: malicious, Browse Filename: XmS_Project.rar, Detection: malicious, Browse Filename: TT ViewBot v3.7.zip, Detection: malicious, Browse Filename: test.pdf.lnk.mal.lnk, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........qt9...j...j...j.gj...j.aj...j...j...j.tj...jt..k...j.wj...j.b.k...j.`j...j.fj...j.bj...jRich...j........PE..d......f.........." .....r...2.......S....................................................`......................................... ...........P................&...L...(..............................................................p............................text....q.......r.................. ..`.rdata...............v..............@..@.data....]... ......................@....pdata...&.......(..................@..@.rsrc................,..............@..@.reloc...............D..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk

Download File

Process:	C:\Users\user\Uninstall.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 10 07:18:43 2024, mtime=Thu Oct 10 07:18:43 2024, atime=Wed Apr 24 11:35:16 2024, length=108383, window=hide
Category:	dropped
Size (bytes):	814
Entropy (8bit):	4.795556189671133
Encrypted:	false
SSDEEP:	12:8ZZ2v4RCrOvSpiseNMlWlEa4iolZFp6NwuG3YilMMEpxRljKZTdc7y/Tdc7X:8jLRExIseNkWChiolAw3q0yW7yr
MD5:	383AF18C044E861871C050791F1C43A2
SHA1:	E2A169B2230C238CB5F421E7FC7D40F9621FB0AE
SHA-256:	AA889C2AE6CB4F6FD44955686D2B07FF30068FC6234D47966FD6B693B42BD9A4
SHA-512:	02FBE6F47CE09580A80485B96C25CEADEF58639ABDD4C2AF0E97FB5DCDFCFAF58CBB92E684125810EED3FC17045061B9D8A7CDDE66B22D241B97F407EAA4D066
Malicious:	false
Reputation:	low
Preview:	L..................F.... .....=.......=.......L.C..._............................DG..Yr?.D..U..k0.~.t...CFSF..2._....Xid .Rar.txt...t.Y^...H.g.3..(.....gVA.G..k...<......JYVBJYVB.........................R.a.r...t.x.t...B...i...............-...8...[...........Dg.v.....C:\Users\..#...................\\971342\Users.user\Rar.txt..P.r.o.c.e.s.s. .R.A.R.,. .Z.I.P. .a.n.d. .o.t.h.e.r. .a.r.c.h.i.v.e. .f.o.r.m.a.t.s.......\.....\.....\.....\.....\.....\.....\.R.a.r...t.x.t...C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.e.s.k.t.o.p.........................\|....I.J.H..K..................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......971342..........D_....3N...W...9..W.e8...8.....[D_....3N...W...9..W.e8...8.....[....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk

Download File

Process:	C:\Users\user\Uninstall.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 10 07:18:43 2024, mtime=Thu Oct 10 07:18:43 2024, atime=Sun May 12 09:02:33 2024, length=46292, window=hide
Category:	dropped
Size (bytes):	845
Entropy (8bit):	4.806329182189861
Encrypted:	false
SSDEEP:	12:8GSf4BgaRaCMZzIislYMlWlEaOpzElZFp6NwuG3YilMMEpxRljKZTddy/TddX:8mBhaZz7slYkWCzzElAw3q0q7P
MD5:	3D0FB82CB0516162B465A2B3FA818F87
SHA1:	C7C8293D5D70A1A02DF91728864A5CE93624AEF1
SHA-256:	812AFD1FC5E9627663AC7B2ABA8DE2D81F485E32372FDF14215E5C71E438865E
SHA-512:	4D6808259AFAFAB3CE8176647004114C6B5383C5EE7D1AA4F0D57286649B2DBD55D26EA8B392EDA6E618D452CE942D80D8D7DE1F55080E10560C4F80873394CA
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...c.?.....c.?.......y.S...............................DG..Yr?.D..U..k0..t.".CFSF..2.....XQP .WhatsNew.txt....t.Y^...H.g.3..(.....gVA.G..k...F......JYVBJYVB.........................W.h.a.t.s.N.e.w...t.x.t...H...n...............-...8...[...........Dg.v.....C:\Users\..#...................\\971342\Users.user\WhatsNew.txt..P.r.o.c.e.s.s. .R.A.R.,. .Z.I.P. .a.n.d. .o.t.h.e.r. .a.r.c.h.i.v.e. .f.o.r.m.a.t.s.!.....\.....\.....\.....\.....\.....\.....\.W.h.a.t.s.N.e.w...t.x.t...C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.e.s.k.t.o.p.........................\|....I.J.H..K..................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......971342..........D_....3N...W...9..W.e8...8.....[D_....3N...W...9..W.e8...8.....[....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk

Download File

Process:	C:\Users\user\Uninstall.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 10 07:18:44 2024, mtime=Thu Oct 10 07:18:44 2024, atime=Sun May 12 09:17:28 2024, length=324272, window=hide
Category:	dropped
Size (bytes):	833
Entropy (8bit):	4.829783343698719
Encrypted:	false
SSDEEP:	12:8R19p4mJHLLC75PszWis4MlWlEarcWxsz3SFp6NwuG3YilMMEpxRljKZTd0Cy/TN:8R1oeH3w4ls4kWCyx4Jw3q0at7ai
MD5:	FEF5D29980CF84DB0FBA74871B533BB7
SHA1:	FE984FBB0DB29FE932861AF56AE9261FC67B12E6
SHA-256:	410F13D53393AD75499E6398E25B697C61D7DD32892562BC2057D6B0B803EF82
SHA-512:	4025FB0A477DB8CCF7CBB405C1B55654AB69C07CC4C00761111BACF8F1DDD13E2DBA16F6D77EE8DDCE7DF86DAD06D40837F88149CE52E4403AC981BD04AB5859
Malicious:	false
Preview:	L..................F.... .................E.n.U................................DG..Yr?.D..U..k0..t. .CFSF..2......X/R .WinRAR.chm....t.Y^...H.g.3..(.....gVA.G..k...B......JYWBJYWB.........................W.i.n.R.A.R...c.h.m...F...l...............-...8...[...........Dg.v.....C:\Users\..#...................\\971342\Users.user\WinRAR.chm..P.r.o.c.e.s.s. .R.A.R.,. .Z.I.P. .a.n.d. .o.t.h.e.r. .a.r.c.h.i.v.e. .f.o.r.m.a.t.s.......\.....\.....\.....\.....\.....\.....\.W.i.n.R.A.R...c.h.m...C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.e.s.k.t.o.p.........................\|....I.J.H..K..................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......971342..........D_....3N...W...9..W.e8...8.....[D_....3N...W...9..W.e8...8.....[....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk

Download File

Process:	C:\Users\user\Uninstall.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 10 07:18:43 2024, mtime=Thu Oct 10 07:18:43 2024, atime=Wed May 15 06:35:22 2024, length=3286680, window=hide
Category:	dropped
Size (bytes):	833
Entropy (8bit):	4.806228346687001
Encrypted:	false
SSDEEP:	12:8mRp4m7CwoFszAvisWMlWlEarcWxszAUmTFp6NwuG3YilMMEpxRljKZTdIy/TdIX:8mkuy4bsWkWCyx4fw3q057u
MD5:	3CA6780E7BF7ECC5ED8583BB4FFDBA77
SHA1:	4716B016A2C55D1293CBA022497B4EE78D7D78EA
SHA-256:	2872125D3B46562B89D81063E6ED5AC848E33A6AAB1DED3EC06DED270F09E077
SHA-512:	0ED070A74F74FDC2787F13F1873A4FA1E46D845BF1564368C0F84C78510CFACB1DB9F3B7DF5A6609361C7F0FD29BBFC8F6C3E9098B9B40244B8D7754B3BD6BE2
Malicious:	false
Preview:	L..................F.... ...e.R.....e.R........q.....&2..........................DG..Yr?.D..U..k0..t. .CFSF..2..&2..Xl< .WinRAR.exe....t.Y^...H.g.3..(.....gVA.G..k...B......JYVBJYVB.........................W.i.n.R.A.R...e.x.e...F...l...............-...8...[...........Dg.v.....C:\Users\..#...................\\971342\Users.user\WinRAR.exe..P.r.o.c.e.s.s. .R.A.R.,. .Z.I.P. .a.n.d. .o.t.h.e.r. .a.r.c.h.i.v.e. .f.o.r.m.a.t.s.......\.....\.....\.....\.....\.....\.....\.W.i.n.R.A.R...e.x.e...C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.e.s.k.t.o.p.........................\|....I.J.H..K..................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......971342..........D_....3N...W...9..W.e8...8.....[D_....3N...W...9..W.e8...8.....[....

C:\Users\user\Default.SFX

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	448000
Entropy (8bit):	6.477949014491552
Encrypted:	false
SSDEEP:	12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t4:xuDXTIGaPhEYzUzA0/0
MD5:	AB1C239D68D65D84EE139DD0C8CE8A52
SHA1:	1A638556DE77369151839BF7A570D972410360E3
SHA-256:	B83A105DDA4806F7AC5E9F3B6546829B37D42D85911D1C4487B1E95BFEA91E9D
SHA-512:	EA2306628F2079BDF5420C12AF3D097C78FB3D3CD90AE2283C6F591E0751325F3AF675BB257B812BABB4D03F7493E2819B97FCA969DC9B5031EC07BB8517ECFB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: nIoRMxnlzt.exe, Detection: malicious, Browse Filename: nIoRMxnlzt.exe, Detection: malicious, Browse Filename: XmS_Project.rar, Detection: malicious, Browse Filename: TT ViewBot v3.7.zip, Detection: malicious, Browse Filename: test.pdf.lnk.mal.lnk, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h...8.................@..........................................`.............................................4......P.......`.......l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...`...........................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\Default32.SFX

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	366592
Entropy (8bit):	6.676160748927781
Encrypted:	false
SSDEEP:	6144:pVJQ3KJxNVhbU3y83OI1SFc+gcYjhLPNVOIopJrX+t4rR8o:7Jf/DdUC83OIgFc+tYjhLFH8rX+t498o
MD5:	C5BCFD921F209366B9CFED632B174A3B
SHA1:	332E2AEB7BC2D4491CBE4B994DBB8FF8E55FFF9F
SHA-256:	476E3F779D2638238EA185DF6019E4FCB54B3704AD12DBD051399FCF26E6E1BF
SHA-512:	72C0D13FA20A7648074601D5726F02C46EA7E62761F80366C2EBDCE40D95568543E11D42907D789864D178D5DA73992FC50400A50FC777B1BC02A02F9276FC55
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v..p2.b#2.b#2.b#.E.#?.b#.E.#..b#.E.#.b#...#0.b#..f"!.b#..a".b#..g"..b#;..#9.b#;..#5.b#2.c#,.b#..g"..b#..b"3.b#...#3.b#..`"3.b#Rich2.b#........................PE..L.....@f...............!.............e............@.......................................@.........................p}..4....}..P.......`....................p......E..T....................F......X...@...................,r.. ....................text...,........................... ..`.rdata..............................@..@.data................t..............@....didat.......p......................@....rsrc...`...........................@..@.reloc......p...,...l..............@..B................................................................................................................................................................................................................................

C:\Users\user\Descript.ion

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1984
Entropy (8bit):	4.660424973452362
Encrypted:	false
SSDEEP:	48:1dilPla18jQ1TfzG7D6nmoLP0UTdfwGQ68Z:1VfwoLMUTO9
MD5:	84846ABC52DC17020E4E934D3C94B4E6
SHA1:	94562A3E13B3EDCCF1848EC0743CAF0E32ED5E3E
SHA-256:	3449FD40D054C96285FAB92011E732174C7CD000EDA67470376F26F0D431F1F2
SHA-512:	9B8CF7844D346B806E2FF6FE9D165D82FC7B4F764846C0F9B30443672E585F588399CF915DF728743E420FC8E58008F0373F7570C8483A2E408567AA1026900E
Malicious:	false
Preview:	7zxa.dll 7z decompression library..Default32.SFX 32 bit GUI RAR SFX module..Default.SFX 64 bit GUI RAR SFX module..Descript.ion File descriptions..License.txt License for use and distribution..Order.htm Registration information..Rar.exe Console RAR..Rar.txt Console RAR manual..RarLng.dll Language resources..RarExt.dll WinRAR shell extension..RarExt32.dll WinRAR shell extension for Windows x86..RarExt64.dll WinRAR shell extension for Windows x64..RarExtInstaller.exe Tool to install and uninstall WinRAR shell extension..RarExtLogo.altform-unplated_targetsize-32.png Graphic file for WinRAR shell extension..RarExtLogo.altform-unplated_targetsize-48.png Graphic file for WinRAR shell extension..RarExtLogo.altform-unplated_targetsize-64.png Graphic file for WinRAR shell extension..RarExtLogo_Default.altform-unplated_targetsize-32.png Graphic file for WinRAR shell extension..R

C:\Users\user\License.txt

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6880
Entropy (8bit):	4.374157879775667
Encrypted:	false
SSDEEP:	96:1ikG8jtbvVq93CLbKTy2tqxULp6C2t1fAOzm44owhAV4aOY5X3Uq2teNAZjweJ:k4DVqQKuABQvpDBEFtey6A
MD5:	672064CF19DB0B083B981CF0BE7662B0
SHA1:	C200C77558CA77C044A2C2D794C98F8437FFD2B4
SHA-256:	9FC8AA33CCAFA04C1CE4C0A61047B341297D720ADAB1B77F67B5FE59F43BB59F
SHA-512:	A016B287B6D1A4320BD5AB5790163F837A28B54D8BCCA56A51DC8B6A50374AACB35C0341D42915CD97D3B135DBF1F363087A4631DEB69F82811D41DB2F78A0A8
Malicious:	false
Preview:	END USER LICENSE AGREEMENT.... The following agreement regarding RAR (and its Windows version - WinRAR).. archiver - referred to as "software" - is made between win.rar GmbH -.. referred to as "licensor" - and anyone who is installing, accessing.. or in any other way using the software - referred to as "user"..... 1. The author and holder of the copyright of the software is.. Alexander L. Roshal. The licensor and as such issuer of the license.. and bearer of the worldwide exclusive usage rights including the rights.. to reproduce, distribute and make the software available to the public.. in any form is win.rar GmbH, Marienstr. 12, 10117 Berlin, Germany..... 2. The software is distributed as try before you buy. This means that.. anyone may use the software during a test period of a maximum of 40 days.. at no charge. Following this test period, the user must purchase.. a license to continue using the software..... 3. The software's tri

C:\Users\user\Order.htm

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3416
Entropy (8bit):	5.03176338065389
Encrypted:	false
SSDEEP:	48:Mq9YxlbkLgrjd0M8LTyMMNnkVZcJE5NRQ3aTN1x2LJJ/krkhA/lSDFOeGfVKrlx:MTsgSJZcJETRkaqr1UlS5zGfVclx
MD5:	5C336DE3B3D794322AD9E5915E3A509F
SHA1:	5256262A417E9A29FE23E8CCA09782C7A3532FC9
SHA-256:	BCE29EF3B95306CB7B304FB8C3039BE7157356D9F9D4E7E1C6BFBF02A117F48F
SHA-512:	7243C9B8EB39FC8AA10EC8B5C290E27D44FA1C245F0478B75AE77964C178D41E9C1F651F987316F1153C1A7176EECEBC269FFB0C42CED5BD0B12E5CC1B95DA04
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".. "http://www.w3.org/TR/html4/loose.dtd">..<html>....<head>..<title>How to buy WinRAR and RAR license</title>....<script type="text/javascript">.. ..function px(addr)..{.. for (I=0;I<addr.length;I++).. if (addr.charAt(I)=='z' && I+1<addr.length && addr.charAt(I+1)=='y').. I++.. else.. document.write(addr.charAt(I));..}....function mx(addr,text)..{.. document.write("<a href=\"mailto:");.. px(addr);.. document.write("\">");.. px(text);.. document.write("<\a>");..}..//-->..</script>....<style type="text/css">..body {font-family: "Arial",serif; font-size: smaller; background-color: #ffffff;}..h4 {text-align: center;}..</style>..</head>....<body>....<h4>How to buy WinRAR and RAR license.</h4>....<p>If you wish to use WinRAR and RAR after the evaluation period of 40 days,..you need to purchase its license from one of the regional dealers..<a href="https://www.rarlab.com/registration.php">listed here

C:\Users\user\Rar.exe

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	762520
Entropy (8bit):	6.480895043803242
Encrypted:	false
SSDEEP:	12288:F09QJ3MbqLyQx5ooXTAl080ejQsg6Udqmoy6jEIq+EpNUstSpx:G9C3MbqyeOojATzjaPiyQq+EpNlSpx
MD5:	16659AE52CE03889AD19DB1F5710C6AA
SHA1:	66B814FE3BE64229E2CC19F0A4460E123BA74971
SHA-256:	0B1866B627D8078D296E7D39583C9F856117BE79C1D226B8C9378FE075369118
SHA-512:	F9DD360C3A230131C08C4D5F838457F690ED4094EC166ACD9F141B7603F649CFA71A47EA80E9FF41B8296246BDC1C72A75288F9A836C18431E06C2E8E3FC8398
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Sg`.................................}......}......}.......~......}..!....~.............}..^...}......}......Rich............................PE..d....@f.........."....!............@..........@.....................................8....`..................................................^.......0..H........N...z...(..............T.......................(.......@............................................text............................... ..`.rdata...q.......r..................@..@.data...\A.......6...b..............@....pdata...N.......P..................@..@_RDATA..\.... ......................@..@.rsrc...H....0......................@..@.reloc...............n..............@..B................................................................................................................................................................................

C:\Users\user\Rar.txt

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	108383
Entropy (8bit):	4.26316643545334
Encrypted:	false
SSDEEP:	768:FoxKukh1SIfjcjKVbRZHqT9E1qYiHSzoOKyGi018e5xCwVxD+wb+WkOPMYC7:FoxKuOKKV9Z699S7Kyi1ZbF7iWBXK
MD5:	B954981A253F5E1EE25585037A0C5FEE
SHA1:	96566E5C591DF1C740519371EE6953AC1DC6A13F
SHA-256:	59E40B34B09BE2654B793576035639C459AD6E962F9F9CD000D556FA21B1C7CD
SHA-512:	6A7772C6B404CD7FEE50110B894FF0C470E5813264E605852B8DCC06BFAEB62B8CC79ADCB695B3DA149E42D5372A0D730CC7E8ED893C0BD0EDB015FC088B7531
Malicious:	true
Preview:	User's Manual.. ~~~~~~~~~~~~~.. RAR 7.01 console version.. ~~~~~~~~~~~~~~~~~~~~~~~~.... =-=-=-=-=-=-=-=-=-=-=-=-=-=-.. Welcome to the RAR Archiver!.. -=-=-=-=-=-=-=-=-=-=-=-=-=-=.... Introduction.. ~~~~~~~~~~~~.... RAR is a console application allowing to manage archive files.. in command line mode. RAR provides compression, encryption,.. data recovery and many other functions described in this manual..... RAR supports only RAR format archives, which have .rar file name.. extension by default. ZIP and other formats are not supported... Even if you specify .zip extension when creating an archive, it will.. still be in RAR format. Windows users may install WinRAR, which supports.. more archive types including RAR and ZIP formats..... WinRAR provides both graphical user interface and command line mode... Wh

C:\Users\user\RarExt.dll

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	651416
Entropy (8bit):	6.694392253598639
Encrypted:	false
SSDEEP:	12288:CheO83S/X2oc1fZy4CArT0pLGbNUnaC7PeUnBd3X3uK:CheOIS/GzfZpopLGbNUL2UnBd3X39
MD5:	1E86C3BFCC0688BDBE629ED007B184B0
SHA1:	793FADA637D0D462E3511AF3FFAEC26C33248FAC
SHA-256:	7B08DAEE81A32F72DBC10C5163B4D10EB48DA8BB7920E9253BE296774029F4EF
SHA-512:	4F8AE58BBF55ACB13600217ED0EEF09FA5F124682CEDD2BFC489D83D921F609B66B0294D8450ACB1A85D838ADB0E8394DADF5282817DBA576571E730704F43AC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......gYP.#8>G#8>G#8>Gh@=F$8>Gh@;F.8>G.C.G'8>G.C:F38>G.C=F)8>G.C;F.8>Gh@:F28>Gh@8F"8>Gh@?F48>G#8?G'9>G.C7F.8>G.C>F"8>G.C.G"8>G#8.G"8>G.C<F"8>GRich#8>G................PE..d.....@f.........." ...!.8...z............................................................`A............................................l...,........0..8........].......(...........)..T....................*..(...`(..@............P...............................text....6.......8.................. ..`.rdata...n...P...p...<..............@..@.data...............................@....pdata...].......^..................@..@_RDATA..\.... ......................@..@.rsrc...8....0......................@..@.reloc..............................@..B........................................................................................................................................................................

C:\Users\user\RarExt32.dll

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	554648
Entropy (8bit):	6.907707531547957
Encrypted:	false
SSDEEP:	12288:WM7zuNOwsIJur4LnQkAifUsogbesSEpwpDBd3X3uQDc:WSz/ug4LQdh2es8pDBd3X3hc
MD5:	24F6FAA5D2E9C8FB15AE0C936BFA4545
SHA1:	17F85D25F0F0C15A164EB11A34F498268677DCB0
SHA-256:	BD3F01E7C100422A6FAAE60D76DA16158F6D8B3868D474E81FD657EC3C0127EF
SHA-512:	CD3F4DD020CAD0357BE2CC18459E7051D65F05B5DF60A8D980152179DFF6CC8DEDF9FEF758224E9B6ADC87DE9033D18DAA3E09AEA8AF2E2A1860EFC753A01380
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........l.....................h...t.......t.......t.......t.................................z.......z.......z..............z.......Rich....................PE..L.....@f...........!...!.v...................................................p......~0....@A.........................p..l...Lq..........8............N...(...0..T1.../..T...................@0......./..@...............(............................text....u.......v.................. ..`.rdata...............z..............@..@.data................n..............@....rsrc...8............~..............@..@.reloc..T1...0...2..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\RarExtInstaller.exe

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	186008
Entropy (8bit):	6.251929166363143
Encrypted:	false
SSDEEP:	3072:YCXGYJKNlePjzWBEFxwk6m9xy7n/covzScPdpKatjS:YCXpAmzWGSk6mYc4rLDG
MD5:	F5B54D16610A819BBC6099BDC92ADD2C
SHA1:	7C680A87233FF7E75866657E9C1ACF97D69F6579
SHA-256:	46F533007FB231D0B0AF058A0997AB5E6B44A1B02AE327621F04FDC4B2E18964
SHA-512:	A120A2EE6C926CD6F6B8D1BE68FF471294552B049BAA637A474D1210FE3CA83E66D0834217D1A5EEA0491D080CEA1795EE328FDD4CB54F6A132BE2DC2E58E4A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.....N...N...N.f.O...N.f.O...N.f.OC..NIv.O...NIv.O...NIv.O...N.uEN...N.f.O...N...N...NGv.O...NGv)N...N..AN...NGv.O...NRich...N................PE..d.....@f.........."....!.....&.......~.........@..........................................`..................................................w..................l........(......,....I..p............................G..@............................................text............................... ..`.rdata..............................@..@.data...p*...........n..............@....pdata..l...........................@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................

C:\Users\user\RarExtLogo.altform-unplated_targetsize-32.png

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2183
Entropy (8bit):	7.892242389507994
Encrypted:	false
SSDEEP:	48:XJu59Mz9ZOj4v0y+ptQo0QOKNxO4a9hOAZ0CZLFua1Q1WGl:XJK9MZ8K+pio0Q13OFWAZ0SLFFO1WO
MD5:	85EE643E6B0837849E300B11395422C4
SHA1:	4634019350AD8DD59FD6C99B4AABEA99CDF06BDD
SHA-256:	8D42F3961E0E381EE32D3E1E144BFBB59294D43A9965E895FC75B8827ACD98E6
SHA-512:	C744A6B2D64121A7AA279CD197790512C9B97264E70D7399BE992FC6F53BAE31B7143ED299B1A47E5DB1AD9BB82D982AE0988CDDF5E4E52814C5A3EADD107D95
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....NIDATX..Y..U..?g...2...m....i...4.....`.q..../jLT....#...E....1.<H.F.D.........e...s....v...p......y......]~.w.=^J~.._S...y.?7z..\|.x....(epY.H...{.N....,[.G...R...5....Lv.g.(..#.<...C......\.l...~.^/e....2.>0.4......0q5...,.K%.Z.........wZ....O.. ].BX.:.8...L..$.U./.d.+.a..........[.A.A..R.@=.F.....7......4.K.o...g.K`..V-......%0?...6s......g..$t.N.^\"..}....2*......&.C.l...`....p.. /...~.;y.,.B.d...J.[G...7r..:{..J..2....k%o..d..NZ......,.K.%P.PR0.+Y.[.;.^..ePz..96.o..Lh.-..aW.h..YH...t...NC.P.z.Zyg.G..._.G.1...j(.....ix.........3.g..K2..b2ow.1)'.\>.}..0[&k....y.p~>..p...2P1..X....9s...i{MUi.f..XNHy..j.....I=.^............2............}.d.. 3....j..J..T..Qh...V..F.r0.j...<.DcyC~Q.7^7..C.Le. t..Z....\c.Zc#...].F@.....w.0.kl.U.......+..(..J.j.@D.J.%.+.b(..yQR...Aj.J..U9<..S.c.Ch....7$.".s..6..k....]6v.2.{w......5x...Y....e..yT..=.M..?..V.-uXB.....[v36v..Z...Jk.V.R......iM.y.,g.....;>...f......o....OC.c.j<..(

C:\Users\user\RarExtLogo.altform-unplated_targetsize-48.png

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4179
Entropy (8bit):	7.941638225376268
Encrypted:	false
SSDEEP:	96:HsNP4L15zRkIEBdPWt+zIeofvdWIcq4dkuRQVRv6hKXUvBzpoLb+qSEsYqw/m+wC:MNP015zRk/uczQfsIcq4SuiVx6KXaBzk
MD5:	EC177CBE676473543E8C9B5D9FB0B797
SHA1:	0D1BB7649D090831D2AB1F2FB44F580E0D4004D3
SHA-256:	5E3C8BBCD81CD0C08819EDCBE04772DBD157F79373A0171B7BD914CF7A2CDEF9
SHA-512:	925A86B5BE1C9FE91CC587B71A3E0D2FBF8EDDEF06093A8356BFFA955B63C296A041729DB38A9538DFC811B723E0ACA4B7A183AB0E9D12D0A302D1239DB12374
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......IDATh..K.f.u..k.}...~..zWwU..v.6....+(....l).@+J.(AH.d..+(R..D...2.H.D....!A..A@..+...v...U....{o..=.c.V..[..KL...Ogp......_...o.o.oi...-....0...5'D....K.q..{A.......y................/P.~...* . .....O.T.....,..'...G..a.....Sd~.a...O.={..&{%E..............;...(..;..\|.\.Sp.5..._....}.[..>.+....C...p...&G.c.mX.7..O.'.5....]......b.e...;...~...v.....h...-G.PRxG.. ...1.......fq#.Z.D...=6..o~.....~.{..?..#....2u......ABg.?.c..z....B.K.`6......5.}k...1.o...../6RR.. ........CM.#:m^...@l`}.&6.....?3....5..o....t...W.....6_3?\a(.....\|..>...7x..ekLL...9.].....O...#..+7.>~,prp..#.O8..;.....f...0..)..s.oX.#.~....[.O..M&.....:.Y<Xs...\|..........T#.PO1W...........'H...9....h..r.-Yh...D....1\|....h,..H.[.....rxx..L{.C.Q.W....q......?..s.X..Da...I<^@..\|.\|.B....:.,N..8.7<..Q........C...2..R..b.M{L...&Xg.&.{$...4.H=...\|........).&G.."lS.E`[..(.g..$.i8.N79..R.a.9>.;.b.Y..z".....I.V.G.......X.d....h.{4e....p...(

C:\Users\user\RarExtLogo.altform-unplated_targetsize-64.png

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6234
Entropy (8bit):	7.9623011066892895
Encrypted:	false
SSDEEP:	192:F7LhuPsvwxZKPeCHV6sZ68EUDfHZkmoWsm:F7SxEDHV6sZd3Nsm
MD5:	248FA2B659874A14B43B5E0E17AC1CFF
SHA1:	B6B0671E015104EE7F4BAC4E6ABF961EC55FDB12
SHA-256:	ED99246EBC6FAD80103F1E887DD8388F67EB509FCBBA187AAA13556B8D884AB2
SHA-512:	1A8E9F0C13D565CDAE77CC17942792E33861F056F73422EB2DF79FBA5DC241A37106C0BF7173F9BA83F517E2016E9D3B8E117DF2BD2D5972155781DBF147F90A
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq....!IDATx..Y.^...k.}.7....5:UI%.......M..4$.R.@..~@B.7@<.3.... .H./-!.....A.PBe.RT....l.....^..}.]e...<um....g..............._..V7~...z.+.......H.4.. ..D.04.1'............../.......KW@.h....`. L....F.6.........6`.!.5c.g.6..B..F.s!..........W.....vu...........'......./.."ORx.=....- ....n.....=].....pn.....0S.1.......}`I.Y.Z..m.4...O....h..3......p...l..t[...SB......N.@1..3..u...q.".J .y.....s..?d.)9;..G.a..G....K.49r...=...i2......Pq..6..o1............N....4aZy....G.v...[.j.8T.......?....=NB.T._.h\|...l.l6.L7.......}...^~./..e~.@#Ml8z...W......[\|..\|.q...>.Z.7.6=......W.........#..c.....h&..j...)..4..m..0..r..}.z.f..b.4.....i..^.G.;...}>B...eH...h..v....Z...Oq.._..~.f.F.M.l.dH....=......W..{..>....Y..cz.i4#=..G.G............y:.Y.G.....A.. ........'..t......._.....?z..j..'w=.<).........%.7x...X~.......h]d..S."a.X....... ..%b.C...6.3..~.2...5.U..Q..#.dSz..5...._."....-6.._9...L.<i....g....zLo..\.;.

C:\Users\user\RarExtPackage.msix

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	Zip archive data, at least v4.5 to extract, compression method=store
Category:	dropped
Size (bytes):	24440
Entropy (8bit):	7.925485516468654
Encrypted:	false
SSDEEP:	384:DBR015ziBz4oqvhFv+qkDmm0fxPZp7SxEDHV6sZd3NsSkI8mvC4j9tEIkTXBHhjA:PYzMzHshFvbkD9oZ06MsZd3w/abEIABS
MD5:	4EBEB72C7DA644A296A0026C061DB51D
SHA1:	6F94EA0EAE2664C8341265D62FF7D871DA702A76
SHA-256:	DE451E233072B0D34ACECF04DDC38BCAD61B56A1E0218041CA0A80AD752BACCF
SHA-512:	B4937191D5A61EBC41497938DA51F6C741D3DA6A9213E236CD62F82B106D311DB597C613BC924C18E3BDC654F3F8526F43CF13EDE0F00380AC22382713570153
Malicious:	false
Preview:	PK..-......z.X................StoreLogo.png.PNG........IHDR...2...2......?......sRGB.........gAMA......a.....pHYs..........o.d...WIDAThC.... .......)...I.k?.5?.n?.H...#5Fj....1Rc..H...#5Fj....1Rc..H...#5Fj....1Rc.e..<..`........IEND.B`.PK..@.k.................PK..-......z.X................Square150x150Logo.png.PNG........IHDR.............<.q.....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....0..........o.......e..V....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H....H......\|"A.(.2.....IEND.B`.PK..^bO.................PK..-......z.X............-...RarExtLogo.altform-unplated_targetsize-48.png.PNG........IHDR...0...0.....W.......IDATh..K.f.u..k.}...~..zWwU..v.6....+

C:\Users\user\RarFiles.lst

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	4.704353931608651
Encrypted:	false
SSDEEP:	24:XB0Ku+6fYEbsaoprp2Xc9wARVo+iL/5BiiUWeiaQPxvjf:xvSQEEpT2AXG/rPfP5
MD5:	E70E22D45ECB35217D66A4CE30F081FA
SHA1:	A5F6C6E1335596D50E89F99267773E30BEBE159E
SHA-256:	9EB1099D7231CD24D8740609D3AC6985139F2334730356DF983AB01D7896AD6F
SHA-512:	638AB88BCF95AA16E2F15036F3DE1C5803A30B518B1A283464444A9B2F04B45F7927FB3C4BF666740C8D042C991D872B6D5749BBD9A721A42DDE6DBF9F549CD3
Malicious:	false
Preview:	; File order list for solid archiving..;..; Here you may modify the file list which tells RAR the order in which..; to add files to a solid archive...;..; This file may contain file names, wildcards and a special entry - $default...; The default entry defines the position in the order list for files not..; matched with other entries in this file. Lines beginning with the semicolon..; symbol ';' are considered as comments and not processed...;..; Place this file in the same directory as RAR.EXE...;..; Tips to provide improved compression and speed of operation:..;..; - files containing similar information should be grouped together in the..; archive if possible;..; - frequently accessed files should be placed at the beginning...;..file_id.diz..descript.ion..read...readme....nfo...doc...txt...htm...html...shtml...css...xsl...xml...js...php...lst...log...ini...bat...cmd...h...hpp...c...cpp...java...asm...bas...bak...cue...rtf...hlp...inf...com...exe..*.dl

C:\Users\user\ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1288
Entropy (8bit):	4.706456912766128
Encrypted:	false
SSDEEP:	24:wT562i+znj04COlBEaT336uSXqzcrfMLosGPjJn9kn7f28hUHT16:wT562i6j04PBnj3PSXKEfKoseTc7f28v
MD5:	00D0A57A6D64EE3DE8F4D5529D6C6447
SHA1:	56C7A7FEFB01AA0A032A8E0F91EA9EFF53BEE1F3
SHA-256:	FCD13E1B97AF47B8B923BA97AE15E9731C66093609667C3171D5DD24A6F7F2E6
SHA-512:	A644967D0CD6EF47324B2E8C52698318C658D1B3B37E5F4DE5E6897AF9CA951B0611CEBA5C6D3E087CA9958286E481BECF9BBFA1C483CB11EBD2F4BE7526F474
Malicious:	false
Preview:	This archive contains WinRAR multifunctional archive manager..... WinRAR features:.... * WinRAR introduces an original compression algorithm. It provides.. a high compression ratio on executable files, object libraries,.. large text files, etc..... * Internally RAR format does not limit archive and file sizes.. also as a number of files in archive. These values may be limited by.. file and operating systems also as by available memory..... * WinRAR provides complete support for RAR and ZIP 2.0 archives.. and is able to unpack 7Z, ARJ, BZ2, CAB, GZ, ISO, JAR, LZ, LZH,.. TAR, UUE, XZ, Z, ZST archives..... * WinRAR offers both a classic interactive Windows interface.. and the command line interface..... * WinRAR provides functionality for creating a 'solid' archive,.. which can raise the compression ratio by 10% - 50% over more common.. methods, particularly when packing large numbers of small files..... * WinRAR offers the ability to create customizable SFX archive

C:\Users\user\Resources.pri

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	data
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	3.946312688270784
Encrypted:	false
SSDEEP:	48:W8LxIIwIIrIITIIk1Wx32oG9hwTrazcOIIshUdIIwMIIwhIIw1yF:WIOI9IcIEI7TGMTWyInKIYIfIvF
MD5:	43CB15C1F1CC705305AEBA33B0A9EE73
SHA1:	52B4CBF1C3ED4494837F54EAFA3E7294BA8E5485
SHA-256:	A7BB097441D9F06DD7A8D08874D70E7495626760C05284CA1AE3A208C11B52F0
SHA-512:	179DDA1518AEC276AE01BD7966272BBD545072077B34FB07396EC47C5B11ADBDDD00AB385D4EE2131A3C1C5265857434A51BE4F33AC7CCD8C4E4B4DFDA8D9C6F
Malicious:	false
Preview:	mrm_pri2....h... ... ...........[mrm_decn_info].................[mrm_pridescex].............P...[mrm_hschemaex] ........@...x...[mrm_res_map2_].................[mrm_dataitem] .................[mrm_dataitem] .............h...[mrm_dataitem] .........h...h...[mrm_dataitem] .............h...[mrm_decn_info]...................................................................,.......d.......,.......,.......................................................................................3.2...U.N.P.L.A.T.E.D...4.8...6.4.............[mrm_pridescex].........P...................................................P...[mrm_hschemaex] ........x...............[def_hnamesx] .........Z..z........m.s.-.a.p.p.x.:././.R.a.r.E.x.t.I.n.s.t.a.l.l.e.r./...R.a.r.E.x.t.I.n.s.t.a.l.l.e.r.............................K...................F..0........A.. ........R.. ........S.. '.......S.. =............................Files.AppxManifest.xml.RarExtLogo.png.Square150x150Logo.png.StoreLogo.png..........x...[mrm_res_map2_].

C:\Users\user\UnRAR.exe

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	506008
Entropy (8bit):	6.4284173495366845
Encrypted:	false
SSDEEP:	6144:yY8mmN3YWYGAj9JwXScp39ioIKzKVEKfr01//bbh3S62Wt3A3ksFqXqjh6AusDyn:yY8XiWYGAkXh3Qqia/zAot3A6AhezSpK
MD5:	98CCD44353F7BC5BAD1BC6BA9AE0CD68
SHA1:	76A4E5BF8D298800C886D29F85EE629E7726052D
SHA-256:	E51021F6CB20EFBD2169F2A2DA10CE1ABCA58B4F5F30FBF4BAE931E4ECAAC99B
SHA-512:	D6E8146A1055A59CBA5E2AAF47F6CB184ACDBE28E42EC3DAEBF1961A91CEC5904554D9D433EBF943DD3639C239EF11560FA49F00E1CFF02E11CD8D3506C4125F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.}............\|.&.....\|.$.J...\|.%.....H}*.....H}./....H}./.....~P.....H}./.....~D.........z...F}./....F}(.....F}./....Rich............PE..d.....@f.........."....!.b.....................@.....................................'....`.................................................\|...........H........4.......(......8...0I..T....................J..(....G..@............................................text....a.......b.................. ..`.rdata...3.......4...f..............@..@.data...............................@....pdata...4.......6..................@..@_RDATA..\...........................@..@.rsrc...H...........................@..@.reloc..8...........................@..B................................................................................................................................................................................................

C:\Users\user\Uninstall.exe

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	488600
Entropy (8bit):	7.025557043139148
Encrypted:	false
SSDEEP:	12288:9Z5zraThq5dDnHEJt1kXm+wBhvBJ/+5IISY1A9h:9Z5n2hsdDnkGXm9Bhvn/+r1+h
MD5:	4783F1A5F0BBA7A6A40CB74BC8C41217
SHA1:	A22B9DC8074296841A5A78EA41F0E2270F7B7AD7
SHA-256:	F376AAA0D4444D0727DB5598E8377F9F1606400ADBBB4772D39D1E4937D5F28C
SHA-512:	463DFF17F06ECA41AE76E3C0B2EFC4EF36529AA2EAED5163EEC0A912FE7802C9FB38C37ACFE94B82972861AAF1ACF02823A5948FBB3292BB4743641ACB99841E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A....................d...z.v.....z....z....z................................t....t.t.....t......Rich............PE..d.....@f.........."....!.............O.........@............................. ......@v....`.................................................D).......0..T......../...L...(......T...0...T.......................(.......@............ ..p............................text...^........................... ..`.rdata..".... ......................@..@.data........@......."..............@....pdata.../.......0...8..............@..@_RDATA..\.... .......h..............@..@.rsrc........0.......j..............@..@.reloc..T............B..............@..B................................................................................................................................................................................................

C:\Users\user\Uninstall.lst

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	793
Entropy (8bit):	4.866183859305658
Encrypted:	false
SSDEEP:	24:vY7Opm2lX+KBJlHchkyiQyaI6qI8I1Xou6qu8u1Xm:gAXNHYkyi3cP1had1W
MD5:	6EEEFCB85673C14201D024B6E6AC6258
SHA1:	DD3BBAD1B014F8D8E9F981AC0DEB9F2F343C5CF4
SHA-256:	B75FDEE208D2834AB147DACB51F4E7D70E44457C8B639048FE67B252B8D61F1F
SHA-512:	D68322F4B861F05876E9B3F349D135B3DF115A52B93C52590A1DC240089AB0DCDB256F91FCA01FD65DC8E689EE53CBD106337BBDA42D402D12B9DCA90434671B
Malicious:	false
Preview:	7zxa.dll..Default32.SFX..Descript.ion..License.txt..Order.htm..Rar.exe..Rar.txt..RarExt.dll..RarExt64.dll..RarFiles.lst..ReadMe.txt..Uninstall.exe..Uninstall.lst..UnRAR.exe..WhatsNew.txt..WinCon32.SFX..WinRAR.chm..WinRAR.exe..Zip32.SFX..rarlng.dll..rarnew.dat..zipnew.dat..rar.lng..rarext.lng..setup.lng..sfx.lng..uninstall.lng..winrar.lng..winrar.chw..Default.SFX..Zip.SFX..WinCon.SFX..RarExt32.dll..RarExtInstaller.exe..RarExtInstaller.exe.manifest..RarExtPackage.msix..RarExtLogo.altform-unplated_targetsize-32.png..RarExtLogo.altform-unplated_targetsize-48.png..RarExtLogo.altform-unplated_targetsize-64.png..RarExtLogo_Default.altform-unplated_targetsize-32.png..RarExtLogo_Default.altform-unplated_targetsize-48.png..RarExtLogo_Default.altform-unplated_targetsize-64.png..Resources.pri..

C:\Users\user\WhatsNew.txt

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46292
Entropy (8bit):	4.525159711057252
Encrypted:	false
SSDEEP:	384:cZIEmAyhs0z4NNVmF5OgUDBA2XCh9Iq1IAnUc9joBHLKp63xUA5B33vX6TBcxAfL:cZ41kVEbUDbwXic9p63Df3fXxuWJo4c
MD5:	1C44C85FDAB8E9C663405CD8E4C3DBBD
SHA1:	74D44E9CB2BF6F4C152AADB61B2FFC6B6CCD1C88
SHA-256:	33108DD40B4E07D60E96E1BCFA4AD877EB4906DE2CC55844E40360E5D4DAFB5D
SHA-512:	46D3FB4F2D084D51B6FD01845823100ABC81913EBD1B0BCFEB52EF18E8222199D282AA45CAE452F0716E0E2BF5520F7A6A254363D22B65F7AB6C10F11292EE2D
Malicious:	false
Preview:	WinRAR - What's new in the latest version...... Version 7.01.... 1. Bugs fixed:.... a) updating an encrypted file in a solid RAR archive produced.. a corrupt archive if updated file was the first in archive,.. no password was specified when starting updating and file name.. encryption in the updated archive wasn't enabled;.... b) WinRAR 7.00 crashed after switching to "Flat folders view" mode.. from archive subfolder;.... c) switch -ep4 duplicated the specified path instead of excluding it.. when extracting;.... d) if archive created by Unix RAR version contained symlinks with.. path separator characters in target paths, these characters could be.. broken when modifying such archive with Windows RAR;.... e) invalid file name was displayed in file rename and file execute.. WinRAR error messages;.... f) SFX "Shortcut" command failed to recognize empty parameters.. def

C:\Users\user\WinCon.SFX

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	382976
Entropy (8bit):	6.2782769555064935
Encrypted:	false
SSDEEP:	6144:KSyrfN+mx1KqjlxAGcQn6vGF3tUImBV15dp6zOmBjC/TGq39YyperSp:KSy731KkuQwtVXdpGjA39YPrSp
MD5:	11217B1A96E83FF6B0DF1DFC0CD804E7
SHA1:	FB824D799554180D7A1C42827C942EB31BEDFD60
SHA-256:	F73F4751DC2B4493CB99E644E6A94F55B4B956B40F0709E205DDAFB512CD1296
SHA-512:	82528862BD375E724DFD6976C3411AF95472AB8355C381064D103DE14376263BC497B73B2A9B343E05467CDC05C5F4A4ECC0A413EE39D40D59D999F963D51E19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......}...9..X9..X9..X.G0X1..X.G2X...X.G3X4..X..<X;..X...Y+..X...Y3..X0.FX8..X...Y...X0.RX0..X9..X...X...Y...X...Y8..X..>X8..X...Y8..XRich9..X........................PE..d.....@f.........."....!.......................@..........................................`.............................................4.......P....P..H.......,+..............@...@...T...........................@3..@...............0...\...`....................text............................... ..`.rdata..............................@..@.data...l........&..................@....pdata..,+.......,..................@..@.didat..p....0.......D..............@..._RDATA..\....@.......F..............@..@.rsrc...H....P.......H..............@..@.reloc..@...........................@..B................................................................................................................................

C:\Users\user\WinCon32.SFX

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	315904
Entropy (8bit):	6.438879283746244
Encrypted:	false
SSDEEP:	6144:Jc+iPZ8eA2KjsnHocFconGhZeD774evVSp4:5ZsKjsHpFconKeD77XSp4
MD5:	E5F0C2C4F60BD298855DFE0019C63043
SHA1:	C741358D77584D9BF055C35BB7D0AC8E44231291
SHA-256:	A339A384B1B69D58BBAAD230C2648944B08030F823E1EF2C41E870053188F878
SHA-512:	311805305F1C9D1D0F9B605E29799AC100E7889B36678E1B87009E71D79271C170DFCC36E589F2E79D74228E4706D8C2C6065F18BC3EFFF255FA7627FEFA8FF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.....M..M..M.HRM..M.HPM..M.HQM..M..^M..M...L..M...L..M.. M..M...L'.M..0M..M..M..M...L<.M...L..M..\M..M...L..MRich..M................PE..L.....@f...............!.D...H...............`....@.......................................@.............................4.......P.... ..H........................#.. ...T..............................@............`..........`....................text...<B.......D.................. ..`.rdata.......`.......H..............@..@.data........0......................@....didat..8............(..............@....rsrc...H.... .......*..............@..@.reloc...#.......$..................@..B........................................................................................................................................................................................................................................

C:\Users\user\WinRAR.chm

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	324272
Entropy (8bit):	7.939215029789359
Encrypted:	false
SSDEEP:	6144:0HQbQuhUP/yv4J15/8Z0lIiFiDoQRkx79WftE+qby/919rRj+g8HR:JQuayv4V8ZMokx79WfGxI9LrPcR
MD5:	6CA1BC8BFE8B929F448E1742DACB8E7F
SHA1:	ECA3E637DB230FA179DCD6C6499BD7D616F211E8
SHA-256:	997184B6F08D36DEDC2CD12EE8DC5AFB5E6E4BF77F7AB10F7ADE9EEFDB163344
SHA-512:	D823F2C960A4D92129B9BDA0F4F9195D32E64B929082B5EFB9149546B5053021255D1DD03CB443F0A03106314554F76B94173E280A553A81E4AC2AC282877973
Malicious:	false
Preview:	ITSF....`.......r.........\|.{.......".....\|.{......."..`...............x.......T@.......@..............................ITSP....T...........................................j..].!......."..T...............PMGLQ................/..../#IDXHDR...3.../#ITBITS..../#STRINGS...[.Z./#SYSTEM..&."./#TOPICS...3.0./#URLSTR...G.../#URLTBL...c.d./#WINDOWS...K.L./$FIftiMain...k..H./$OBJINST...,.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...(../$WWKeywordLinks/..../$WWKeywordLinks/BTree......L./$WWKeywordLinks/Data...c.+./$WWKeywordLinks/Map....z./$WWKeywordLinks/Property.... ./html/..../html/HELPAcknowledgments.htm.....d./html/HELPAddShortcut.htm.....r./html/HELPAppData.htm...x.../html/HELPArcComment.htm...?. ./html/HELPArcEncryption.htm...A.~./html/HELPArchiveTypes.htm.....I./html/HELPArcLocking.htm...d.f./html/HELPArcNonRAR.htm......./html/HELPArcOptimal.htm...J.[./html/HELPArcPassword.htm...^.A./html/HELPArcRecovery.htm..._.../html/HELPArcRecVolumes.htm...h.d./html/HELPArcSFX.htm...L.u.

C:\Users\user\WinRAR.exe

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3286680
Entropy (8bit):	6.864323385790075
Encrypted:	false
SSDEEP:	49152:olh7WxDi+U/pcCz7PZTZlzdOZlUkJLF1Uac+3+fESa6HYlGBzNwui0hBdH3XK:oMgZeD+hBBquTBpnK
MD5:	53CF9BACC49C034E9E947D75FFAB9224
SHA1:	7DB940C68D5D351E4948F26425CD9AEE09B49B3F
SHA-256:	3B214FD9774C6D96332E50A501C5E467671B8B504070BBB17E497083B7E282C3
SHA-512:	44C9154B1FDBCF27AB7FAEE6BE5B563A18B2BAEAD3E68B3EA788C6C76CF582F52F3F87BD447A4F6E25EC7D4690761332211659D754FB4E0630C22A372E470BDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9...9...9...r.......*.?......+......1......}...r...0...r.......r...8...r..."...9...4...9...?..........(.8......8...Rich9...........PE..d....@f.........."....!.....D......`..........@............................. 7.....DK2...`..................................................D".......(.L.....(.`.....1..(....7.....4...T.......................(....k..@....................@".@....................text............................... ..`.rdata..@...........................@..@.data........."......b".............@....pdata..`.....(.......#.............@..@.didat........(.......#.............@..._RDATA..\.....(.......#.............@..@.rsrc.........(.......#.............@..@.reloc........7.......1.............@..B................................................................................................................................................

C:\Users\user\Zip.SFX

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	387584
Entropy (8bit):	6.458529414773216
Encrypted:	false
SSDEEP:	6144:p5aMJNLwL73PZPkFr1jilzqqVWk6855JKSFtIooEbQ/WX+t4:pOxPkPjQeqQ1Y53KR/WX+t4
MD5:	CD7BB857DE39A930085360674B5D78E9
SHA1:	77AA6120D04B05C387FEAA9E3563B1E4D0CD4662
SHA-256:	8AFBE21A3F3BCCAC6345AAB8D99C2E8F6E01CBD96D9F0FFE58F6CB881E4638FE
SHA-512:	0B64FE30C4704AF1ED404B287C081AD1EACBADDE153A1D9B14849868BCB950F7A41D7A36E5B03AD3CCC9C0F8E2690BE5D74D87AA606004854E4FD2EE81805D7C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........B#..,p..,p..,p.:.p..,p.:.p5.,p.:.p..,p<..p..,p<.(q..,p<./q..,p<.)q..,p..p..,p..p..,p..p..,p..-p..,p2.)q..,p2.,q..,p2..p..,p2..q..,pRich..,p................PE..d...+.@f.........."....!.....".......f.........@..........................................`............................................4.......P.......`......................8....`..T....................a..(.......@............................................text.............................. ..`.rdata..............................@..@.data...\...........................@....pdata..........,..................@..@.didat..............................@..._RDATA..\...........................@..@.rsrc...`...........................@..@.reloc..8...........................@..B................................................................................................................................

C:\Users\user\Zip32.SFX

Download File

Process:	C:\Users\user\Desktop\winrar-x64-701(1).exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323072
Entropy (8bit):	6.679575531692226
Encrypted:	false
SSDEEP:	6144:au3rMuh4risIXF9sQJlBBYuiTj+7HiR1juTIosSeX+t4sh:xX4riL9sU/BYuCQHipeeX+t4M
MD5:	E0A8B12266260CB8597D0D5ECAE30362
SHA1:	69D5B706B7B11462B4279592535C95E78CC090CF
SHA-256:	6EA28B1B5DA1D2F13DC3787D1348934F0C2BF6A186535D691818FD9FE8A90294
SHA-512:	5BE1E9E4BDF75E490867150D82CBE8FB3D25B32D0E1009774BF41AF02565FE488BEFE133A959E4187B4457CCAB63059609370C314404C674174CB085021552BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........y..y..y....~.y....\|.!y....}.y..+.r.y..+...y..+...y..+...y.....y.....y..y..x..%...y..%...y..%.p.y..%...y..Rich.y..................PE..L...'.@f...............!............@........ ....@.......................................@.............................4...$...P.......`.......................@/.. ...T............................F..@............ ..L............................text...\|........................... ..`.rdata..4.... ......................@..@.data...x...........................@....didat..\|...........................@....rsrc...`...........................@..@.reloc..@/.......0..................@..B........................................................................................................................................................................................................................................

C:\Users\user\rarnew.dat

Download File

Process:	C:\Users\user\Uninstall.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:uv6L4fz0mkl:uv6cLkl
MD5:	C69D0B5902A959577C02E9DCDDA77DE0
SHA1:	6233724F8B3AC18649DC248D1C778E2BCA78A7F2
SHA-256:	4301EC2E9592E7A22262D1C046954545033B73BE322B33A8117D201556C4254B
SHA-512:	2E8945172EF567D4AE84D6317EFCE63502A6D9496CAA48B8DC09CF12D1CEEC3E89D033D6D9FCEEBA82F403107D15341BCDB72B4A6F60BA3E6DF4D2A2CB6E48CD
Malicious:	false
Preview:	Rar!......_V.....wVQ....

C:\Users\user\zipnew.dat

Download File

Process:	C:\Users\user\Uninstall.exe
File Type:	Zip archive data (empty)
Category:	dropped
Size (bytes):	22
Entropy (8bit):	1.0476747992754052
Encrypted:	false
SSDEEP:	3:pjt/l:Nt
MD5:	76CDB2BAD9582D23C1F6F4D868218D6C
SHA1:	B04F3EE8F5E43FA3B162981B50BB72FE1ACABB33
SHA-256:	8739C76E681F900923B900C9DF0EF75CF421D39CABB54650C4B9AD19B6A76D85
SHA-512:	5E2F959F36B66DF0580A94F384C5FC1CEEEC4B2A3925F062D7B68F21758B86581AC2ADCFDDE73A171A28496E758EF1B23CA4951C05455CDAE9357CC3B5A5825F
Malicious:	false
Preview:	PK....................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.955285356381258
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	winrar-x64-701(1).exe
File size:	3'948'120 bytes
MD5:	46c17c999744470b689331f41eab7df1
SHA1:	b8a63127df6a87d333061c622220d6d70ed80f7c
SHA256:	c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a
SHA512:	4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6
SSDEEP:	98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB
TLSH:	8206231AF7A904F5D077E178C9A34607E6727C9D4771928F23E60A492F277909E3E322
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u...u...u...v...u...p.P.u.J.....u.J.q...u.J.v...u.J.p...u...q...u...s...u...t...u...t...u.D.\|...u.D.u...u.D.....u.D.w...u

File Icon


Icon Hash:	3b3b336b696ab269

Static PE Info

General

Entrypoint:	0x140029e90
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409736 [Sun May 12 10:17:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	39da3cace27ab9503fa46001ce968ea6

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	8/7/2023 5:00:00 PM 8/7/2026 4:59:59 PM
Subject Chain	CN=win.rar GmbH, O=win.rar GmbH, L=Berlin, S=Berlin, C=DE, SERIALNUMBER=HRB 109885, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.1=Charlottenburg, OID.1.3.6.1.4.1.311.60.2.1.2=Berlin, OID.1.3.6.1.4.1.311.60.2.1.3=DE
Version:	3
Thumbprint MD5:	4E14FDD2231019D7E676235D9D81BCAE
Thumbprint SHA-1:	729AE1F8B489DE176CC099FF49937F85F9E412F7
Thumbprint SHA-256:	E0F8ABF2A732B2D82369C6CDF5657C85C231A924C82528D853AA8F38E0B3ACD9
Serial:	048B08399EC703623C72CD2077AD65D9

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F25489F4AC8h
dec eax
add esp, 28h
jmp 00007F25489F440Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F25489F4C1Fh
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F25489F45A3h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F25489F6AFFh
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 10h
dec esp
mov dword ptr [esp], edx
dec esp
mov dword ptr [esp+08h], ebx
dec ebp
xor ebx, ebx
dec esp
lea edx, dword ptr [esp+18h]
dec esp
sub edx, eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x54f50	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54f84	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6c000	0x26090	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x66000	0x3ff0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3c15c0	0x2898
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x93000	0x944	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4f340	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4f400	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x44d00	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x44000	0x518	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x5412c	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4217e	0x42200	3b541339cc9e14f15b888d0479b3133f	False	0.5534137228260869	DOS executable (COM)	6.465496377863431	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x44000	0x12096	0x12200	68b3387c3dedeaa3b1e5cd69a387443c	False	0.4515355603448276	SysEx File - Matsushita	5.2033734091823645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x57000	0xe404	0x1200	615b97fd5c58191151507c5357520b77	False	0.2573784722222222	data	3.0651893813727122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x66000	0x3ff0	0x4000	1b12bb5f5c27bc0ec26e22d952efe46a	False	0.47430419921875	data	5.202190058981855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6a000	0x338	0x400	7a4026fb8d4e9aa87fe9f6aaaaa650d9	False	0.244140625	data	2.9226525026637282	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6b000	0x15c	0x200	c2a487c68e9b43cb7d57799aad555ea0	False	0.40625	data	3.3261253179891916	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x6c000	0x27000	0x26200	0e7c014a9728ac20034e79955ae49a9b	False	0.8942943135245902	data	7.756954915676745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x93000	0x944	0xa00	c5a48e3ca994dee11a564d2249cdf0a4	False	0.476171875	data	5.252204538581881	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x6c5cc	0x3318	PNG image data, 256 x 64, 8-bit/color RGBA, non-interlaced	English	United States	0.9983944954128441
PNG	0x6f8e4	0xdc20	PNG image data, 512 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.000461385576377
RT_ICON	0x7d504	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4031791907514451
RT_ICON	0x7da6c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.6425992779783394
RT_ICON	0x7e314	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.6156716417910447
RT_ICON	0x7f1bc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.43439716312056736
RT_ICON	0x7f624	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.5175891181988743
RT_ICON	0x806cc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.5034232365145228
RT_ICON	0x82c74	0xd646	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9980675976227805
RT_DIALOG	0x902bc	0xdc	data	English	United States	0.7090909090909091
RT_DIALOG	0x90398	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x904c8	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x90800	0x37a	data	English	United States	0.5348314606741573
RT_STRING	0x90b7c	0x178	data	English	United States	0.4308510638297872
RT_STRING	0x90cf4	0x1b4	data	English	United States	0.4426605504587156
RT_STRING	0x90ea8	0x19a	data	English	United States	0.4902439024390244
RT_STRING	0x91044	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x9118c	0x1fc	data	English	United States	0.4547244094488189
RT_STRING	0x91388	0xd6	Matlab v4 mat-file (little endian) E, numeric, rows 0, columns 0	English	United States	0.46261682242990654
RT_STRING	0x91460	0x9a	data	English	United States	0.5974025974025974
RT_STRING	0x914fc	0x3a	data	English	United States	0.6896551724137931
RT_STRING	0x91538	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x91610	0x68	data	English	United States	0.7019230769230769
RT_VERSION	0x91678	0x2c8	data	English	United States	0.46207865168539325
RT_MANIFEST	0x91940	0x750	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3969017094017094

Imports

DLL	Import
KERNEL32.dll	GetLastError, FormatMessageW, LocalFree, SetLastError, CreateHardLinkW, SetFileTime, GetCurrentProcess, CloseHandle, CreateFileW, DeviceIoControl, RemoveDirectoryW, DeleteFileW, GetLongPathNameW, GetShortPathNameW, MoveFileW, GetStdHandle, WriteFile, ReadFile, SetFilePointer, SetEndOfFile, FlushFileBuffers, GetFileType, CreateDirectoryW, GetFileAttributesW, SetFileAttributesW, GetCurrentProcessId, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, SetThreadExecutionState, CompareStringW, AllocConsole, AttachConsole, WriteConsoleW, Sleep, FreeConsole, ExitProcess, GetSystemDirectoryW, LoadLibraryW, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, CreateThread, WaitForSingleObject, GetProcessAffinityMask, CreateSemaphoreW, CreateEventW, ReleaseSemaphore, SetThreadPriority, SetEvent, ResetEvent, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, SystemTimeToFileTime, LocalFileTimeToFileTime, TzSpecificLocalTimeToSystemTime, GetSystemTime, WideCharToMultiByte, MultiByteToWideChar, GetCPInfo, IsDBCSLeadByte, GlobalAlloc, SizeofResource, LoadResource, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GetDateFormatW, GetTimeFormatW, GlobalMemoryStatusEx, GetLocaleInfoW, GetNumberFormatW, GetCommandLineW, OpenFileMappingW, MapViewOfFile, UnmapViewOfFile, SetEnvironmentVariableW, GetLocalTime, GetTickCount, CreateFileMappingW, MoveFileExW, GetTempPathW, GetExitCodeProcess, GetConsoleMode, GetConsoleOutputCP, HeapSize, SetFilePointerEx, GetStringTypeW, SetStdHandle, GetProcessHeap, LCMapStringW, FlsFree, FlsSetValue, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, HeapFree, HeapAlloc, HeapReAlloc, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, FlsAlloc, FlsGetValue
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipFree, GdipAlloc, GdipCloneImage, GdipDisposeImage, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipCreateBitmapFromStream

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	04:18:29
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\winrar-x64-701(1).exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\winrar-x64-701(1).exe"
Imagebase:	0x13f780000
File size:	3'948'120 bytes
MD5 hash:	46C17C999744470B689331F41EAB7DF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:18:44
Start date:	10/10/2024
Path:	C:\Users\user\Uninstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\uninstall.exe" /setup
Imagebase:	0x13fa40000
File size:	488'600 bytes
MD5 hash:	4783F1A5F0BBA7A6A40CB74BC8C41217
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 3%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.2%
Total number of Nodes:	1336
Total number of Limit Nodes:	23

Executed Functions

Function 000000013F7A4930 Relevance: 98.9, APIs: 45, Strings: 11, Instructions: 931windowfilesleepCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 000000013F7A4A32
SetDlgItemTextW.USER32 ref: 000000013F7A4A82
GetMessageW.USER32 ref: 000000013F7A4AB2
IsDialogMessageW.USER32 ref: 000000013F7A4ACB
TranslateMessage.USER32 ref: 000000013F7A4ADD
DispatchMessageW.USER32 ref: 000000013F7A4AEB
ShowWindow.USER32 ref: 000000013F7A4B16
EndDialog.USER32 ref: 000000013F7A4BD2
GetDlgItem.USER32 ref: 000000013F7A4C07
SendMessageW.USER32 ref: 000000013F7A4C28
SendMessageW.USER32 ref: 000000013F7A4C40
SetFocus.USER32 ref: 000000013F7A4C49
GetLastError.KERNEL32 ref: 000000013F7A4D44
GetLastError.KERNEL32 ref: 000000013F7A4D66
GetTickCount.KERNEL32 ref: 000000013F7A4D8C
GetLastError.KERNEL32 ref: 000000013F7A4DF1
GetCommandLineW.KERNEL32 ref: 000000013F7A4F06
CreateFileMappingW.KERNEL32 ref: 000000013F7A4FB7
MapViewOfFile.KERNEL32 ref: 000000013F7A4FDA
ShellExecuteExW.SHELL32 ref: 000000013F7A5030
Sleep.KERNEL32 ref: 000000013F7A5075
UnmapViewOfFile.KERNEL32 ref: 000000013F7A509E
SetDlgItemTextW.USER32 ref: 000000013F7A51E5
SetDlgItemTextW.USER32 ref: 000000013F7A520A
GetDlgItem.USER32 ref: 000000013F7A5218
GetWindowLongPtrW.USER32 ref: 000000013F7A5232
SetWindowLongPtrW.USER32 ref: 000000013F7A5246
SetDlgItemTextW.USER32 ref: 000000013F7A5310
CloseHandle.KERNEL32 ref: 000000013F7A50A7

Part of subcall function 000000013F79788C: LoadStringW.USER32 ref: 000000013F797855
Part of subcall function 000000013F79788C: LoadStringW.USER32 ref: 000000013F797871

DeleteObject.GDI32 ref: 000000013F7A54A1
DeleteObject.GDI32 ref: 000000013F7A54E1
SendDlgItemMessageW.USER32 ref: 000000013F7A54FF
SendMessageW.USER32 ref: 000000013F7A552D
SendDlgItemMessageW.USER32 ref: 000000013F7A5551
GetDlgItem.USER32 ref: 000000013F7A555F
SendMessageW.USER32 ref: 000000013F7A5579
GetDlgItem.USER32 ref: 000000013F7A559C
SetDlgItemTextW.USER32 ref: 000000013F7A562F
SetDlgItemTextW.USER32 ref: 000000013F7A5647
SetForegroundWindow.USER32 ref: 000000013F7A56BB
DialogBoxParamW.USER32 ref: 000000013F7A5714
EndDialog.USER32 ref: 000000013F7A572C
EnableWindow.USER32 ref: 000000013F7A586E
SendMessageW.USER32 ref: 000000013F7A58C0
SetDlgItemTextW.USER32 ref: 000000013F7A58E9

Strings

LICENSEDLG, xrefs: 000000013F7A5706
winrarsfxmappingfile.tmp, xrefs: 000000013F7A4F98
runas, xrefs: 000000013F7A4EAD
WinRAR, xrefs: 000000013F7A4B94
p, xrefs: 000000013F7A4E8F
@, xrefs: 000000013F7A4E9A
__tmp_rar_sfx_access_check_, xrefs: 000000013F7A4DA5
STARTDLG, xrefs: 000000013F7A4964
-el -s2 "-d%s" "-sp%s", xrefs: 000000013F7A4E7D
1ERs, xrefs: 000000013F7A494A
d, xrefs: 000000013F7A507D

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Item$Message$SendText$DialogWindow$ErrorFileLast$DeleteLoadLongObjectStringView$CloseCommandCountCreateDispatchEnableExecuteFocusForegroundHandleLineMappingParamShellShowSleepTickTranslateUnmap
String ID: -el -s2 "-d%s" "-sp%s"$1ERs$@$LICENSEDLG$STARTDLG$WinRAR$__tmp_rar_sfx_access_check_$d$p$runas$winrarsfxmappingfile.tmp
API String ID: 1861407826-1862608659
Opcode ID: bfefcb1adc0f4337bd9708062b20f0ae54d63f6e4ad3fb607d105c27b1d5a5d9
Instruction ID: 29f1330b941f7dfb5aefeaf18743128d706e4bf891c9101213dbbd4b72cb0f85
Opcode Fuzzy Hash: bfefcb1adc0f4337bd9708062b20f0ae54d63f6e4ad3fb607d105c27b1d5a5d9
Instruction Fuzzy Hash: D2929132B0568092FE60EB61E8517EA7761BBD5780F81403DE94A47BE6DF29CB0BC741

Function 000000013F7A41D0 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 228
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013F79A548: GetModuleHandleW.KERNEL32 ref: 000000013F79A592
Part of subcall function 000000013F79A548: GetProcAddress.KERNEL32 ref: 000000013F79A5AA
Part of subcall function 000000013F79A548: GetProcAddress.KERNEL32 ref: 000000013F79A5CC

Part of subcall function 000000013F794A5C: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,000000013F79449F), ref: 000000013F794A6D
Part of subcall function 000000013F794A5C: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,000000013F79449F), ref: 000000013F794A9D

Part of subcall function 000000013F7A2794: OleInitialize.OLE32 ref: 000000013F7A27AE
Part of subcall function 000000013F7A2794: GdiplusStartup.GDIPLUS ref: 000000013F7A27E6
Part of subcall function 000000013F7A2794: SHGetMalloc.SHELL32 ref: 000000013F7A27F3

GetCommandLineW.KERNEL32 ref: 000000013F7A4280
OpenFileMappingW.KERNEL32 ref: 000000013F7A42CE
MapViewOfFile.KERNEL32 ref: 000000013F7A42F7
UnmapViewOfFile.KERNEL32 ref: 000000013F7A4318
UnmapViewOfFile.KERNEL32 ref: 000000013F7A439C
MapViewOfFile.KERNEL32 ref: 000000013F7A4335

Part of subcall function 000000013F7A4688: SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000013F7A43C4), ref: 000000013F7A46AF
Part of subcall function 000000013F7A4688: SetEnvironmentVariableW.KERNEL32 ref: 000000013F7A470C

CloseHandle.KERNEL32 ref: 000000013F7A43A5
SetEnvironmentVariableW.KERNEL32 ref: 000000013F7A4407
GetLocalTime.KERNEL32 ref: 000000013F7A4412
SetEnvironmentVariableW.KERNEL32 ref: 000000013F7A4480
GetModuleHandleW.KERNEL32 ref: 000000013F7A4488
LoadIconW.USER32 ref: 000000013F7A44A7
DialogBoxParamW.USER32 ref: 000000013F7A44FB
Sleep.KERNEL32 ref: 000000013F7A452D
DeleteObject.GDI32 ref: 000000013F7A4554
DeleteObject.GDI32 ref: 000000013F7A4566
CloseHandle.KERNEL32 ref: 000000013F7A45AD

Strings

winrarsfxmappingfile.tmp, xrefs: 000000013F7A42C0
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 000000013F7A445C
sfxname, xrefs: 000000013F7A4400
STARTDLG, xrefs: 000000013F7A44EA
sfxstime, xrefs: 000000013F7A4479
1ERs, xrefs: 000000013F7A41EE

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogGdiplusIconInitializeLineLoadLocalMallocMappingOpenParamSleepStartupTime
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$1ERs$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 956318440-2037133340
Opcode ID: a3721ac13b9f2c53508f2668e3fc4f6423e7929e4d77d1bc6e4f4f65e0df9eb2
Instruction ID: 307dca8676642e3c79cff39f042bf4c298b5574a2ca69ad9a2beb184fef3ef74
Opcode Fuzzy Hash: a3721ac13b9f2c53508f2668e3fc4f6423e7929e4d77d1bc6e4f4f65e0df9eb2
Instruction Fuzzy Hash: 68C10632A10A4096FF50EF60E8567E973A1FB94744F81443EA94E46AE6EF39C74BC740

Function 000000013F7A5ABC Relevance: 34.4, APIs: 7, Strings: 12, Instructions: 1184COMMON

Download Yara Rule

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 000000013F7A5FB5
.tmp, xrefs: 000000013F7A6349
.lnk, xrefs: 000000013F7A6AE2
@set:user, xrefs: 000000013F7A65CC
RarSFX, xrefs: 000000013F7A64B9, 000000013F7A652A
HIDE, xrefs: 000000013F7A5D28
ProgramFilesDir, xrefs: 000000013F7A5FA4
MIN, xrefs: 000000013F7A5D84
MAX, xrefs: 000000013F7A5D56
lnk, xrefs: 000000013F7A6AAD
1ERs, xrefs: 000000013F7A5AE2
<br>, xrefs: 000000013F7A6106

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: .lnk$.tmp$1ERs$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$RarSFX$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 0-3451782
Opcode ID: 98741a0b586446009d92956d10e054fefa308feace73c8e7b410cd9c5ad81809
Instruction ID: 58ce1988d51e0a63397bdf5e72f597af39a67d9afafff06513c67103fb28f725
Opcode Fuzzy Hash: 98741a0b586446009d92956d10e054fefa308feace73c8e7b410cd9c5ad81809
Instruction Fuzzy Hash: 5BB20D72A1054095FF60EBA4DC923DD7761F791348F82513AEA0E976EAEE64CB4BC340

Function 000000013F796960 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013F79C520: WideCharToMultiByte.KERNEL32 ref: 000000013F79C551

SetDlgItemTextW.USER32 ref: 000000013F796A14
GetWindowRect.USER32 ref: 000000013F796A48
GetClientRect.USER32 ref: 000000013F796A56
GetWindowLongPtrW.USER32 ref: 000000013F796AFC
GetWindowRect.USER32 ref: 000000013F796B42
SetWindowTextW.USER32 ref: 000000013F796B78
GetSystemMetrics.USER32 ref: 000000013F796B83
GetWindow.USER32 ref: 000000013F796B94
GetWindowRect.USER32 ref: 000000013F796BCE
GetWindow.USER32 ref: 000000013F796C90

Strings

$%s:, xrefs: 000000013F7969A2
CAPTION, xrefs: 000000013F796B5E
1ERs, xrefs: 000000013F79697F

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide
String ID: $%s:$1ERs$CAPTION
API String ID: 644714697-2433757044
Opcode ID: ee7c6a2717057d0bed3ba9a49207a42e0b11ab8094b40c8b8e3542f0488fcae4
Instruction ID: 6b8e85f46b1570cc6f515920699a12f3f152c9e5d7248a9157cfc60d047adc64
Opcode Fuzzy Hash: ee7c6a2717057d0bed3ba9a49207a42e0b11ab8094b40c8b8e3542f0488fcae4
Instruction Fuzzy Hash: C891E872B246408BEB18CF39E84579A7761F7C5B84F409129EF4A57B98DE3DDA06CB00

Function 000000013F795B4C Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013F79C574: MultiByteToWideChar.KERNEL32 ref: 000000013F79C5A1

__swprintf_l.LIBCMT ref: 000000013F796075

Strings

$%s:, xrefs: 000000013F79604F
@%s:, xrefs: 000000013F796056
MENU, xrefs: 000000013F795F05
DIALOG, xrefs: 000000013F795EF9
RTL, xrefs: 000000013F79602B
DIRECTION, xrefs: 000000013F795F10
STRINGS, xrefs: 000000013F795EED
*messages***, xrefs: 000000013F795D3A
1ERs, xrefs: 000000013F795B78
*messages***, xrefs: 000000013F795CFC
,, xrefs: 000000013F7961DB

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ByteCharMultiWide__swprintf_l
String ID: ,$$%s:$*messages***$*messages***$1ERs$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3405735246-1486914383
Opcode ID: a5017536ce3901cfda56e82df6f7f2d922a7d09d550f9b948db48fb69ee736d9
Instruction ID: 14dd9d531520a3eee028c4769959fa82cd2dffe143ad71a61f94e66ea6b45306
Opcode Fuzzy Hash: a5017536ce3901cfda56e82df6f7f2d922a7d09d550f9b948db48fb69ee736d9
Instruction Fuzzy Hash: F3229132A11A5195EB20DF25D8947EE73A1F745788F80523EEA4E476EAEB35CB07C340

Function 000000013F7A1FEC Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32 ref: 000000013F7A2005
SizeofResource.KERNEL32 ref: 000000013F7A2021
LoadResource.KERNEL32 ref: 000000013F7A203B
LockResource.KERNEL32 ref: 000000013F7A204D
GlobalAlloc.KERNEL32 ref: 000000013F7A206C
GlobalLock.KERNEL32 ref: 000000013F7A2081
CreateStreamOnHGlobal.OLE32 ref: 000000013F7A20AE
GlobalUnlock.KERNEL32 ref: 000000013F7A211B

Part of subcall function 000000013F7A25C0: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 000000013F7A25DE

GlobalFree.KERNEL32 ref: 000000013F7A2124

Strings

PNG, xrefs: 000000013F7A1FF7

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: 6e6bf86b030be450644aadc403cb9e14e21563b103a4267463e7844ec5b29060
Instruction ID: dc9be0b4a106fb7d00fde112d00943f5783895ea7173dcf8c3a7d909d3b3e34f
Opcode Fuzzy Hash: 6e6bf86b030be450644aadc403cb9e14e21563b103a4267463e7844ec5b29060
Instruction Fuzzy Hash: 46310631B05A0181FE599F96F8583E9B3A1AB88BD0F45403D9E0E877A5EE78C65AC300

Function 000000013F791F08 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32 ref: 000000013F791F53
FindFirstFileW.KERNEL32 ref: 000000013F791F94
GetLastError.KERNEL32 ref: 000000013F791FAD
FindNextFileW.KERNEL32 ref: 000000013F791FD6
GetLastError.KERNEL32 ref: 000000013F791FE4

Strings

1ERs, xrefs: 000000013F791F1F

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID: 1ERs
API String ID: 869497890-1577259171
Opcode ID: be01675985a9e4af430eb1eacd21b50adc1fe5c5a8316179733ceb51338fdfde
Instruction ID: 58951b63510c028e4d39925233c9ebbf459d07af70e5441cb9d5c36b7260dd03
Opcode Fuzzy Hash: be01675985a9e4af430eb1eacd21b50adc1fe5c5a8316179733ceb51338fdfde
Instruction Fuzzy Hash: 3C419032605A4496EE20DB25E5413EA73A1FB857B4F400339EBAD47BD5DF68C72AC700

Function 000000013F7A02DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59comCOMMON

Download Yara Rule

APIs

CLSIDFromString.OLE32 ref: 000000013F7A0304
CoCreateInstance.OLE32 ref: 000000013F7A0325

Strings

Shell.Explorer, xrefs: 000000013F7A02FD
1ERs, xrefs: 000000013F7A02E6

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CreateFromInstanceString
String ID: 1ERs$Shell.Explorer
API String ID: 432265043-327250298
Opcode ID: 07fda1288cf3761b6bdaf391c7fd541c65212326588851c844ec710d49ff74c1
Instruction ID: 7cc22b15e2646fe7ca3d2783d900d5d6c7f796acd0c0069c831f7d5970a8e59e
Opcode Fuzzy Hash: 07fda1288cf3761b6bdaf391c7fd541c65212326588851c844ec710d49ff74c1
Instruction Fuzzy Hash: 7731B536614E4982EF00CF6AE8907997370F788F99F55412ADA4E47774DF38C64ACB00

Function 000000013F78DE98 Relevance: 3.4, Strings: 2, Instructions: 895COMMON

Download Yara Rule

Strings

__tmp_reference_source_, xrefs: 000000013F78E16A
1ERs, xrefs: 000000013F78DEB2

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs$__tmp_reference_source_
API String ID: 0-3521100098
Opcode ID: bad5ab0c43429d5b91f80a964903c7c39e04616d7c69a0df644427c713c81732
Instruction ID: eedecc8b54544da200f2f91a087373367a4a979c62d54388545e38c005fd124e
Opcode Fuzzy Hash: bad5ab0c43429d5b91f80a964903c7c39e04616d7c69a0df644427c713c81732
Instruction Fuzzy Hash: 5D92C172A146C095FA70DBA1E0527EE7FA1F791784F85003EDA8A43696DB6CCB47C702

Function 000000013F785330 Relevance: 3.1, Strings: 2, Instructions: 612COMMON

Download Yara Rule

Strings

CMT, xrefs: 000000013F785BA6
1ERs, xrefs: 000000013F785353

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs$CMT
API String ID: 0-2971618018
Opcode ID: 801226655134016f4c2f1aff102fed7a53d997e639ea45294287d3acd7f803f1
Instruction ID: 093b27b348ee880a038aa591191862444c6c0e0137d4154f48df521cb4d54a32
Opcode Fuzzy Hash: 801226655134016f4c2f1aff102fed7a53d997e639ea45294287d3acd7f803f1
Instruction Fuzzy Hash: CB42BE72B00690A6EB18DB64D5927EE7BA1F7517D8F80003EEA4A877A6DF74C617C700

Function 000000013F7A9D00 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 000000013F7A9D09
_invalid_parameter_noinfo.LIBCMT ref: 000000013F7B6E08

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: baf030bf4a28e115bbc61a4e03e20e7e9b5047dc875e5aa845e42fd7a9cca394
Instruction ID: bd1b844589a6b6b59d896f69249019897ef212e23d02f9ed5c69a73d02610788
Opcode Fuzzy Hash: baf030bf4a28e115bbc61a4e03e20e7e9b5047dc875e5aa845e42fd7a9cca394
Instruction Fuzzy Hash: 8FE01231E15119C7FD3C37A98C433EC34912B4A330F9002BDA325557D2CA2C0BA76752

Function 000000013F79D3C0 Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

1ERs, xrefs: 000000013F79D3DF

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs
API String ID: 0-1577259171
Opcode ID: be24b3948965e2bc9aa86c6c2c61302812faa6f3c6270ce6ce533432fe1c4b2b
Instruction ID: 72b380df00efdce4a28f5e9f2b2918a9eca581cd7ec39a9e0980f2adcc37cde8
Opcode Fuzzy Hash: be24b3948965e2bc9aa86c6c2c61302812faa6f3c6270ce6ce533432fe1c4b2b
Instruction Fuzzy Hash: 02D1C072A042808AFB60DF29D5483DEBBA1F74878CF055139DB895BB86DB38D686C700

Function 000000013F7A0A20 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 000000013F7A0A52

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 2989c6689f53d6059e17e005a401a26052607f97d951d1bdaca2b27c9e00b382
Instruction ID: 08eb903f01ae3b9ebcee3c61091e1c48025000e88c59d63ed2bb09ed9235b64c
Opcode Fuzzy Hash: 2989c6689f53d6059e17e005a401a26052607f97d951d1bdaca2b27c9e00b382
Instruction Fuzzy Hash: 72F09033B10B9086E614CF43B980689B775F3A9FD0F19802AEF4917B69CF34C6528780

Function 000000013F79A548 Relevance: 147.4, APIs: 16, Strings: 68, Instructions: 421
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000000013F79A592
GetProcAddress.KERNEL32 ref: 000000013F79A5AA
GetProcAddress.KERNEL32 ref: 000000013F79A5CC
CreateFileW.KERNEL32 ref: 000000013F79A968
SetFilePointer.KERNEL32 ref: 000000013F79A986
ReadFile.KERNEL32 ref: 000000013F79A9AE
CompareStringW.KERNEL32 ref: 000000013F79AA9E
CloseHandle.KERNEL32 ref: 000000013F79AA38

Part of subcall function 000000013F79AD40: GetSystemDirectoryW.KERNEL32 ref: 000000013F79AD8F
Part of subcall function 000000013F79AD40: LoadLibraryW.KERNEL32 ref: 000000013F79ADF9

Part of subcall function 000000013F792A74: GetVersionExW.KERNEL32 ref: 000000013F792AA5

AllocConsole.KERNEL32 ref: 000000013F79AC7A
GetCurrentProcessId.KERNEL32 ref: 000000013F79AC84
AttachConsole.KERNEL32 ref: 000000013F79AC8C
GetStdHandle.KERNEL32 ref: 000000013F79ACB1
WriteConsoleW.KERNEL32 ref: 000000013F79ACCA
Sleep.KERNEL32 ref: 000000013F79ACD5
FreeConsole.KERNEL32 ref: 000000013F79ACDB
ExitProcess.KERNEL32 ref: 000000013F79ACED

Strings

ntshrui.dll, xrefs: 000000013F79A69B
rsaenh.dll, xrefs: 000000013F79A611
xlistpos, xrefs: 000000013F79A91E
WindowsCodecs.dll, xrefs: 000000013F79A789
userenv.dll, xrefs: 000000013F79A6D3
propsys.dll, xrefs: 000000013F79A823
dhcpcsvc6.dll, xrefs: 000000013F79A893
profapi.dll, xrefs: 000000013F79A77B
1ERs, xrefs: 000000013F79A574
setupapi.dll, xrefs: 000000013F79A6B7
iphlpapi.DLL, xrefs: 000000013F79A7DD
browcli.dll, xrefs: 000000013F79A877
WINNSI.DLL, xrefs: 000000013F79A7EB
rasadhlp.dll, xrefs: 000000013F79A885
kernel32, xrefs: 000000013F79A58B
clbcatq.dll, xrefs: 000000013F79A653
atl.dll, xrefs: 000000013F79A6A9
secur32.dll, xrefs: 000000013F79A743
ntmarta.dll, xrefs: 000000013F79A76D
apphelp.dll, xrefs: 000000013F79A6C5
uxtheme.dll, xrefs: 000000013F79AB7E
XmlLite.dll, xrefs: 000000013F79A8AF
devrtl.dll, xrefs: 000000013F79A815
ws2help.dll, xrefs: 000000013F79A674
slc.dll, xrefs: 000000013F79A7B3
cryptui.dll, xrefs: 000000013F79A719
mlang.dll, xrefs: 000000013F79A831
SetDefaultDllDirectories, xrefs: 000000013F79A5C2
DXGIDebug.dll, xrefs: 000000013F79A5F0, 000000013F79AAE1
psapi.dll, xrefs: 000000013F79A67F
UXTheme.dll, xrefs: 000000013F79A61C
cryptbase.dll, xrefs: 000000013F79A632
peerdist.dll, xrefs: 000000013F79A903
aclui.dll, xrefs: 000000013F79A8E7
wintrust.dll, xrefs: 000000013F79A727
usp10.dll, xrefs: 000000013F79A648
msasn1.dll, xrefs: 000000013F79A70B
mpr.dll, xrefs: 000000013F79A807
imageres.dll, xrefs: 000000013F79A7C1
shell32.dll, xrefs: 000000013F79A735
ws2_32.dll, xrefs: 000000013F79A669
dfscli.dll, xrefs: 000000013F79A869
wkscli.dll, xrefs: 000000013F79A85B
version.dll, xrefs: 000000013F79A5E5
crypt32.dll, xrefs: 000000013F79A6FD
samcli.dll, xrefs: 000000013F79A83F
RpcRtRemote.dll, xrefs: 000000013F79A8D9
samlib.dll, xrefs: 000000013F79A84D
SSPICLI.DLL, xrefs: 000000013F79A606
SetDllDirectoryW, xrefs: 000000013F79A5A0
sfc_os.dll, xrefs: 000000013F79A5FB
comres.dll, xrefs: 000000013F79A65E
cscapi.dll, xrefs: 000000013F79A7A5
dnsapi.DLL, xrefs: 000000013F79A7CF
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 000000013F79AC69
dsrole.dll, xrefs: 000000013F79A8F5
cabinet.dll, xrefs: 000000013F79A751
cryptsp.dll, xrefs: 000000013F79A8CB
netutils.dll, xrefs: 000000013F79A7F9
dhcpcsvc.dll, xrefs: 000000013F79A8A1
shdocvw.dll, xrefs: 000000013F79A6EF
netapi32.dll, xrefs: 000000013F79A6E1
oleaccrc.dll, xrefs: 000000013F79A75F
ieframe.dll, xrefs: 000000013F79A68D
lpk.dll, xrefs: 000000013F79A63D
dwmapi.dll, xrefs: 000000013F79A627, 000000013F79AB72
linkinfo.dll, xrefs: 000000013F79A8BD
srvcli.dll, xrefs: 000000013F79A797

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: 1ERs$DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll$xlistpos
API String ID: 1466332177-2631482306
Opcode ID: 75c65fd87bb48fbb252f9060d9a8b0682445e0091f3e1e728915e8945996d23f
Instruction ID: 6402cc6552329ee0d9cb6a943bcdf401fc69b94aa24210b2325c72fb73f2094f
Opcode Fuzzy Hash: 75c65fd87bb48fbb252f9060d9a8b0682445e0091f3e1e728915e8945996d23f
Instruction Fuzzy Hash: DC320832A11F8099EB219F64E8813DA73B4FB54354F50523ADA9D477A9EF38C79AC340

Function 000000013F7A8B00 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013F7A8754: DloadProtectSection.DELAYIMP ref: 000000013F7A87C5

RaiseException.KERNEL32 ref: 000000013F7A8BA7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 000000013F7A8B93

Part of subcall function 000000013F7A8A64: DloadProtectSection.DELAYIMP ref: 000000013F7A8AC3

LoadLibraryExA.KERNEL32 ref: 000000013F7A8C46
GetLastError.KERNEL32 ref: 000000013F7A8C54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 000000013F7A8C86
RaiseException.KERNEL32 ref: 000000013F7A8C9A

Strings

H, xrefs: 000000013F7A8B74

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: 08df8d98a9dad4dac36af99e044c8b654dd9a4f13edfbee5db96de11301e47a4
Instruction ID: e010a4097d40b050afdd7258c533bf1db9bc95c87af7881880a38ff060e1ae73
Opcode Fuzzy Hash: 08df8d98a9dad4dac36af99e044c8b654dd9a4f13edfbee5db96de11301e47a4
Instruction Fuzzy Hash: 20911836A11B508AFF54CFA5E9447D833B1FB18B98F0A453ADE1A17758EB38D64AC700

Function 000000013F7A07C4 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32 ref: 000000013F7A07FD

Part of subcall function 000000013F7A0990: LoadCursorW.USER32 ref: 000000013F7A09D9
Part of subcall function 000000013F7A0990: RegisterClassExW.USER32 ref: 000000013F7A0A04

GetWindowRect.USER32 ref: 000000013F7A083E
GetParent.USER32 ref: 000000013F7A0847
MapWindowPoints.USER32 ref: 000000013F7A085D
DestroyWindow.USER32 ref: 000000013F7A086C
GetParent.USER32 ref: 000000013F7A0888
CreateWindowExW.USER32 ref: 000000013F7A08CF
ShowWindow.USER32 ref: 000000013F7A090E
ShowWindow.USER32 ref: 000000013F7A093A
UpdateWindow.USER32 ref: 000000013F7A0944

Strings

RarHtmlClassName, xrefs: 000000013F7A08C4
1ERs, xrefs: 000000013F7A07D2

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterUpdate
String ID: 1ERs$RarHtmlClassName
API String ID: 2859687067-3327420863
Opcode ID: 2ffb5877be5a80f2849e9111e7cffa3fc4bb933bc98fdb6052adf66a743cfd4b
Instruction ID: 90066111d665e5c1b714f1fad55bb4acb837ba74afd3a2d4552e102ccd42912a
Opcode Fuzzy Hash: 2ffb5877be5a80f2849e9111e7cffa3fc4bb933bc98fdb6052adf66a743cfd4b
Instruction Fuzzy Hash: 0E419C72A04B408AFF14CF66E4587EA73A5F799B80F064539EE4A477A4CF39C64AC700

Function 000000013F7A30D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 100
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013F7A28E8: PeekMessageW.USER32 ref: 000000013F7A28FE
Part of subcall function 000000013F7A28E8: GetMessageW.USER32 ref: 000000013F7A2915
Part of subcall function 000000013F7A28E8: IsDialogMessageW.USER32 ref: 000000013F7A292C
Part of subcall function 000000013F7A28E8: TranslateMessage.USER32 ref: 000000013F7A293B
Part of subcall function 000000013F7A28E8: DispatchMessageW.USER32 ref: 000000013F7A2946

GetDlgItem.USER32 ref: 000000013F7A3113
ShowWindow.USER32 ref: 000000013F7A3132
SendMessageW.USER32 ref: 000000013F7A3147
SendMessageW.USER32 ref: 000000013F7A315F
SendMessageW.USER32 ref: 000000013F7A3180
SendMessageW.USER32 ref: 000000013F7A319C
SendMessageW.USER32 ref: 000000013F7A31DF
SendMessageW.USER32 ref: 000000013F7A31FB
SendMessageW.USER32 ref: 000000013F7A320F
SendMessageW.USER32 ref: 000000013F7A3239
SendMessageW.USER32 ref: 000000013F7A3251

Part of subcall function 000000013F7A0968: DestroyWindow.USER32 ref: 000000013F7A097E

Strings

1ERs, xrefs: 000000013F7A30EE

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Message$Send$Window$DestroyDialogDispatchItemPeekShowTranslate
String ID: 1ERs
API String ID: 1209198919-1577259171
Opcode ID: fa27f97e81fdd9f153174fe77ab98be216ca896bdd964116c3b2ac2c746c8652
Instruction ID: 7142601f0b0698a4deea78ab6d243e18df75217e8d5a470d6bcacb9be6b15a31
Opcode Fuzzy Hash: fa27f97e81fdd9f153174fe77ab98be216ca896bdd964116c3b2ac2c746c8652
Instruction Fuzzy Hash: 92416032B106508AF7108FA5E815BC93770E789B98F851239DD1A17BA9CE7EC64BC700

Function 000000013F7A6E54 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 000000013F7A706F
ShowWindow.USER32 ref: 000000013F7A70AE
GetExitCodeProcess.KERNEL32 ref: 000000013F7A70E4
CloseHandle.KERNEL32 ref: 000000013F7A710C
ShowWindow.USER32 ref: 000000013F7A7166

Strings

Install, xrefs: 000000013F7A6FF1
.inf, xrefs: 000000013F7A6FE2
.exe, xrefs: 000000013F7A7117
1ERs, xrefs: 000000013F7A6E6B

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell
String ID: .exe$.inf$1ERs$Install
API String ID: 1828429325-732751198
Opcode ID: 8aabcf0fc50635339d97af016f1aa9b5ab9c55a57160201a8aa8ec534bf5f264
Instruction ID: 1f9e4c9cc08ec884832dcb9b0444c88f906f00fe8acd07dcec2c4d54641ae14d
Opcode Fuzzy Hash: 8aabcf0fc50635339d97af016f1aa9b5ab9c55a57160201a8aa8ec534bf5f264
Instruction Fuzzy Hash: 68A17B32F0460485FF51EBA1E9513EE3BB1AB95B84F414039ED4A577A6DA38CB4BC340

Function 000000013F7BB170 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000000013F7BB2EC
GetProcAddress.KERNEL32 ref: 000000013F7BB2F8

Strings

api-ms-, xrefs: 000000013F7BB236
ext-ms-, xrefs: 000000013F7BB249
1ERs, xrefs: 000000013F7BB1AC, 000000013F7BB291, 000000013F7BB303

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: 1ERs$api-ms-$ext-ms-
API String ID: 3013587201-1896474530
Opcode ID: 57a8b596a1503f26f6ff46af51ce6bc8fd40067f29b5d6761e983004135d4d5f
Instruction ID: 08fa8e28185f1ec152acb694a22c5322219db940bc8cd09a9920f7feaa91f2fa
Opcode Fuzzy Hash: 57a8b596a1503f26f6ff46af51ce6bc8fd40067f29b5d6761e983004135d4d5f
Instruction Fuzzy Hash: 6141B632B11A1482FE15CB5AA8087DA3391B74ABE0F59453DDE1D87798DF38CA47C304

Function 000000013F7A0DE0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 113
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000013F7A1317), ref: 000000013F7A0EFC
CreateStreamOnHGlobal.OLE32 ref: 000000013F7A0F32

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 000000013F7A0E67
<html>, xrefs: 000000013F7A0E4E
</html>, xrefs: 000000013F7A0E93
, xrefs: 000000013F7A0E38
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 000000013F7A0E24
1ERs, xrefs: 000000013F7A0DF8

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Global$AllocCreateStream
String ID: $1ERs$</html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 1039121705-3318514152
Opcode ID: 125e7bda62205f68ffd57646446bb67724558c50e9972ca4f8095c52de3b50cb
Instruction ID: 7e2f7f5264aa0e81260805ec2b26bdd8bcb38024800294f71c577dd15fe81575
Opcode Fuzzy Hash: 125e7bda62205f68ffd57646446bb67724558c50e9972ca4f8095c52de3b50cb
Instruction Fuzzy Hash: 51410B72B04A10A5FF10EFA5D8613ED7771AB54B88F85443AEE0D566AAEE24C60BC340

Function 000000013F790580 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 000000013F79063A
GetLastError.KERNEL32 ref: 000000013F79064D
CreateFileW.KERNEL32 ref: 000000013F79069D
GetLastError.KERNEL32 ref: 000000013F7906A6
SetFileTime.KERNEL32 ref: 000000013F79070D

Strings

1ERs, xrefs: 000000013F790593

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID: 1ERs
API String ID: 1999340476-1577259171
Opcode ID: dcfe0a08d1e0b445740c6a5767d5a0c50ae79fd6602f16daa682fc2f45f2860c
Instruction ID: 00d7b23c171827d060284c0aa3db8737d4319d841c465406389a19a411cb1ccd
Opcode Fuzzy Hash: dcfe0a08d1e0b445740c6a5767d5a0c50ae79fd6602f16daa682fc2f45f2860c
Instruction Fuzzy Hash: 47511172A1428046FB208F25E0553EA7AA0F3857B8F04033DDF6A57AE1CB3DC65ACB00

Function 000000013F7AF9BC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?,000000013F7AFC6E,?,?,?,000000013F7AF960,?,?,00000001,000000013F7AC679), ref: 000000013F7AFA41
GetLastError.KERNEL32(?,?,?,000000013F7AFC6E,?,?,?,000000013F7AF960,?,?,00000001,000000013F7AC679), ref: 000000013F7AFA4F
LoadLibraryExW.KERNEL32(?,?,?,000000013F7AFC6E,?,?,?,000000013F7AF960,?,?,00000001,000000013F7AC679), ref: 000000013F7AFA79
FreeLibrary.KERNEL32(?,?,?,000000013F7AFC6E,?,?,?,000000013F7AF960,?,?,00000001,000000013F7AC679), ref: 000000013F7AFABF
GetProcAddress.KERNEL32(?,?,?,000000013F7AFC6E,?,?,?,000000013F7AF960,?,?,00000001,000000013F7AC679), ref: 000000013F7AFACB

Strings

api-ms-, xrefs: 000000013F7AFA61

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: bae88bc27c21ad60c76f677b5c45fa165faed71e7c4ca7cdbe25b1edddfacdfe
Instruction ID: 06619c42def0d860cf665375b86dc14f27a56baa896e3b2e008f0a056a939b8a
Opcode Fuzzy Hash: bae88bc27c21ad60c76f677b5c45fa165faed71e7c4ca7cdbe25b1edddfacdfe
Instruction Fuzzy Hash: 51319231B12B5095FE219F82A800BE673E4FB49BA5F5A463DDD194B394EF38C64B8300

Function 000000013F7A7598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.ADVAPI32 ref: 000000013F7A762E
RegSetValueExW.ADVAPI32 ref: 000000013F7A7675
RegCloseKey.ADVAPI32 ref: 000000013F7A7680

Strings

Software\WinRAR SFX, xrefs: 000000013F7A7620
1ERs, xrefs: 000000013F7A75A1

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CloseCreateValue
String ID: 1ERs$Software\WinRAR SFX
API String ID: 1818849710-2170826906
Opcode ID: ab533b50932db9b46b0fcb2a6db69c68fa5b0be7dc7afc5157c19e885853c253
Instruction ID: f126284c7f01e519b9128d4044c76a0ec3ed908a564dc230e922ff344bbd35d4
Opcode Fuzzy Hash: ab533b50932db9b46b0fcb2a6db69c68fa5b0be7dc7afc5157c19e885853c253
Instruction Fuzzy Hash: D0216232A14A4086FF50DB61F8557DA7760F794794F401139E98D42BE5DF6CC75ACB00

Function 000000013F7A19F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 000000013F7A1A19
SHAutoComplete.SHLWAPI ref: 000000013F7A1A5D

Part of subcall function 000000013F79CB10: CompareStringW.KERNEL32 ref: 000000013F79CB2F

FindWindowExW.USER32 ref: 000000013F7A1A47

Strings

EDIT, xrefs: 000000013F7A1A23, 000000013F7A1A3B
1ERs, xrefs: 000000013F7A19F9

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: 1ERs$EDIT
API String ID: 4243998846-627568177
Opcode ID: a3730f09f30549a015c781de93191d6efbc31bd36ef359d9da3c26f4bf0f9089
Instruction ID: 84ae34ca57b9f7040eb62f410c51cbb65a43d1bf054085e0b495c76cc760c33e
Opcode Fuzzy Hash: a3730f09f30549a015c781de93191d6efbc31bd36ef359d9da3c26f4bf0f9089
Instruction Fuzzy Hash: 8B014431B14B4181FE209B51F8657D673A0BB98780F45143A8D4D47794EE7CC34BCB10

Function 000000013F7A28E8 Relevance: 7.5, APIs: 5, Instructions: 27windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 000000013F7A28FE
GetMessageW.USER32 ref: 000000013F7A2915
IsDialogMessageW.USER32 ref: 000000013F7A292C
TranslateMessage.USER32 ref: 000000013F7A293B
DispatchMessageW.USER32 ref: 000000013F7A2946

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 2d41d9326857e66844fb115c9f216b9fd577e98702e5580aa58207ff4f5c7ede
Instruction ID: a98292e09aa54da6ecc6302242193be44f2f298f546f69b7925c2cc50481ca15
Opcode Fuzzy Hash: 2d41d9326857e66844fb115c9f216b9fd577e98702e5580aa58207ff4f5c7ede
Instruction Fuzzy Hash: 52F01236B3454183FB609F64F895B963361FBE4B09F815029A64A51954DF38C21ACB00

Function 000000013F7909B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,00000000,?,000000013F782D4B,?,?,?,000000013F7958BE,?,?,000000013F782D4B,000000013F79EED1), ref: 000000013F7909F2
WriteFile.KERNEL32 ref: 000000013F790A3C
WriteFile.KERNEL32 ref: 000000013F790A6A

Strings

1ERs, xrefs: 000000013F7909BF

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: FileWrite$Handle
String ID: 1ERs
API String ID: 4209713984-1577259171
Opcode ID: 6c63c6d13426ae45ae70cfabcba1d893a44962a4fb46c0652e468ff880ee99ec
Instruction ID: a17ed95879005fa29aed1a79f6baedc9ae3d8bdf659613e0d0fd10879ee699bd
Opcode Fuzzy Hash: 6c63c6d13426ae45ae70cfabcba1d893a44962a4fb46c0652e468ff880ee99ec
Instruction Fuzzy Hash: CF41E233B2594096FA60CB35E914BEB7370F744B94F415039EE4A87AA4DB38CA8BC740

Function 000000013F7911B4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000000,?,000000013F7913AC), ref: 000000013F7911FC
CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000000,?,000000013F7913AC), ref: 000000013F791247
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,000000013F7913AC), ref: 000000013F791271

Strings

1ERs, xrefs: 000000013F7911C6

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID: 1ERs
API String ID: 2485089472-1577259171
Opcode ID: 913eede59ff50bad42cb935bf16b1ff0049bae282bbe7c49875a751f3b0a0ac1
Instruction ID: 504baf4f339dde526e2f0a3090776e5d9d1fddb28ea657e030c583065020db5d
Opcode Fuzzy Hash: 913eede59ff50bad42cb935bf16b1ff0049bae282bbe7c49875a751f3b0a0ac1
Instruction Fuzzy Hash: E721B03AB0464042FB70EB61A5513EB73A1B785780F464139ED4AC3B96DFB8CA278200

Function 000000013F7811C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32 ref: 000000013F7811EB
SHBrowseForFolderW.SHELL32 ref: 000000013F781228

Part of subcall function 000000013F7939B8: SHGetPathFromIDListW.SHELL32 ref: 000000013F7939E8

Strings

A, xrefs: 000000013F781220
1ERs, xrefs: 000000013F7811CB

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: BrowseFolderFromListMallocPath
String ID: 1ERs$A
API String ID: 2332185071-695673618
Opcode ID: b00eb2558a74acd322b513043997ce8e923ceda0cdca6b51de8298474a559cb6
Instruction ID: 6e3499f56f848174639d902ae3058ab9a29f17979052917f44960759e988cb16
Opcode Fuzzy Hash: b00eb2558a74acd322b513043997ce8e923ceda0cdca6b51de8298474a559cb6
Instruction Fuzzy Hash: BD115E76B14B8486FA508B11F4953EAB3B4F799BD4F404129EA8D87B98DF3CC55ACB00

Function 000000013F7A2794 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24comCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013F79AD40: GetSystemDirectoryW.KERNEL32 ref: 000000013F79AD8F
Part of subcall function 000000013F79AD40: LoadLibraryW.KERNEL32 ref: 000000013F79ADF9

OleInitialize.OLE32 ref: 000000013F7A27AE
GdiplusStartup.GDIPLUS ref: 000000013F7A27E6
SHGetMalloc.SHELL32 ref: 000000013F7A27F3

Strings

riched20.dll, xrefs: 000000013F7A279D

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: e1ae680da6eeb6b091c96a84323e0508884e921eebe8047fde12cde52f90d683
Instruction ID: aada90470cc386531610a38045b832772104fbaf02748fc8e2cad9d7a03335d5
Opcode Fuzzy Hash: e1ae680da6eeb6b091c96a84323e0508884e921eebe8047fde12cde52f90d683
Instruction Fuzzy Hash: 02F01772A14A4682FF009F60E8143D9B360FBA4714F80003AE98E466A4DF7CC74ECB10

Function 000000013F7A2EEC Relevance: 6.1, APIs: 4, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000000013F7A2F34
RegQueryValueExW.ADVAPI32 ref: 000000013F7A2F65
RegQueryValueExW.ADVAPI32 ref: 000000013F7A2FE7
RegCloseKey.ADVAPI32 ref: 000000013F7A3026

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 28a070677619c59ed845ba7aa30c74b9fadcb3fd9c6e5316b8293aa6b47e6f28
Instruction ID: fb7c09e530072d31c6cb79c6be3354244697c0d509a8ee5c842649c40897d1a0
Opcode Fuzzy Hash: 28a070677619c59ed845ba7aa30c74b9fadcb3fd9c6e5316b8293aa6b47e6f28
Instruction Fuzzy Hash: AA415832B10A5089EB50DBA1D852BEE37A4F798B84F40803AEE4D97B59DE38C6568340

Function 000000013F7A9D1C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 000000013F7A9D2B

Part of subcall function 000000013F7A97A4: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 000000013F7A97C6

__scrt_acquire_startup_lock.LIBCMT ref: 000000013F7A9D40
__scrt_release_startup_lock.LIBCMT ref: 000000013F7A9DAE
__scrt_get_show_window_mode.LIBCMT ref: 000000013F7A9E01

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: b1a589d711ce5c113e8e4a51647d4a5db0ae59c4c3c3c73f71d1b0031afe7af5
Instruction ID: 72614195ac915889b6d2684bc54916a5f7fcc803afdf7a20f6b7fcaf87544b6a
Opcode Fuzzy Hash: b1a589d711ce5c113e8e4a51647d4a5db0ae59c4c3c3c73f71d1b0031afe7af5
Instruction Fuzzy Hash: 4531C432E0424081FF64BFA4E4513E933A1AB85784F86443CAA0A4B3E7DE29CB5FC751

Function 000000013F790CB8 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,000000013F790B8F,?,?,?,?,00000000,000000013F78F09E), ref: 000000013F790CE0
ReadFile.KERNEL32 ref: 000000013F790CFF
GetLastError.KERNEL32 ref: 000000013F790D33
GetLastError.KERNEL32 ref: 000000013F790D52

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 0c321b472b1accf97c07723b29d3a00105f7604eb72aaf1162b066b3eb931f18
Instruction ID: 118513beaca99d3f5dcb6c87495c97e7a9639870e74b7d85ef939bd3356308b4
Opcode Fuzzy Hash: 0c321b472b1accf97c07723b29d3a00105f7604eb72aaf1162b066b3eb931f18
Instruction Fuzzy Hash: 6121A231E24E40C5EA709F35B4003AB77A4F746BA4F14513DDA5A8B7E5CB38DA868741

Function 000000013F7BAADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F7BA42C: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,000000013F7BA768), ref: 000000013F7BA456

IsValidCodePage.KERNEL32(?,?,?,00000001,?,00000000,?,000000013F7BA899), ref: 000000013F7BAB49
GetCPInfo.KERNEL32(?,?,?,00000001,?,00000000,?,000000013F7BA899), ref: 000000013F7BAB8D

Strings

1ERs, xrefs: 000000013F7BAAF2

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CodeInfoPageValid
String ID: 1ERs
API String ID: 546120528-1577259171
Opcode ID: 5d6f11de72f5d3909ae7cdef260ed5fab4dc2d1caac9d7e27b3f9ee4a98ada73
Instruction ID: cbf0da857fff40a89f79b79bcdc6b30cae48740486315d7a7bd35333d6ee204d
Opcode Fuzzy Hash: 5d6f11de72f5d3909ae7cdef260ed5fab4dc2d1caac9d7e27b3f9ee4a98ada73
Instruction Fuzzy Hash: 0981C1B2A0468886FB64AF29E0543E97FA2F356740F58403ECF9A47695DA39DF47C300

Function 000000013F7BA544 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000000013F7BA586

Strings

, xrefs: 000000013F7BA5C9
1ERs, xrefs: 000000013F7BA55E

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Info
String ID: $1ERs
API String ID: 1807457897-4251509486
Opcode ID: 789a4126fd2d51ccc01158b3c7840c3a71ce060e94776f7cb552cb3a58c115b4
Instruction ID: 17495c56aae445841deb5eb4cfa0dac193f3a83fef08a1ca78b5cf56ee57889b
Opcode Fuzzy Hash: 789a4126fd2d51ccc01158b3c7840c3a71ce060e94776f7cb552cb3a58c115b4
Instruction Fuzzy Hash: A651A672A187C49BF7219F34E0843DE7BA1F34A748F944139DB8947A85CB78CA56CB40

Function 000000013F790DA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,?,?,000000013F790FB5,?,?,?,000000013F78E89F), ref: 000000013F790EDC
GetLastError.KERNEL32(?,00000000,?,?,?,000000013F790FB5,?,?,?,000000013F78E89F), ref: 000000013F790EEB

Strings

1ERs, xrefs: 000000013F790DBC

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: 1ERs
API String ID: 2976181284-1577259171
Opcode ID: 30d69afa2f8fea5e1676c29147f384c57fe93985ddc0e2677324810948d62f4f
Instruction ID: fa65d6c8cea8b7aad57dcd48ec3511942a73d6dd6e525c4b021e19306e04e8a1
Opcode Fuzzy Hash: 30d69afa2f8fea5e1676c29147f384c57fe93985ddc0e2677324810948d62f4f
Instruction Fuzzy Hash: 91317332B21A5482FE605F3AE541BDA7360AB44FD4F145239AE5D87BF4DB39CA839700

Function 000000013F7907A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000000013F790839
CreateFileW.KERNEL32 ref: 000000013F790891

Strings

1ERs, xrefs: 000000013F7907B4

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CreateFile
String ID: 1ERs
API String ID: 823142352-1577259171
Opcode ID: 7e97925d7c3582261a0924c79b53a7fcbe5925999bd5a73e6ec343f705ecc1ff
Instruction ID: a3bf85a91d6186b3cf032e84045030e8c5f312832320f8ff314a2b90d4ef4050
Opcode Fuzzy Hash: 7e97925d7c3582261a0924c79b53a7fcbe5925999bd5a73e6ec343f705ecc1ff
Instruction Fuzzy Hash: B431C733A206808AFB609F20E4057DA7660F785778F544338DEA947AD6CB79C656C740

Function 000000013F79AD40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 000000013F79AD8F
LoadLibraryW.KERNEL32 ref: 000000013F79ADF9

Strings

1ERs, xrefs: 000000013F79AD57

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID: 1ERs
API String ID: 1175261203-1577259171
Opcode ID: 3245ba2793be4fba06aa236f857d8204ba1a07326754a835ada1c1679b041746
Instruction ID: f1a9ebd50d074902263765622a00c54c9ca3d888c814c1c9945e3f367a3388d2
Opcode Fuzzy Hash: 3245ba2793be4fba06aa236f857d8204ba1a07326754a835ada1c1679b041746
Instruction Fuzzy Hash: 89213632B01944AAEB10EFB1D4A67DD3770E794784F82543ADA0D9779ADE24C70AC340

Function 000000013F7A0190 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 000000013F7A01E7
CopyRect.USER32 ref: 000000013F7A0208

Strings

1ERs, xrefs: 000000013F7A019B

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Rect$ClientCopy
String ID: 1ERs
API String ID: 1880273418-1577259171
Opcode ID: 4c4c53f5941366ca05170129574d2302a37d8930208409adda015816e1e6f880
Instruction ID: cf2ed5b29a840ac192e6b914da74ca3e9a9bbfd930a24da5a52db7ebae1a1a92
Opcode Fuzzy Hash: 4c4c53f5941366ca05170129574d2302a37d8930208409adda015816e1e6f880
Instruction Fuzzy Hash: 6D218C73610B848AEB10CF26E48479A73B0F348BA5F058125DF4D47751DB39C5A6CB00

Function 000000013F782724 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 000000013F782756
GetWindowTextW.USER32 ref: 000000013F78278A

Strings

1ERs, xrefs: 000000013F78272E

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: TextWindow$Length
String ID: 1ERs
API String ID: 1006428111-1577259171
Opcode ID: 693238c59dfcd0af217fe7a8ec1b744b67b4b4df6e5d41ed855ced795a2116ac
Instruction ID: 6e73a155849d062176c7d458fa05584675f0e51bd30deb4638f262283523b732
Opcode Fuzzy Hash: 693238c59dfcd0af217fe7a8ec1b744b67b4b4df6e5d41ed855ced795a2116ac
Instruction Fuzzy Hash: 0F11613260494051EA10EB51E9523EEBB70EBD9BC1F54003AEA4E86BBADE28C747C700

Function 000000013F79788C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 000000013F797855
LoadStringW.USER32 ref: 000000013F797871

Strings

Extracting %s, xrefs: 000000013F7978AA

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: LoadString
String ID: Extracting %s
API String ID: 2948472770-2318847974
Opcode ID: 4c99ee2f3136c9eaeab264dd604a1bd4734cbf8bd24d08ca86dfbbf99dc764f6
Instruction ID: 5b4e6608e57aadc569abf59c10e27ecaa8508f13cf9cbf23d1bf7c1d9ccf8ee8
Opcode Fuzzy Hash: 4c99ee2f3136c9eaeab264dd604a1bd4734cbf8bd24d08ca86dfbbf99dc764f6
Instruction Fuzzy Hash: FC014CB1F0474086EB508F19E8857E677A2B7A8BC4F54843DDA0D97B69DE38C693C600

Function 000000013F791694 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F79126D), ref: 000000013F7916BF
SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F79126D), ref: 000000013F7916F9

Strings

1ERs, xrefs: 000000013F7916A3

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: AttributesFile
String ID: 1ERs
API String ID: 3188754299-1577259171
Opcode ID: 08041598bbfc8ee7016aa0b0103d0fb04ae4b6732f55a4ada51b10bda0816287
Instruction ID: a82c1aaa62f1651629a53bda6c81dcf7a909526b59729ceec6876f962bb2f275
Opcode Fuzzy Hash: 08041598bbfc8ee7016aa0b0103d0fb04ae4b6732f55a4ada51b10bda0816287
Instruction Fuzzy Hash: B1015232B0464182FA20DB61F8513DA73B0FB89B84F444139EA8D87BA6DF28C657CB40

Function 000000013F7919A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32 ref: 000000013F7919C4
DeleteFileW.KERNEL32 ref: 000000013F7919FC

Strings

1ERs, xrefs: 000000013F7919AA

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: DeleteFile
String ID: 1ERs
API String ID: 4033686569-1577259171
Opcode ID: e8be1f6962a8664d0939ea7b10e775250d712eeabbcebd9d35a28616fbe80002
Instruction ID: 2ee4e82f3de048965ebe25136645b441dd32288373469e8d44401eb325423c53
Opcode Fuzzy Hash: e8be1f6962a8664d0939ea7b10e775250d712eeabbcebd9d35a28616fbe80002
Instruction Fuzzy Hash: 03014432B4468142EE10DB61E4513EA7360FB85B84F45013DE99D87796DF28CA56C600

Function 000000013F79160C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F7915DD,?,?,?,?,000000013F78BD80), ref: 000000013F791630
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F7915DD,?,?,?,?,000000013F78BD80), ref: 000000013F791666

Strings

1ERs, xrefs: 000000013F791616

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: AttributesFile
String ID: 1ERs
API String ID: 3188754299-1577259171
Opcode ID: 0d029f1be65e0e5603c0bace5cacd859890830e7664a4b3eca3c0019234412f5
Instruction ID: 26588796e67fbcee2ac33cbca623ba46af39819730a3488194459e5bd54cf36f
Opcode Fuzzy Hash: 0d029f1be65e0e5603c0bace5cacd859890830e7664a4b3eca3c0019234412f5
Instruction Fuzzy Hash: 21016232B0464042EE50EB60F5523EA73B1B789794F41023DEA9D877E6DF68CB56C740

Function 000000013F7BB3E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32(?,?,00000003,000000013F7B8AB1), ref: 000000013F7BB435
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000003,000000013F7B8AB1), ref: 000000013F7BB442

Strings

InitializeCriticalSectionEx, xrefs: 000000013F7BB40D

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CriticalInitializeSection$CountSpin
String ID: InitializeCriticalSectionEx
API String ID: 4156364057-3084827643
Opcode ID: 70ce026c1062cd7536bc8c4ef3018c1ae346da97b3efec155eeae0b50783c252
Instruction ID: 44a5f6bd2040f1a7105eed9f23af05421eb0ae0d9509b40c6b1a9848a7d1888d
Opcode Fuzzy Hash: 70ce026c1062cd7536bc8c4ef3018c1ae346da97b3efec155eeae0b50783c252
Instruction Fuzzy Hash: ADF03A75B14B8482EA548B57B5447E973A1BB89BC0F985039EE1A17B58CE38CA4B8740

Function 000000013F7B5E04 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,000000013F7B5E00), ref: 000000013F7B5E15
TerminateProcess.KERNEL32(?,?,?,000000013F7B5E00), ref: 000000013F7B5E20
ExitProcess.KERNEL32 ref: 000000013F7B5E2F

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0c078c363d29b9141b167f0092bd120b3e9dd2414ef442033e7c55832df72cdf
Instruction ID: 7d12590455c288716fe5ac629cc7df044de0c6bb5a3d8e83f2944460b6b607c1
Opcode Fuzzy Hash: 0c078c363d29b9141b167f0092bd120b3e9dd2414ef442033e7c55832df72cdf
Instruction Fuzzy Hash: EDD09230F1170886EE582F706A957E832216B99B81F01143C89470A39BCF398E4B8200

Function 000000013F7A0C7C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 000000013F7A0D9D

Strings

1ERs, xrefs: 000000013F7A0C8E

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ShowWindow
String ID: 1ERs
API String ID: 1268545403-1577259171
Opcode ID: 5134a0bba61ddd67747fce870432551b35958541116bffe9b840d32909437fba
Instruction ID: 2b3f064643aefbb6fe23b103ab030f32879aac00e6e7ad1f9e071aa4670478d4
Opcode Fuzzy Hash: 5134a0bba61ddd67747fce870432551b35958541116bffe9b840d32909437fba
Instruction Fuzzy Hash: D441F636B10B548AFB108BA6E8907D83770F788B99F01452ADE0E47B65CF79D64AC700

Function 000000013F7A32F8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32 ref: 000000013F7A33AD

Part of subcall function 000000013F79788C: LoadStringW.USER32 ref: 000000013F797855
Part of subcall function 000000013F79788C: LoadStringW.USER32 ref: 000000013F797871

Strings

1ERs, xrefs: 000000013F7A3305

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: LoadString$ItemText
String ID: 1ERs
API String ID: 1059950464-1577259171
Opcode ID: 8dfaf5107776f4bb91ff556e9ac6771125ec21fa947c0e43471bc33183724d37
Instruction ID: 644271cce401a98c2380e84c6f669979fe59186c8348d71f3b5f81555ea88b6f
Opcode Fuzzy Hash: 8dfaf5107776f4bb91ff556e9ac6771125ec21fa947c0e43471bc33183724d37
Instruction Fuzzy Hash: EE213032A0468091FA60EB51E8523DBB761FBC4780F81413EAA9D477DBDE2CC71AC740

Function 000000013F7BB458 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 000000013F7BB529

Strings

LCMapStringEx, xrefs: 000000013F7BB474, 000000013F7BB485

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 8edcd1dfeb4e11932c5bcda800dafe0a52aa29bfe321694e1dec0054d309228c
Instruction ID: a5dbf7d3d50d1feb4f148f250c2481c4862c586f731abaa6ca671338ce57ec0e
Opcode Fuzzy Hash: 8edcd1dfeb4e11932c5bcda800dafe0a52aa29bfe321694e1dec0054d309228c
Instruction Fuzzy Hash: BE212C75608B8486DB60CF1AF8407DAB7A4F789BC0F54412AEE8D83B19DF38C9418B00

Function 000000013F7827FC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 000000013F78282E

Strings

1ERs, xrefs: 000000013F782809

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Item
String ID: 1ERs
API String ID: 3207170592-1577259171
Opcode ID: bbc828a22b587c18cfcee94c2407bc39963c56471405518dd50b8081fac055eb
Instruction ID: 166d2e7f83afe21102416a22c04398fe9b4883ff5cfb47dd9478b25129a2298e
Opcode Fuzzy Hash: bbc828a22b587c18cfcee94c2407bc39963c56471405518dd50b8081fac055eb
Instruction Fuzzy Hash: 5C11A031A1568042FE549B10E9563EAB390FB88785F404139EA8D477EADF2CC606C700

Function 000000013F79AF80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000000013F79AFAA

Strings

CreateThread failed, xrefs: 000000013F79AFB8

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CreateThread
String ID: CreateThread failed
API String ID: 2422867632-3849766595
Opcode ID: 076826c65c3817310e42f2594601f196a5e328c759c1d6d375bb12eb28e87a68
Instruction ID: 9c7f24a9b9f235aa5652d023c3b75a38883ceb38b69cde27c12438906e7b80ca
Opcode Fuzzy Hash: 076826c65c3817310e42f2594601f196a5e328c759c1d6d375bb12eb28e87a68
Instruction Fuzzy Hash: 74F03471A10B4096EA01DB24E89A7DA7360E748784F84453EE988063A5EB3CC75BC700

Function 000000013F781B5C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 000000013F781B67

Strings

vector too long, xrefs: 000000013F781B60

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: vector too long
API String ID: 909987262-2873823879
Opcode ID: e7f1a1db9dd46f36446f392bd04bf6f0da6fc0c7d75d490b6e2a964867ce68f1
Instruction ID: 1ef458e79988c12d83174fbaf178c89513b5244c9c1858d364a9d7bdcdd8b960
Opcode Fuzzy Hash: e7f1a1db9dd46f36446f392bd04bf6f0da6fc0c7d75d490b6e2a964867ce68f1
Instruction Fuzzy Hash: 77E04F36A01F8592DA18AF91F6812887374F758780F648935D75807B65EF34D2B28700

Function 000000013F791020 Relevance: 3.1, APIs: 2, Instructions: 78timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 000000013F79104A
SetFileTime.KERNEL32 ref: 000000013F7910FA

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 6a6bc897d1c5dff00b34c8d30a5e108cf18015d032f8426d0a3628d9fa8e4bb9
Instruction ID: 10cb4dc09e7b1b51b4551d2bd8d5bec67d990f9080e515f244ff2fa4a52bd60d
Opcode Fuzzy Hash: 6a6bc897d1c5dff00b34c8d30a5e108cf18015d032f8426d0a3628d9fa8e4bb9
Instruction Fuzzy Hash: 7221F532F456C048FD559B6692143EFB3719B82BC4F080135DD490B7AADAA6CB6BC300

Function 000000013F790F00 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32 ref: 000000013F790F5C
GetLastError.KERNEL32 ref: 000000013F790F69

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ea7845a602860c14d0a46e4b99b46f81841b6815f05ce2a60d14a5b1042bce38
Instruction ID: dd7e704f5b23629d6b3371970d3b0bfbb03cc4bc2099e7c95f93b7d73e71b0d1
Opcode Fuzzy Hash: ea7845a602860c14d0a46e4b99b46f81841b6815f05ce2a60d14a5b1042bce38
Instruction Fuzzy Hash: 09115E32A28B4082FB608B35A4453DE7761E745BB4F544329EA7A973E9CB39C783C340

Function 000000013F79B038 Relevance: 3.0, APIs: 2, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,000000013F79B08D,?,?,?,?,000000013F793392,?,?,?,000000013F79331D), ref: 000000013F79B03C
GetProcessAffinityMask.KERNEL32 ref: 000000013F79B04F

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 365564994351043c0f6da4208c40dc7667041a7c1eea9d086d56b8e935f100ff
Instruction ID: 558df31adf88835cc73bc047aa9292e046bdcf542d9be7bb6d55b981d4f52870
Opcode Fuzzy Hash: 365564994351043c0f6da4208c40dc7667041a7c1eea9d086d56b8e935f100ff
Instruction Fuzzy Hash: DFE09B71B2194586DF598F5DD854BDA73A1BBC8B40F848139D50783714DE29D7468700

Function 000000013F7A933C Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000013F7A936C
Concurrency::cancel_current_task.LIBCPMT ref: 000000013F7A9372

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: dbbab3fd95f54e33885a284bb2ed7428d76a937d639561f340475b5681ff7bf1
Instruction ID: 3a74cb2c5c519750f6ddc097a79f4eb5396158d4da0237322298d6d061146bbb
Opcode Fuzzy Hash: dbbab3fd95f54e33885a284bb2ed7428d76a937d639561f340475b5681ff7bf1
Instruction Fuzzy Hash: F8E01230E1150946FD5932F355563F931740F5A7B1E1E1B3C9A3A153C2B924CB6B8120

Function 000000013F782280 Relevance: 3.0, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000013F7822AE
Concurrency::cancel_current_task.LIBCPMT ref: 000000013F7822B4

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: da961a74296a8bf94e293d096c062b8a1162fd65afa57d4769f7f2f1c1c3535b
Instruction ID: e93003c870ea57202a483aaa4dd5a55208a41931c5275035dd484b70a36927ca
Opcode Fuzzy Hash: da961a74296a8bf94e293d096c062b8a1162fd65afa57d4769f7f2f1c1c3535b
Instruction Fuzzy Hash: 4DE0E265E02B0A85EC1CB3A5C0973ED26A04B49731E900F38E63D06BE2EA289A53C250

Function 000000013F7AC7DC Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

__vcrt_FlsAlloc.LIBVCRUNTIME ref: 000000013F7AC7E7
__vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 000000013F7AC817

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Alloc__vcrt___vcrt_uninitialize_ptd
String ID:
API String ID: 3765095794-0
Opcode ID: d597362c3116f6ab4b785273b15ee223b4072af199ab353e3b77f6cbd2219f8d
Instruction ID: 315227b915288c0ed07eb41fffbe550580e66a294f3166a9c01825d81b68fa5e
Opcode Fuzzy Hash: d597362c3116f6ab4b785273b15ee223b4072af199ab353e3b77f6cbd2219f8d
Instruction Fuzzy Hash: DBE0B674E00600E5FE64ABB998953E432A07B45360F96677DE025863E2EB28C76F9720

Function 000000013F7B7738 Relevance: 2.5, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000013F7B774E
GetLastError.KERNEL32(?,?,000000013F7B6677,000000013F7BC272,?,?,?,000000013F7BC2AF,?,?,00000000,000000013F7BC775,?,?,?,000000013F7BC6A7), ref: 000000013F7B7758

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 270eea0ec511144396b5b6131a5847575a112457cd499bf419628d3236a835b4
Instruction ID: e5071c7a06a2ce41a75dce2c6184be9e4b4df337b5d0f30af35897ebc29cef20
Opcode Fuzzy Hash: 270eea0ec511144396b5b6131a5847575a112457cd499bf419628d3236a835b4
Instruction Fuzzy Hash: 5AE0C271F0120443FF086FF2A8853E832A15B8D700F44403C8E0287391DE388F838310

Function 000000013F7B5D35 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000000013F7B5D63

Part of subcall function 000000013F7B5E5C: GetModuleHandleExW.KERNEL32 ref: 000000013F7B5E81
Part of subcall function 000000013F7B5E5C: GetProcAddress.KERNEL32 ref: 000000013F7B5E97
Part of subcall function 000000013F7B5E5C: FreeLibrary.KERNEL32 ref: 000000013F7B5EBE

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 1ac00a3ac0a97039873183d2416d4f645a5f18b594404755723b7314a3f65ff8
Instruction ID: d9c477e945e4c7bde897f66883986c03b6219e3b90a69e270f7c40eb404776d8
Opcode Fuzzy Hash: 1ac00a3ac0a97039873183d2416d4f645a5f18b594404755723b7314a3f65ff8
Instruction Fuzzy Hash: 4E214832A10B088AFBA49F64D4883ED37B0E745758F54473AD76906BD9DB34CA86CB80

Function 000000013F7A8754 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F7A8800: GetModuleHandleW.KERNEL32(?,?,?,000000013F7A876F,?,?,?,000000013F7A8B2A), ref: 000000013F7A8827

DloadProtectSection.DELAYIMP ref: 000000013F7A87C5

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: c0018843b65cb32e0b337282390bd8317558431382415f05cfee804b8789bce6
Instruction ID: d71a12600c9daaf756448231df50b8e8204e35d35f3b73cfe85ad45ede303925
Opcode Fuzzy Hash: c0018843b65cb32e0b337282390bd8317558431382415f05cfee804b8789bce6
Instruction Fuzzy Hash: FE119072E1060581FE51AFD5AE857E033A1A718759F85403DEA09473F1DB388B9BC615

Function 000000013F791EA4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F791F08: FindFirstFileW.KERNEL32 ref: 000000013F791F53
Part of subcall function 000000013F791F08: FindFirstFileW.KERNEL32 ref: 000000013F791F94
Part of subcall function 000000013F791F08: GetLastError.KERNEL32 ref: 000000013F791FAD

FindClose.KERNEL32(?,?,?,000000013F78C08E), ref: 000000013F791ED9

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 34d6502389b4690eca8b4a11efe4042d55015a8a6d19fd2ec76808677c43b1a3
Instruction ID: 23e5dfc664bfb8e3a8b878e611fc6daf0dc0649907a0fea14061999b0a03795f
Opcode Fuzzy Hash: 34d6502389b4690eca8b4a11efe4042d55015a8a6d19fd2ec76808677c43b1a3
Instruction Fuzzy Hash: BCF02472A0438081EF50AF79A1063DA37609706BB4F18437CDE3A0B7D7CA64C2A7C700

Function 000000013F7939B8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

SHGetPathFromIDListW.SHELL32 ref: 000000013F7939E8

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: FromListPath
String ID:
API String ID: 3839826586-0
Opcode ID: 4ee4a53a9798eae0db382600d551ca3ae0aa6d7e4044a86bff0496983a3df156
Instruction ID: 0185c7d57ac2ce5dc88e2b5de14a1eee26b4765d1f37dddbb0fce5675dd0739a
Opcode Fuzzy Hash: 4ee4a53a9798eae0db382600d551ca3ae0aa6d7e4044a86bff0496983a3df156
Instruction Fuzzy Hash: 40F0896270444052DA10AB12E8567EE7720F7D47C4F84403AE58D877AADD6CCA46C700

Function 000000013F7B7774 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,000000013F7B8FA1,?,?,00000000,000000013F7BB137,?,?,?,000000013F7B6677,?,?,?,000000013F7B656D), ref: 000000013F7B77B2

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 44d1fbd9aeaba12978170c91871863ab6d6e557c08f90b5073f45cb598671283
Instruction ID: bc70db0031eeca7d940804785f3d75573643281ff5f1acf051cc3939863d1dbd
Opcode Fuzzy Hash: 44d1fbd9aeaba12978170c91871863ab6d6e557c08f90b5073f45cb598671283
Instruction Fuzzy Hash: 82F0A035F0120841FE646B7158117E532905B4EBB0F58073CAF27863C1DA2CCF434260

Function 000000013F79B220 Relevance: 1.5, APIs: 1, Instructions: 25threadCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013F79AF80: CreateThread.KERNEL32 ref: 000000013F79AFAA

SetThreadPriority.KERNEL32(?,?,?,000000013F79B3A2), ref: 000000013F79B25A

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Thread$CreatePriority
String ID:
API String ID: 2610526550-0
Opcode ID: be7d468b03d03b89ae625b15826e974f6cb6fcd7b4f78dcfcb41af788ab5fe92
Instruction ID: 6d2cf84b65778f245688c4e1ffee8a497acb7ba0dbc24931d3c229909aaebafa
Opcode Fuzzy Hash: be7d468b03d03b89ae625b15826e974f6cb6fcd7b4f78dcfcb41af788ab5fe92
Instruction Fuzzy Hash: 2DF05E32A15A80C2E740AF56F98439F7371F384F84F548139EA9606359CB34C6938710

Function 000000013F7A2804 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS ref: 000000013F7A2825

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: GdiplusShutdown
String ID:
API String ID: 872607806-0
Opcode ID: 7107821959c357d72a3bbd2138b0c6fef8d2e4744e4df414b84200909bcac28e
Instruction ID: 7fbb622f2ae6cf9eb293bc8e16573c83b2291d088cee1c5a3cbe805ac8bb4fea
Opcode Fuzzy Hash: 7107821959c357d72a3bbd2138b0c6fef8d2e4744e4df414b84200909bcac28e
Instruction Fuzzy Hash: F4E01236A08BC4C2EB068F72E8543983B30E35AF54F5D406ACB5943362DA28855AC310

Function 000000013F7A2724 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStream.GDIPLUS ref: 000000013F7A274D

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 8755241a6e8fba26f7a3844923e965bd14633a0c29ae9e09f8c5e4ad22476a9d
Instruction ID: e3cf12f168ee5a695a1f8c0280f621432b85b4a9856857426c2ef2aee87ac426
Opcode Fuzzy Hash: 8755241a6e8fba26f7a3844923e965bd14633a0c29ae9e09f8c5e4ad22476a9d
Instruction Fuzzy Hash: EDE04FB6A2074082EF04DFA2E4507D97320FB8DB80F441039AE5A47355DF3CC299C700

Function 000000013F7A0150 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 000000013F7A0164

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 2323ccc5e59be8ee0254885ef1c083fa11a3be6e46f9bc61acf87414425a04a4
Instruction ID: aa6724aef5ebf6b3c2a317bb3327eba04650daf47351e96bde0958ad40d46cff
Opcode Fuzzy Hash: 2323ccc5e59be8ee0254885ef1c083fa11a3be6e46f9bc61acf87414425a04a4
Instruction Fuzzy Hash: F4E0EC72B14A4081EB608FAAF9847A973B4E75CBD4F1591359A4D87374DA34C9E68B00

Function 000000013F7A25C0 Relevance: 1.5, APIs: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 000000013F7A25DE

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: BitmapCreateFromGdip
String ID:
API String ID: 4184683939-0
Opcode ID: 12bca694415d1f4a30f94878050f35f48547ab6f4853a6a98fe57919ee8146b3
Instruction ID: 97fdf9a23cd25731f10eb1d06b369c5605051b5ed3aaae47a9f01d6e4c7c9a6f
Opcode Fuzzy Hash: 12bca694415d1f4a30f94878050f35f48547ab6f4853a6a98fe57919ee8146b3
Instruction Fuzzy Hash: 54D02220F1010084FF189BB3B895BB822E283EEFC4F285034CD0A8B304CC18C7838380

Function 000000013F7A3BE4 Relevance: 1.5, APIs: 1, Instructions: 12windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32 ref: 000000013F7A3C0E

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 5ef386b3ee7542144411525105acc9ef7d75829a786e0529e5d3ae37d7fd2362
Instruction ID: 5bfd8c77fb1a9ca5f07f49dc96cd9eb86cc92a334470869301d45f14b84c59b3
Opcode Fuzzy Hash: 5ef386b3ee7542144411525105acc9ef7d75829a786e0529e5d3ae37d7fd2362
Instruction Fuzzy Hash: 90D0A770F0020082F710A741A8157ED3320A392B40F41023CD9092E7D5CE3DC3379740

Function 000000013F791184 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000000013F791196

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b379d1919eef6dcf220e50b388016eabcdfdb9be812353f068f69c0090a9467a
Instruction ID: 63d62932fc1ac447500e069099fb1d70ff2972194777c22c57206ce6017efede
Opcode Fuzzy Hash: b379d1919eef6dcf220e50b388016eabcdfdb9be812353f068f69c0090a9467a
Instruction Fuzzy Hash: 10D01233D45440A2ED545775B8513AD3350AB42735FB50754D23B816E1C75986E79321

Function 000000013F7A0968 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 000000013F7A097E

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 710c7b1c1bc91ce3b40f3e9955189a48e107171e98c207c05e24d5f66646d289
Instruction ID: 76d2a669a86bbe1031fcc197f0f64f1926e48633fcdd1fb318fab17495289120
Opcode Fuzzy Hash: 710c7b1c1bc91ce3b40f3e9955189a48e107171e98c207c05e24d5f66646d289
Instruction Fuzzy Hash: 44D012B6E1194486FF158FA1E4853A47370EB6CB05F4D4419C9190D390CB24C5DAC750

Function 000000013F794A40 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 000000013F794A4C

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: a56fe56e028b5553d6bfa0a370792c557ad4760319b0add77b2bc37b80b940d4
Instruction ID: e4860ee377546f9629c52377b1aaef6d734e9687b36004082461971d937742d7
Opcode Fuzzy Hash: a56fe56e028b5553d6bfa0a370792c557ad4760319b0add77b2bc37b80b940d4
Instruction Fuzzy Hash: 34B09224F0210182EA087BA2288B7C822542BA4B00F950028D406C2251DE1C82A61700

Function 000000013F791008 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32 ref: 000000013F791010

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 14c98af5e7350858a0d6e5058a5882b99b4c2eb4990546580bf634d78ef99be5
Instruction ID: 8f9012cbf2e384ee53a90a33c5e8cdcbc55cff81e1614e018fd19eb3f9b725ab
Opcode Fuzzy Hash: 14c98af5e7350858a0d6e5058a5882b99b4c2eb4990546580bf634d78ef99be5
Instruction Fuzzy Hash: E3B09221B12440C2DA046B22DC827082324B794B01F9A4064850E91220CE18C9EB9700

Function 000000013F790910 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000000013F790936

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3b82a6023a20df79a4367766d46024c1a82b0f45e6a7cb7470ce24be78ea5211
Instruction ID: 503afd0c039c2414aca29a6c0d3a2d6d36f8aff2e0f6fde0d28c09d684bbfeee
Opcode Fuzzy Hash: 3b82a6023a20df79a4367766d46024c1a82b0f45e6a7cb7470ce24be78ea5211
Instruction Fuzzy Hash: 8CF0B432A1068089FF348F35E1457AA3B61E305B78F59536CDB38851E9DB20CAD6C300

Non-executed Functions

Function 000000013F7BCFAC Relevance: 25.7, APIs: 9, Strings: 5, Instructions: 1226COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 000000013F7BCFFA
_invalid_parameter_noinfo.LIBCMT ref: 000000013F7BD666
_invalid_parameter_noinfo.LIBCMT ref: 000000013F7BD7DC
_invalid_parameter_noinfo.LIBCMT ref: 000000013F7BDA9A
_invalid_parameter_noinfo.LIBCMT ref: 000000013F7BDCBA
_invalid_parameter_noinfo.LIBCMT ref: 000000013F7BDEF7
memcpy_s.LIBCPMT ref: 000000013F7BDFD2
memcpy_s.LIBCPMT ref: 000000013F7BE07D
memcpy_s.LIBCPMT ref: 000000013F7BE14C

Strings

1#INF, xrefs: 000000013F7BD123
1#QNAN, xrefs: 000000013F7BD113
1#IND, xrefs: 000000013F7BD0E7
1#SNAN, xrefs: 000000013F7BD10A
1ERs, xrefs: 000000013F7BCFC6

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$1ERs
API String ID: 808467561-158295685
Opcode ID: f2a266fa450776d83431f905e69ad70814a7d5f92595957338657dd028b3c8d2
Instruction ID: cccd92bc023565026560a3b297f4e4e5a2d2a77f18b7a816ab9e53e9f80ae0e3
Opcode Fuzzy Hash: f2a266fa450776d83431f905e69ad70814a7d5f92595957338657dd028b3c8d2
Instruction Fuzzy Hash: ABB2BE72E142888BEB648F68D544BED77A1F356788F505139DB0AA7B88D738DF02CB40

Function 000000013F78C4E0 Relevance: 23.2, APIs: 8, Strings: 5, Instructions: 412fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013F78C424: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F78C3F3,?,?,?,000000013F78C2E2), ref: 000000013F78C447
Part of subcall function 000000013F78C424: GetLastError.KERNEL32 ref: 000000013F78C4A8
Part of subcall function 000000013F78C424: CloseHandle.KERNEL32 ref: 000000013F78C4BB

CreateFileW.KERNEL32 ref: 000000013F78C7A3

Part of subcall function 000000013F79160C: GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F7915DD,?,?,?,?,000000013F78BD80), ref: 000000013F791630
Part of subcall function 000000013F79160C: GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F7915DD,?,?,?,?,000000013F78BD80), ref: 000000013F791666

CloseHandle.KERNEL32 ref: 000000013F78C819
CreateFileW.KERNEL32 ref: 000000013F78C9CA

Part of subcall function 000000013F791A2C: RemoveDirectoryW.KERNEL32 ref: 000000013F791A50
Part of subcall function 000000013F791A2C: RemoveDirectoryW.KERNEL32 ref: 000000013F791A88

DeviceIoControl.KERNEL32 ref: 000000013F78CA3B
CloseHandle.KERNEL32 ref: 000000013F78CA48
GetLastError.KERNEL32 ref: 000000013F78CA5D
RemoveDirectoryW.KERNEL32 ref: 000000013F78CAA4
DeleteFileW.KERNEL32 ref: 000000013F78CAAF

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 000000013F78C53D
UNC\, xrefs: 000000013F78C607
\??\, xrefs: 000000013F78C583
SeRestorePrivilege, xrefs: 000000013F78C531
1ERs, xrefs: 000000013F78C4FF

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: File$CloseDirectoryHandleRemove$AttributesCreateErrorLast$ControlCurrentDeleteDeviceProcess
String ID: 1ERs$SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3322710514-697573642
Opcode ID: 00bf185859861c6fa433c379406061ab1097067d98995703e2199257f9c40f31
Instruction ID: b217e2889257c49138b1faed76cb7c41e8d793e313998421e7ee7b8ec0ec231c
Opcode Fuzzy Hash: 00bf185859861c6fa433c379406061ab1097067d98995703e2199257f9c40f31
Instruction Fuzzy Hash: E502B032B0454096FB10EB70D4567DE7BA0FB957A4F41423AEA5D876E6DE28CB4BC700

Function 000000013F7A34D0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 247windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32 ref: 000000013F7A3581
EndDialog.USER32 ref: 000000013F7A359B

Strings

%s %s, xrefs: 000000013F7A375E, 000000013F7A3894
REPLACEFILEDLG, xrefs: 000000013F7A3509
1ERs, xrefs: 000000013F7A34ED

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: DialogItemMessageSend
String ID: %s %s$1ERs$REPLACEFILEDLG
API String ID: 575162118-1688214261
Opcode ID: d1c259cd9f0f8fc9098d6da4718300a2a854cb3ea85eb70d7794af816bcd3f45
Instruction ID: caa4f41197486e14d8a7de2bd1be3f7e244e5dd5c6423d1e29f47d602807663b
Opcode Fuzzy Hash: d1c259cd9f0f8fc9098d6da4718300a2a854cb3ea85eb70d7794af816bcd3f45
Instruction Fuzzy Hash: 3CB12C32A01A8096FF64AF65D8953ED7761F785B84F41413ADA0D4BB9ADE29CB0BC340

Function 000000013F7AFEC8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000000013F7AFF41
RtlLookupFunctionEntry.KERNEL32 ref: 000000013F7AFF59
RtlVirtualUnwind.KERNEL32 ref: 000000013F7AFF94
IsDebuggerPresent.KERNEL32 ref: 000000013F7AFFCD
SetUnhandledExceptionFilter.KERNEL32 ref: 000000013F7AFFD7
UnhandledExceptionFilter.KERNEL32 ref: 000000013F7AFFE2

Strings

1ERs, xrefs: 000000013F7AFEE5

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: 1ERs
API String ID: 1239891234-1577259171
Opcode ID: 6dc7126bae958aafbb62ae645c9ce5dc0c359ef71b5fef61e852479692239a18
Instruction ID: e13bcadfc05ab89997f99d33975bee0683679462fd976c784d1c5e62d296edeb
Opcode Fuzzy Hash: 6dc7126bae958aafbb62ae645c9ce5dc0c359ef71b5fef61e852479692239a18
Instruction Fuzzy Hash: 01317032614F8086EB60CF65E8407DE73B4F789794F55012AEA9D43B99DF38C65ACB00

Function 000000013F7AA170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000000013F7AA18C
RtlCaptureContext.KERNEL32 ref: 000000013F7AA1B9
RtlLookupFunctionEntry.KERNEL32 ref: 000000013F7AA1D3
RtlVirtualUnwind.KERNEL32 ref: 000000013F7AA214
IsDebuggerPresent.KERNEL32 ref: 000000013F7AA268
SetUnhandledExceptionFilter.KERNEL32 ref: 000000013F7AA289
UnhandledExceptionFilter.KERNEL32 ref: 000000013F7AA294

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eea4ae72b02310c68cbfcb40ebcbd3b76fa2b8c2e372b8786a5d16902a8ea07a
Instruction ID: 0c6597c598f18917fc2f662c38d7c9352aaf0e985b4cedfa57e60b2db5b994ae
Opcode Fuzzy Hash: eea4ae72b02310c68cbfcb40ebcbd3b76fa2b8c2e372b8786a5d16902a8ea07a
Instruction Fuzzy Hash: BE313872605B808AFB609FA0E8507EE7374F784748F44442EDA4E57B98EF38C649C710

Function 000000013F7A1CE8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

1ERs, xrefs: 000000013F7A1CFF

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Release$CapsDevice
String ID: 1ERs
API String ID: 4264324914-1577259171
Opcode ID: a8f0bf8731cb7f5468add9e736cf6f914d64d33afddb42cda0f44b8301450785
Instruction ID: 7f6914461cb81a48fef9ff2b40f5a3b09b90035e1f18ac2e3687d4aad3879fce
Opcode Fuzzy Hash: a8f0bf8731cb7f5468add9e736cf6f914d64d33afddb42cda0f44b8301450785
Instruction Fuzzy Hash: D4810A36B14A0486FB20CFAAE440B9D7771F788B99F41412ADE0E97B64DF78C64AC740

Function 000000013F7BCB10 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000000013F7BCB76
memcpy_s.LIBCPMT ref: 000000013F7BCBA1

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: f4205ceffc3342b216eaddc1e284d1c32450f725fb56c2d98b4cfced0672fb09
Instruction ID: 3f24fc0f00766cbb006232785aa0d8fa76c9d6ae2408e8c6face8b67ffe034a0
Opcode Fuzzy Hash: f4205ceffc3342b216eaddc1e284d1c32450f725fb56c2d98b4cfced0672fb09
Instruction Fuzzy Hash: E4C11772B146898BEB34CF19E0487AAB791F395B84F44D139DB4A47784D739EE02CB40

Function 000000013F78BA38 Relevance: 4.5, APIs: 3, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00000000,000000013F78BAD6), ref: 000000013F78BA45
FormatMessageW.KERNEL32 ref: 000000013F78BA7A
LocalFree.KERNEL32 ref: 000000013F78BA96

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: 720e1d665af86155b6d52ddd483690ffce5b947b9306b03357ccbbb50c1fc7e4
Instruction ID: 8b278acb9c1e20109db934172576cdc7129750e20787e70f5a048cb589a014c7
Opcode Fuzzy Hash: 720e1d665af86155b6d52ddd483690ffce5b947b9306b03357ccbbb50c1fc7e4
Instruction Fuzzy Hash: A6F06272A1464083FB108B52F449BAAB7A0F784791F045028DA8646A94DFBCC2568B51

Function 000000013F7B35D4 Relevance: 4.1, Strings: 3, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 000000013F7B3742
1ERs, xrefs: 000000013F7B35F0
, xrefs: 000000013F7B3984

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: $ $1ERs
API String ID: 0-3943490557
Opcode ID: d9b61ac85c199ae343cad72166c8023041029ab95baf6ee6999918e89ee9266a
Instruction ID: bb68e585f35a5977838902ce4391ceaa8dcc87895a46dc3f08807b4bfe200a58
Opcode Fuzzy Hash: d9b61ac85c199ae343cad72166c8023041029ab95baf6ee6999918e89ee9266a
Instruction Fuzzy Hash: CFE1A676A0064886EBA88F2985907AD33A1F74BB88F24523DDB46077D4DB76CED3C740

Function 000000013F7B9B40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

1ERs, xrefs: 000000013F7B9CDE

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs
API String ID: 0-1577259171
Opcode ID: 4da2d9596358c2733e3ade1a129fd8a46b445a55c1436d0a43b11196e90c78d1
Instruction ID: f383e168163374191f0bf79ac004011b628a98bef10ba3dd0152d4809e47397a
Opcode Fuzzy Hash: 4da2d9596358c2733e3ade1a129fd8a46b445a55c1436d0a43b11196e90c78d1
Instruction Fuzzy Hash: 2751D432B0078485FB209B76A8447DE7BB5E746BD4F144129EF6867B99DA38CA02C700

Function 000000013F792D64 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 000000013F792D96

Part of subcall function 000000013F792B00: CoCreateInstance.OLE32 ref: 000000013F792B34

Strings

1ERs, xrefs: 000000013F792D6D

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CreateInstanceVersion
String ID: 1ERs
API String ID: 1462612201-1577259171
Opcode ID: ef4d7b2877b706d9039eb1f5b643314b8e5d64cb964088a55bb453073a6001ec
Instruction ID: cc474a5ab66ad4c5a6361c4b56161bed9f26b713819176c61aff687ffa6c5027
Opcode Fuzzy Hash: ef4d7b2877b706d9039eb1f5b643314b8e5d64cb964088a55bb453073a6001ec
Instruction Fuzzy Hash: 2001A432D4968085FE71AB20B4263EA77A0A779305F44117DD5CC077AAD77C834BCB24

Function 000000013F7A2954 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 000000013F7A2981

Strings

1ERs, xrefs: 000000013F7A295B

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: InfoLocale
String ID: 1ERs
API String ID: 2299586839-1577259171
Opcode ID: 2d32fba226446cf735b3efa7e389aea2716db7426c436d2914a0ba6405b8d279
Instruction ID: 72fa1b6d0da1548f12334d1d4b0e93838f89665cfa64261a95d760345a249a14
Opcode Fuzzy Hash: 2d32fba226446cf735b3efa7e389aea2716db7426c436d2914a0ba6405b8d279
Instruction Fuzzy Hash: 44E04632A1468186FB709B00F412BE973A0F788B44FC00035AACD43B85EF3CC22ACA40

Function 000000013F784778 Relevance: 3.2, Strings: 2, Instructions: 731COMMON

Download Yara Rule

Strings

CMT, xrefs: 000000013F784F8B
1ERs, xrefs: 000000013F78479B

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs$CMT
API String ID: 0-2971618018
Opcode ID: 2a55f9927a61f896333a20387cebc1786a396451154bb660c9bd129a31ab8d5d
Instruction ID: 2af0cf7e9395bd0b940e8361a2d95e71251bcb8a7d5d6509ad4d34ea49172138
Opcode Fuzzy Hash: 2a55f9927a61f896333a20387cebc1786a396451154bb660c9bd129a31ab8d5d
Instruction Fuzzy Hash: D762ED72B0069096EB18DF25D456BED7FA5F791388F40402EEA4A877D2CBB8CA57C700

Function 000000013F7C1518 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000000013F7C1767
RaiseException.KERNEL32 ref: 000000013F7C1778

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 9f2f120d3ecb95be0da68e540d64d61f85f31db099565da766693d65c9a44c61
Instruction ID: 491cf0cecdb9e59b202b14cc6bd967234bb4eb3b1c19971d4b5e8259ad6f7f3b
Opcode Fuzzy Hash: 9f2f120d3ecb95be0da68e540d64d61f85f31db099565da766693d65c9a44c61
Instruction Fuzzy Hash: B9B14077600B888BEB15CF2AC84639C7BE1F344B58F198925DB9D877A5CB79C552C700

Function 000000013F7B7D40 Relevance: 2.6, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

Strings

gfff, xrefs: 000000013F7B7ECA
e+000, xrefs: 000000013F7B7E4D

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: a16caab20146e5fad907b32f0584b0b2d47f79384eaef0e96097227fb797859a
Instruction ID: 49d3806302d200994604456659c0a1fe8cc2b9a853d9f95ba4aed107d51f03a4
Opcode Fuzzy Hash: a16caab20146e5fad907b32f0584b0b2d47f79384eaef0e96097227fb797859a
Instruction Fuzzy Hash: D4514832B146C846E7658E39E8057D9BB91E346B94F488239CBA44BBD5CB3ECA47C700

Function 000000013F7B31D0 Relevance: 1.6, Strings: 1, Instructions: 327COMMONLIBRARYCODE

Download Yara Rule

Strings

1ERs, xrefs: 000000013F7B31EF

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs
API String ID: 0-1577259171
Opcode ID: 3ce01dcdfbdad5a378132bd8dff2501772a90bb84c1e186c249de49aa357e036
Instruction ID: b59c4e2d6c824fa06d0e3dadf820f7035fe784da6cfd162effb701bc347e5c0b
Opcode Fuzzy Hash: 3ce01dcdfbdad5a378132bd8dff2501772a90bb84c1e186c249de49aa357e036
Instruction Fuzzy Hash: DDD1BE36A0464886EBA98F2985547EE37A0EB47B48F24423DCF0A476D5DBB5CEC7C740

Function 000000013F788BE0 Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

1ERs, xrefs: 000000013F788C03

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs
API String ID: 0-1577259171
Opcode ID: f11c3cfc7f864254b051c5df1df81e9b4045b7f6a323e9653ed5c3f6f5cf2c0b
Instruction ID: 840c5766562d4ecd2f305129919755fccea15c8618a5a127bb31fa7fb49cfdbd
Opcode Fuzzy Hash: f11c3cfc7f864254b051c5df1df81e9b4045b7f6a323e9653ed5c3f6f5cf2c0b
Instruction Fuzzy Hash: 1FD178B7B242908FE360CFBAD400B9D3BB1F39878CB519125DE59A7B09D639D646CB40

Function 000000013F7B78AC Relevance: 1.5, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

Strings

gfffffff, xrefs: 000000013F7B7BEE

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 94604325bb74c132b3677955763b418003b5be94bd3e1b621f9fe3a9a961bc1b
Instruction ID: 55d0a3979a4a84111af55521e5c5d600ef613f73e75ffbf1f4c7ea7f1f64bd16
Opcode Fuzzy Hash: 94604325bb74c132b3677955763b418003b5be94bd3e1b621f9fe3a9a961bc1b
Instruction Fuzzy Hash: D5A13573A047C886EB21CF29A450BEA7BA5E752B84F05913ADF8947785DA3DCA07C701

Function 000000013F78A1EC Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

1ERs, xrefs: 000000013F78A20B

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs
API String ID: 0-1577259171
Opcode ID: b0f706961199820fe2e345934f27a80a7d546ce3fac6a5e6cdcb32fc393c353f
Instruction ID: 7154413311e415b55ffc193059ff695e7ba4e52b1ee62e5cc9c012ee0baa3b23
Opcode Fuzzy Hash: b0f706961199820fe2e345934f27a80a7d546ce3fac6a5e6cdcb32fc393c353f
Instruction Fuzzy Hash: 8A91E262B14684A6FB11DF68D4923EE7B20FB55788F401129EF4A07B9AEB35C70BC300

Function 000000013F79F04C Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

1ERs, xrefs: 000000013F79F066

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs
API String ID: 0-1577259171
Opcode ID: cffaa5060630d9a76fe80a654a48307057e2165b29533d0ec43de94ed3f83d25
Instruction ID: 889caef3a4226464be5a24c910fd23dcf788d92483eed715378a68e40670f218
Opcode Fuzzy Hash: cffaa5060630d9a76fe80a654a48307057e2165b29533d0ec43de94ed3f83d25
Instruction Fuzzy Hash: FC713076F1828086FB209B68E581BEF7B90A311388F10013DCE8557AC7DB29C747CB51

Function 000000013F797FC8 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

1ERs, xrefs: 000000013F797FE1

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs
API String ID: 0-1577259171
Opcode ID: 08f87da3c21ac6c3b6ad54b5c00a067e824c395104bfcccc05a58fdc758abbda
Instruction ID: 03044181cb3147ed3798b1a32f6bda2be92b3b4ffbf073c341d6d6c2a4853bef
Opcode Fuzzy Hash: 08f87da3c21ac6c3b6ad54b5c00a067e824c395104bfcccc05a58fdc758abbda
Instruction Fuzzy Hash: CB611333B101D059EB01CF759A107EE7FB1E35A784F86802ACF9A67646D639C607CB10

Function 000000013F7994DC Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

1ERs, xrefs: 000000013F799500

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs
API String ID: 0-1577259171
Opcode ID: f9f3cd2992c65023a5ea7fc19f0cefddf71d6570bb4a6a01ba758df2379e2081
Instruction ID: 62c4717cddb89695883581e401d6a5b3e7cd5fe040c14e52bd19a6c3332df5d4
Opcode Fuzzy Hash: f9f3cd2992c65023a5ea7fc19f0cefddf71d6570bb4a6a01ba758df2379e2081
Instruction Fuzzy Hash: BB51A137B286908BD764CF25E400B9E73A5F388798F445119EF4A93B49DB39DA46CF40

Function 000000013F79F9B0 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

1ERs, xrefs: 000000013F79F9C2

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: 1ERs
API String ID: 0-1577259171
Opcode ID: ac3787fb25f440b6ddd73408786dce7f8a35c1cd44ab3c231a3be5c96b6a0843
Instruction ID: ba2314133f8cfaf97c0e494efcf71eb28a5903e770541b2494290151b9126e4f
Opcode Fuzzy Hash: ac3787fb25f440b6ddd73408786dce7f8a35c1cd44ab3c231a3be5c96b6a0843
Instruction Fuzzy Hash: D3511473B241904BE728CF38E518BEE7762F384B58F594129DB4547B89DA39CA47CB00

Function 000000013F7B65C0 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

1ERs, xrefs: 000000013F7B65EC, 000000013F7B668A, 000000013F7B66BF, 000000013F7B66EE, 000000013F7B6710, 000000013F7B672E

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID: 1ERs
API String ID: 485612231-1577259171
Opcode ID: 321a00be8216ab1d5a6abf96824688860184d35458da0e7affeca5d9c463e6b8
Instruction ID: 6f70928166ba0dd7b762df74ef2ac286b0c870392becfb03cfb84bc0c91e615f
Opcode Fuzzy Hash: 321a00be8216ab1d5a6abf96824688860184d35458da0e7affeca5d9c463e6b8
Instruction Fuzzy Hash: E641B072710A5882EF04CF6ADA647D973A1A348FD4F49903AEF0D87B98DA38C6478300

Function 000000013F7BB630 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000000013F7BB634

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f19df3457cabf08339b26dd724f0c9893481a6ac0a987c3003da21f85d52f0fa
Instruction ID: 87d16edac67c2d1529ed13d23482f11ad27c90cb1d869011b86275b464e66dbc
Opcode Fuzzy Hash: f19df3457cabf08339b26dd724f0c9893481a6ac0a987c3003da21f85d52f0fa
Instruction Fuzzy Hash: EEB09231E03B00C6EA082B116D8278433A86B88B10F99002CC40D50320DA3C12E75700

Function 000000013F787754 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ac0fc35d8cf77e6e1bd8c6a8413b265182a4939a0404e7029cdd914341865a
Instruction ID: b64294e5bf1d8fb0303d43b4e8b759d2db487e7e2487555da90efefd163183c9
Opcode Fuzzy Hash: 99ac0fc35d8cf77e6e1bd8c6a8413b265182a4939a0404e7029cdd914341865a
Instruction Fuzzy Hash: 5E627F9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 000000013F798978 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb2ce0b07b00d60622ba1d133584415865426598a4840553b895c569aa2730a
Instruction ID: 50d2e027d55e32997c4958ad1b959eb0e560bc07ce97cfccf6010b3932421e2c
Opcode Fuzzy Hash: 2eb2ce0b07b00d60622ba1d133584415865426598a4840553b895c569aa2730a
Instruction Fuzzy Hash: 4C22C2B3B206508BD728CF25D89AE5E3766F398744B4B9228DF06CB785DB39D605CB40

Function 000000013F7B2840 Relevance: .2, Instructions: 241COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2150a2774044c36f79e81eacf1206554ea999062c49d9c81a4d9e38c8f448f
Instruction ID: ebfd1141ddad0a9723216a3bc28f925ffc390a786612659a5dbbd948ba07d8cf
Opcode Fuzzy Hash: 7d2150a2774044c36f79e81eacf1206554ea999062c49d9c81a4d9e38c8f448f
Instruction Fuzzy Hash: 34B16072A16B8885E7668F39C0543AD3BA0F34AF48F28412DCF4A57395DB35CE42D785

Function 000000013F7B83C0 Relevance: .2, Instructions: 198COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa021549f167e7e5cc87e9c9d49059b1c09a6111a41a30a90789b7ea67b7d5a
Instruction ID: eb8784f4388b66f861150d700477e605dceb8d4e600b01c5a6326271550ad921
Opcode Fuzzy Hash: 2fa021549f167e7e5cc87e9c9d49059b1c09a6111a41a30a90789b7ea67b7d5a
Instruction Fuzzy Hash: FC81D572A0878886EB74CF19A5403DA7A91F7467D4F14423DDB9D47B99DB3DCA038B00

Function 000000013F7B1D94 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: fa039be8d57848366d06c57e0227fa79fda609714e8ad74bd268d1a178fd3a05
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 1451B436A1165886E7648F29D0443A833A0E74AF69F344139DF4A577E8C7B2DE53C780

Function 000000013F7B1984 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 77cf9f0de298969a42c466be007e21103d70c0e418a929e84fe1ea27df60e7f0
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 1F51C577A14A9886E7248F29C05479933A0E346F6CF24512ACF4A577E4D7B2DE53C780

Function 000000013F7B1574 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: e6aafc98156632943afff5d616b6f1cee2bff798814df841810e9e355b0fa5ba
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 7851B576A14A5886E7248F29C0443A833A1F74AF6CF284129CF8B577E5CB76CE53C780

Function 000000013F7B1B90 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: f9583e87f54210bb96865099cba92c571542303c68ab099c779296702151e61d
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: A651A136B10A5886E7258F29C0483AD37A1E78AF58F345139CF4A577A8D7B6DE43C780

Function 000000013F7B1780 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: ccdb717c8521f830f06b63e259101ebe682989a4837ce3d62925372ccb1cc5c7
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 79517176B1069886E7248B29C0443A937A1E34AF68F354139CF4A577A9CB76DE53C780

Function 000000013F7B1370 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 9b2d10d48be0873763c0065f9813524cd2898dc74f1e31796208b10a85fda959
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: E151C337B1465886E7248B29C0443AC37A1E74AF58F244139DF4A57BA8D7B6CE53C780

Function 000000013F79EEF0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cdc14705774243d19fb94633146f393bab702cd26d035aadc90ecda4019bf39
Instruction ID: ce13f227c696adba32acd8810e50146be7bae61fc65428c47def31c9a4d15987
Opcode Fuzzy Hash: 8cdc14705774243d19fb94633146f393bab702cd26d035aadc90ecda4019bf39
Instruction Fuzzy Hash: 553128B2A146404BE748EA2AE9917EF7BD1F344784F14803DDF8287B42DA38C547C710

Function 000000013F79AEE4 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5852029dbc0ce463896b4f8196b6243869ef963d9e7f9ccb60a74bfb739e6291
Instruction ID: c85602b24b24537de4ac119f3aa1164e0d9ae2c34461d9f6bcdcf2365d2da63d
Opcode Fuzzy Hash: 5852029dbc0ce463896b4f8196b6243869ef963d9e7f9ccb60a74bfb739e6291
Instruction Fuzzy Hash: 93F0C9F5F2B00546FF68102D981DBBB32D7E365314F6489BEE417DA2C2E459CB935209

Function 000000013F7AA354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26cc2c670222ae876159ff5603c0af37539fb50017e4d91ac7b3a384edc0ce7
Instruction ID: 08ad91b6a9114c602572644c9ad70f29b3649fc4c703b792f05c1c709c5c29fe
Opcode Fuzzy Hash: b26cc2c670222ae876159ff5603c0af37539fb50017e4d91ac7b3a384edc0ce7
Instruction Fuzzy Hash: 9EA00232944C40D8FE84CF90F8507E03330F392300F91003DF00A511A09B3C8607C700

Function 000000013F7A99C0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000000013F7A99D6
GetModuleHandleW.KERNEL32 ref: 000000013F7A99E3
GetModuleHandleW.KERNEL32 ref: 000000013F7A99F8
GetProcAddress.KERNEL32 ref: 000000013F7A9A10
GetProcAddress.KERNEL32 ref: 000000013F7A9A23
CreateEventW.KERNEL32 ref: 000000013F7A9A4F
DeleteCriticalSection.KERNEL32 ref: 000000013F7A9A9B
CloseHandle.KERNEL32 ref: 000000013F7A9AAD

Strings

<pi-ms-win-core-synch-l1-2-0.dll, xrefs: 000000013F7A99DC
SleepConditionVariableCS, xrefs: 000000013F7A9A06
WakeAllConditionVariable, xrefs: 000000013F7A9A16
kernel32.dll, xrefs: 000000013F7A99F1

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: <pi-ms-win-core-synch-l1-2-0.dll$SleepConditionVariableCS$WakeAllConditionVariable$kernel32.dll
API String ID: 2565136772-369236946
Opcode ID: e0361d743c454d09e960a600f16381c646ca90098b4fa54283586941770b61f3
Instruction ID: 44f8f6b691104c63cff26f31c2b14b0c58ed23ad0f6f3865f489b016875955b7
Opcode Fuzzy Hash: e0361d743c454d09e960a600f16381c646ca90098b4fa54283586941770b61f3
Instruction Fuzzy Hash: F2213D31E12A0192FE559F61FD54BE433B1AB94B50F8A403E994F067A5EE38C76BC300

Function 000000013F7A5950 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 000000013F7A595F

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: LICENSEDLG
API String ID: 0-2177901306
Opcode ID: 0c808f6cd05cc0a747108c0f82ff5e28cc2279d91e0e18d1e2e229003918714d
Instruction ID: 60912831a885cc95c0ff3f32e2a5cd38ce2e8bba06fb0b5b4d96fe1df98f370c
Opcode Fuzzy Hash: 0c808f6cd05cc0a747108c0f82ff5e28cc2279d91e0e18d1e2e229003918714d
Instruction Fuzzy Hash: FE316B31B0465082FE549BA2A850BE937A1AB99FD0F45403DAD4E0BBA5DF39CB4B8700

Function 000000013F7A2BCC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 000000013F7A2C0B
GetClassNameW.USER32 ref: 000000013F7A2C38
GetWindowLongPtrW.USER32 ref: 000000013F7A2C59
SendMessageW.USER32 ref: 000000013F7A2C73
SendMessageW.USER32 ref: 000000013F7A2CC3
DeleteObject.GDI32 ref: 000000013F7A2CCC
GetWindow.USER32 ref: 000000013F7A2CDA

Strings

STATIC, xrefs: 000000013F7A2C3E
1ERs, xrefs: 000000013F7A2BE1

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Window$MessageSend$ClassDeleteLongNameObject
String ID: 1ERs$STATIC
API String ID: 25648435-2122532312
Opcode ID: 61700d33a8561694a78568dba75358c344a7c7a9c021a197164aa6a8e619da87
Instruction ID: 4cf70e22cdfa1c3dcbff0765e22cac03796fdf4fa2ba35844145171624045760
Opcode Fuzzy Hash: 61700d33a8561694a78568dba75358c344a7c7a9c021a197164aa6a8e619da87
Instruction Fuzzy Hash: 7431BF32B05B8086FF64DB52A9547EA33A1B789BC0F450039DD4E07B95DE39CA5B8B00

Function 000000013F7B0BF8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013F7B0C38
_invalid_parameter_noinfo.LIBCMT ref: 000000013F7B1000
_invalid_parameter_noinfo.LIBCMT ref: 000000013F7B129F

Strings

f, xrefs: 000000013F7B0CD0
f, xrefs: 000000013F7B0D3A
p, xrefs: 000000013F7B0D42
f, xrefs: 000000013F7B0E85
p, xrefs: 000000013F7B0CDD

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 3e37737b2b1630447d2a3105bac6e122366a1c5d0912d830ab69edb90e93f5d3
Instruction ID: dde1ee77caef5e60e32d2344892d74c7463889321d27e5943923a44f17aeb375
Opcode Fuzzy Hash: 3e37737b2b1630447d2a3105bac6e122366a1c5d0912d830ab69edb90e93f5d3
Instruction Fuzzy Hash: 1012A772F0828A86FB649A14E0547EE77A1F382750FD8413DE79347AD4D7B8CE828B50

Function 000000013F7AD17C Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000000013F7AD1D9

Part of subcall function 000000013F7AF474: __GetUnwindTryBlock.LIBCMT ref: 000000013F7AF4B7
Part of subcall function 000000013F7AF474: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000000013F7AF4DC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000000013F7AD2B1
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000000013F7AD506
std::bad_alloc::bad_alloc.LIBCMT ref: 000000013F7AD612

Strings

csm, xrefs: 000000013F7AD1F3
csm, xrefs: 000000013F7AD2D4
csm, xrefs: 000000013F7AD25A
1ERs, xrefs: 000000013F7AD195

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: 1ERs$csm$csm$csm
API String ID: 849930591-3428941641
Opcode ID: 60ccb990520f364bd5ff3320d79b5af825f669780890ab8edf7d24260d78d952
Instruction ID: 915b63c284b02f9b95552341da7d5c1b99289ac8ea0352c0da5e7cac9bd383bb
Opcode Fuzzy Hash: 60ccb990520f364bd5ff3320d79b5af825f669780890ab8edf7d24260d78d952
Instruction Fuzzy Hash: ECE1A372E04B408AFF60DFA9D4843DD77A0F749798F110129EE8957B9ADB34D69AC700

Function 000000013F7900DC Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 247fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 000000013F790123
GetLongPathNameW.KERNEL32 ref: 000000013F790163
GetShortPathNameW.KERNEL32 ref: 000000013F790196
GetShortPathNameW.KERNEL32 ref: 000000013F7901D6
MoveFileW.KERNEL32 ref: 000000013F790398
MoveFileW.KERNEL32 ref: 000000013F7903EF

Strings

rtmp, xrefs: 000000013F7902DB
1ERs, xrefs: 000000013F7900F9

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: NamePath$FileLongMoveShort
String ID: 1ERs$rtmp
API String ID: 3741477874-2702954190
Opcode ID: 079ba69fcc673c0077970e8d3d88ee44f4b9ea605e4e1b7a23ab3fccf93bec08
Instruction ID: e6d13a0f1aa4f1a0dc342cb4156cd09e340d49e16c6fbf3cb01c3c76270b1108
Opcode Fuzzy Hash: 079ba69fcc673c0077970e8d3d88ee44f4b9ea605e4e1b7a23ab3fccf93bec08
Instruction Fuzzy Hash: C6A12F32B1154065FA50EB71D8523EE7B60ABD1784F81503AE94EC7AFAEE64CB4BC740

Function 000000013F7A213C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32 ref: 000000013F7A217C
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 000000013F7A218E
SystemTimeToFileTime.KERNEL32 ref: 000000013F7A219E
FileTimeToSystemTime.KERNEL32 ref: 000000013F7A21AE
GetDateFormatW.KERNEL32 ref: 000000013F7A21D4
GetTimeFormatW.KERNEL32 ref: 000000013F7A2204

Strings

2, xrefs: 000000013F7A21E2
1ERs, xrefs: 000000013F7A2156

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific
String ID: 1ERs$2
API String ID: 909090443-3766158228
Opcode ID: 4b14c85589888b76fbd4abfff1d50f03c115230c74de0e2e2410d8fb73203b99
Instruction ID: f4739d7e958ef89b11223dc30419ce3b929b1b0b82d979e8c0413b1b4c60025d
Opcode Fuzzy Hash: 4b14c85589888b76fbd4abfff1d50f03c115230c74de0e2e2410d8fb73203b99
Instruction Fuzzy Hash: AF315032604A8196EB10DF61F8517DA73B1F788788F81512AEA8D47B58DF38C60ACB00

Function 000000013F7B72E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000013F7B72EF
FlsGetValue.KERNEL32 ref: 000000013F7B7304
FlsSetValue.KERNEL32 ref: 000000013F7B7325
FlsSetValue.KERNEL32 ref: 000000013F7B7352
FlsSetValue.KERNEL32 ref: 000000013F7B7363
FlsSetValue.KERNEL32 ref: 000000013F7B7374
SetLastError.KERNEL32 ref: 000000013F7B738F

Strings

1ERs, xrefs: 000000013F7B72EA

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Value$ErrorLast
String ID: 1ERs
API String ID: 2506987500-1577259171
Opcode ID: 33f8256a778b83c36d7b81987b11f071b38dbe2f901bfaba2eaf53f1a568370b
Instruction ID: c37a92eaca752d81356a4a48e18570ad59acc482ca0572c138937fa563a1bcd5
Opcode Fuzzy Hash: 33f8256a778b83c36d7b81987b11f071b38dbe2f901bfaba2eaf53f1a568370b
Instruction Fuzzy Hash: 9C21A231F0428846FA68677596463ED72929B4A7F0F54073DAF3687BC6DE28CE434300

Function 000000013F7A8FC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000000013F7A9047
MultiByteToWideChar.KERNEL32 ref: 000000013F7A90C9
SysAllocString.OLEAUT32 ref: 000000013F7A90D6

Strings

SELECT * FROM Win32_OperatingSystem, xrefs: 000000013F7A8FC6
1ERs, xrefs: 000000013F7A8FDA

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID: 1ERs$SELECT * FROM Win32_OperatingSystem
API String ID: 262959230-3080580435
Opcode ID: 89c07923fc20cd276b35abe59e078f2180a7127b2a66092dd87468531a82c199
Instruction ID: cff295f8c16549a7f06abdc18ad59a1220dde8e0637c53387b2bbf6970ef633f
Opcode Fuzzy Hash: 89c07923fc20cd276b35abe59e078f2180a7127b2a66092dd87468531a82c199
Instruction Fuzzy Hash: 8D41B232A0074589FF149FB5E9443E972A1E744BE4F15463CAA6E877D9DF38C6678300

Function 000000013F79B444 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110timeCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013F792A74: GetVersionExW.KERNEL32 ref: 000000013F792AA5

FileTimeToLocalFileTime.KERNEL32 ref: 000000013F79B487
FileTimeToSystemTime.KERNEL32 ref: 000000013F79B493
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 000000013F79B4A3
SystemTimeToFileTime.KERNEL32 ref: 000000013F79B4B1
SystemTimeToFileTime.KERNEL32 ref: 000000013F79B4BF
FileTimeToSystemTime.KERNEL32 ref: 000000013F79B500

Strings

1ERs, xrefs: 000000013F79B456

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID: 1ERs
API String ID: 2092733347-1577259171
Opcode ID: 785aab82d1612a79ecf9afd1edb4d9ea8d5d9007b697cc82a07f5d23ef14f703
Instruction ID: 64ebd7cb458d2e22e0be1e77f2a6d6f6f893a03c02b47cee9a69b0e62fc96555
Opcode Fuzzy Hash: 785aab82d1612a79ecf9afd1edb4d9ea8d5d9007b697cc82a07f5d23ef14f703
Instruction Fuzzy Hash: D7412972F106508AEB54CFB9D8457ED37B1F708B88F50402ADE1A57B58EB38CA56CB40

Function 000000013F79B5DC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 000000013F79B640

Part of subcall function 000000013F792A74: GetVersionExW.KERNEL32 ref: 000000013F792AA5

LocalFileTimeToFileTime.KERNEL32 ref: 000000013F79B662
FileTimeToSystemTime.KERNEL32 ref: 000000013F79B66E
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 000000013F79B67E
SystemTimeToFileTime.KERNEL32 ref: 000000013F79B68C
SystemTimeToFileTime.KERNEL32 ref: 000000013F79B69A

Strings

1ERs, xrefs: 000000013F79B5EB

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID: 1ERs
API String ID: 2092733347-1577259171
Opcode ID: 956c3446ac1bfcf25464c98837fee348a5ffcf07c062ffee1da10e396255a6cd
Instruction ID: 040f8fa1041d64e0a5ca135665219f743883f0cdc5f89b57b8b63a270d4d1dd3
Opcode Fuzzy Hash: 956c3446ac1bfcf25464c98837fee348a5ffcf07c062ffee1da10e396255a6cd
Instruction Fuzzy Hash: 71313B73F106508AFB14CFB5E8813ED3771FB08758F54502AEE1A97A58EA38CA96C350

Function 000000013F7AD654 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 316COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000000013F7AD7F2
std::bad_alloc::bad_alloc.LIBCMT ref: 000000013F7ADB15

Strings

csm, xrefs: 000000013F7AD739
csm, xrefs: 000000013F7AD819
csm, xrefs: 000000013F7AD79B
1ERs, xrefs: 000000013F7AD670

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: 1ERs$csm$csm$csm
API String ID: 3523768491-3428941641
Opcode ID: e98d9cd26de64f13b8959c209465968c05dba0e954234f4c35712d9457a1f7f8
Instruction ID: e101659e8f3cd7bd087aecc71a471ea415a09598e6430eca9415fb6fe16d07e4
Opcode Fuzzy Hash: e98d9cd26de64f13b8959c209465968c05dba0e954234f4c35712d9457a1f7f8
Instruction Fuzzy Hash: ECE19E73A04B808AFB20DFA9D4843ED7BB1F745758F16412AEE8957796DB34C68AC700

Function 000000013F7BB7D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013F7BB8B4

Strings

1ERs, xrefs: 000000013F7BB8DB
1ERs, xrefs: 000000013F7BB8E4
1ERs, xrefs: 000000013F7BB8C9
1ERs, xrefs: 000000013F7BB8D2
1ERs, xrefs: 000000013F7BB905, 000000013F7BB9A0

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 1ERs$1ERs$1ERs$1ERs$1ERs
API String ID: 3215553584-3967319807
Opcode ID: 0c21b3e6a92f08f13745e3e526015717081f69c98e2bb41ab6e567fe70251a95
Instruction ID: cdef48155ed1c2c2781c51eb0ee1046f5bf20b962f1c4f54345b29dee462244b
Opcode Fuzzy Hash: 0c21b3e6a92f08f13745e3e526015717081f69c98e2bb41ab6e567fe70251a95
Instruction Fuzzy Hash: E6619F32E0064882FA699B6D95883EE7AA0F787780F55453DDF4A177A4DA38CF53C780

Function 000000013F792B00 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 155comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 000000013F792B34

Part of subcall function 000000013F792E24: SysFreeString.OLEAUT32 ref: 000000013F792E81

VariantClear.OLEAUT32 ref: 000000013F792CE3

Strings

SELECT * FROM Win32_OperatingSystem, xrefs: 000000013F792BF0
ROOT\CIMV2, xrefs: 000000013F792B51
WQL, xrefs: 000000013F792C0C
Name, xrefs: 000000013F792CBE

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ClearCreateFreeInstanceStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL
API String ID: 395591258-566834514
Opcode ID: 36a982d5529d683292142ef0ef30e8f896cec8efdc1ecc99ac1944d8507f6ab1
Instruction ID: eb11f1f4849d1fc08cf09adaecfc7963189ad2f23595e8b3a5f05411273a4bcd
Opcode Fuzzy Hash: 36a982d5529d683292142ef0ef30e8f896cec8efdc1ecc99ac1944d8507f6ab1
Instruction Fuzzy Hash: 74710836611B4496EB20EF65E8907DD73A4F788B98F41512AEE4E47BA8DF38C646C700

Function 000000013F7C13CC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000000013F7C13FD
GetLastError.KERNEL32 ref: 000000013F7C1409
CloseHandle.KERNEL32 ref: 000000013F7C1421
CreateFileW.KERNEL32 ref: 000000013F7C144C
WriteConsoleW.KERNEL32 ref: 000000013F7C146B

Strings

CONOUT$, xrefs: 000000013F7C142D

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 99401a05b28a9207d8dd0d05491b38b25e137ad6b948d1adcf7db3e2e0ec208d
Instruction ID: 5dcab98fd61c49194692b3cebbd702dc564f185f02cc22ee0e81a87113626ccb
Opcode Fuzzy Hash: 99401a05b28a9207d8dd0d05491b38b25e137ad6b948d1adcf7db3e2e0ec208d
Instruction Fuzzy Hash: B4116D32B10B4086EB508B56F84479A76A0F798FE4F444238EA5E87BA4DF78CA468744

Function 000000013F7A8800 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,000000013F7A876F,?,?,?,000000013F7A8B2A), ref: 000000013F7A8827
GetProcAddress.KERNEL32(?,?,?,000000013F7A876F,?,?,?,000000013F7A8B2A), ref: 000000013F7A8844
GetProcAddress.KERNEL32(?,?,?,000000013F7A876F,?,?,?,000000013F7A8B2A), ref: 000000013F7A8860

Strings

ReleaseSRWLockExclusive, xrefs: 000000013F7A884F
AcquireSRWLockExclusive, xrefs: 000000013F7A883A
KERNEL32.DLL, xrefs: 000000013F7A8820

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 7c169681784771b86197f8841d22ea9abd0677e23566ea11e573b1539fb58786
Instruction ID: a4deb2c2acec510e080018a32f9e4c13d89e50d0e973f2117640e6296d40c146
Opcode Fuzzy Hash: 7c169681784771b86197f8841d22ea9abd0677e23566ea11e573b1539fb58786
Instruction Fuzzy Hash: C7115E31E26B0095FE658F91FB403E473A1AB08B80F4A547D994E073A4EE3CD7AB8300

Function 000000013F7B7458 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00003F0073524531,000000013F7B7721,?,?,?,?,000000013F7B8FBA,?,?,00000000,000000013F7BB137,?,?,?), ref: 000000013F7B7467
FlsSetValue.KERNEL32(?,?,00003F0073524531,000000013F7B7721,?,?,?,?,000000013F7B8FBA,?,?,00000000,000000013F7BB137,?,?,?), ref: 000000013F7B749D
FlsSetValue.KERNEL32(?,?,00003F0073524531,000000013F7B7721,?,?,?,?,000000013F7B8FBA,?,?,00000000,000000013F7BB137,?,?,?), ref: 000000013F7B74CA
FlsSetValue.KERNEL32(?,?,00003F0073524531,000000013F7B7721,?,?,?,?,000000013F7B8FBA,?,?,00000000,000000013F7BB137,?,?,?), ref: 000000013F7B74DB
FlsSetValue.KERNEL32(?,?,00003F0073524531,000000013F7B7721,?,?,?,?,000000013F7B8FBA,?,?,00000000,000000013F7BB137,?,?,?), ref: 000000013F7B74EC
SetLastError.KERNEL32(?,?,00003F0073524531,000000013F7B7721,?,?,?,?,000000013F7B8FBA,?,?,00000000,000000013F7BB137,?,?,?), ref: 000000013F7B7507

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ba828b49eb28cf8f14636659f097d3729cc1d46c627f16ccd11c1666027e59fe
Instruction ID: c4aa60c39f7a61e12b87d68175aa539a297d34311c05a959db0662e87e25f6a8
Opcode Fuzzy Hash: ba828b49eb28cf8f14636659f097d3729cc1d46c627f16ccd11c1666027e59fe
Instruction Fuzzy Hash: D2117C31A0424842FA54AB3596857ED32929B8A7B0F54073DEF36877C6EE28CE438300

Function 000000013F7BEF38 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000000013F7BEFB7
WriteFile.KERNEL32 ref: 000000013F7BF27F
WriteFile.KERNEL32 ref: 000000013F7BF2C5
GetLastError.KERNEL32 ref: 000000013F7BF37B

Strings

1ERs, xrefs: 000000013F7BEF5D

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: 1ERs
API String ID: 2718003287-1577259171
Opcode ID: a8e3eefb6b4a7bb60a8dfef776a41c730d8024edca4d5e0d56e7037e71f64804
Instruction ID: 18b4430fe72b599cadec59daade8a929512a60aaf263dc6b8917c94be1699704
Opcode Fuzzy Hash: a8e3eefb6b4a7bb60a8dfef776a41c730d8024edca4d5e0d56e7037e71f64804
Instruction Fuzzy Hash: 9AD1B032B14A8889E711CFE9D4403DC37B1F345B98F54822ADF5AABB99DA34CA57C340

Function 000000013F7ADD6C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000000013F7ADDDC
_CallSETranslator.LIBVCRUNTIME ref: 000000013F7ADE27

Strings

RCC, xrefs: 000000013F7ADDF8
MOC, xrefs: 000000013F7ADDF0
1ERs, xrefs: 000000013F7ADD85

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: 1ERs$MOC$RCC
API String ID: 3544855599-2904164723
Opcode ID: 47af0c85fdb25179673fa66b102b971ee9e42a9de974d5d47ddfa20c25a00b67
Instruction ID: 970c062242f22b9485acd4e54e2f1a562bb9a91bb0aa818eee839f8074dfd2df
Opcode Fuzzy Hash: 47af0c85fdb25179673fa66b102b971ee9e42a9de974d5d47ddfa20c25a00b67
Instruction Fuzzy Hash: A3917E73A14B908AFB50DFA5D8843DD7BA0F344788F15412AEF8957B55DB38C2AACB00

Function 000000013F7AC478 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000013F7AC4A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000000013F7AC538
RtlUnwindEx.KERNEL32 ref: 000000013F7AC587

Strings

csm, xrefs: 000000013F7AC51E
f, xrefs: 000000013F7AC4B6

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a6761e8e7c818eeef342585bf932cfb9eaa669016519b3295bdcd8878ab48e67
Instruction ID: 121597e3c9cd813a309c11fbb718696624338e1ebd38e817f8e22b9f7dc7bebf
Opcode Fuzzy Hash: a6761e8e7c818eeef342585bf932cfb9eaa669016519b3295bdcd8878ab48e67
Instruction Fuzzy Hash: 3051DE32B11600AAFF15CF5DE504B9937A6F384BC8F269138EE1647788EB34CA4AC700

Function 000000013F7913D8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000000013F7914A8
CreateFileW.KERNEL32 ref: 000000013F791506
SetFileTime.KERNEL32 ref: 000000013F79158F
CloseHandle.KERNEL32 ref: 000000013F79159A

Strings

1ERs, xrefs: 000000013F7913EC

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID: 1ERs
API String ID: 2287278272-1577259171
Opcode ID: 84e8bc31e468431bf3ce36ec2598d1eaa81598ad8955d9683e74096c8d90d524
Instruction ID: b16ba56597efd2383a2298e313dd94d3555842ba9e84ef08c21b1dd382d59560
Opcode Fuzzy Hash: 84e8bc31e468431bf3ce36ec2598d1eaa81598ad8955d9683e74096c8d90d524
Instruction Fuzzy Hash: CC51E632B4064045FE60DB21F5117EB77A0AB867E4F454239ED6A0B7EADE78C65BC700

Function 000000013F793F2C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 000000013F793F78
GetFullPathNameW.KERNEL32 ref: 000000013F793FB4

Strings

1ERs, xrefs: 000000013F793F3E

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: FullNamePath
String ID: 1ERs
API String ID: 608056474-1577259171
Opcode ID: bc269fee4e50a1ee74e2711acd90c84bb1ed9af7c8df65560ead03289f62de64
Instruction ID: 4396a549a7195f049a4f7705827e9a21f1ec5a442eef338abc149b29a0fc840b
Opcode Fuzzy Hash: bc269fee4e50a1ee74e2711acd90c84bb1ed9af7c8df65560ead03289f62de64
Instruction Fuzzy Hash: 5A414C31F1060094FB50EBB1D866BEE3BA1AB95784F54403EDD0E97A9AEE64CB07C301

Function 000000013F7A33EC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 000000013F7A3444, 000000013F7A34A4
RENAMEDLG, xrefs: 000000013F7A3470

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 7d2f55ecc67719a671fa2d38e6172bed85f8f4a9c20d5812f76a5836ffd50a38
Instruction ID: 35d09adf08cb2f4cd2ddb27790817d9e7688ef115a4779d24607dc01154ee87e
Opcode Fuzzy Hash: 7d2f55ecc67719a671fa2d38e6172bed85f8f4a9c20d5812f76a5836ffd50a38
Instruction Fuzzy Hash: 2921D035A04B8591FE918FA5F8843E877A0B349B88F81443EE94D873A1DA3EC75B8300

Function 000000013F7A4688 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000013F7A43C4), ref: 000000013F7A46AF
SetEnvironmentVariableW.KERNEL32 ref: 000000013F7A470C

Strings

sfxpar, xrefs: 000000013F7A4705
sfxcmd, xrefs: 000000013F7A46A8
1ERs, xrefs: 000000013F7A468E

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: EnvironmentVariable
String ID: 1ERs$sfxcmd$sfxpar
API String ID: 1431749950-18409952
Opcode ID: ff593fcf8732caf793ca9fa8692b2aaa7cde79f1b0adea124ae6a48ad6d30b5c
Instruction ID: b6aacfd4d0310627323e8dff6b0db84d9d1badd490b96f2c81255b1b029d4d61
Opcode Fuzzy Hash: ff593fcf8732caf793ca9fa8692b2aaa7cde79f1b0adea124ae6a48ad6d30b5c
Instruction Fuzzy Hash: 63118072A0464481FE20AF10E8523EA77B0FB8A784F851139E98E473A6DE2DC35BC700

Function 000000013F7B5E5C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000000013F7B5E81
GetProcAddress.KERNEL32 ref: 000000013F7B5E97
FreeLibrary.KERNEL32 ref: 000000013F7B5EBE

Strings

mscoree.dll, xrefs: 000000013F7B5E78
CorExitProcess, xrefs: 000000013F7B5E90

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3a6960139d1195420c441f0a180e2eceb3f0f0355911d38fddc9faec6ff8e26f
Instruction ID: 1b122fffd7975236643dba9294b25c16b3345f2586d5a79d790931e817577f7d
Opcode Fuzzy Hash: 3a6960139d1195420c441f0a180e2eceb3f0f0355911d38fddc9faec6ff8e26f
Instruction Fuzzy Hash: B9F01271A11B0482EE249F64F8847997370AB49BA2F54073DD66B4A2E8DF3CC646C700

Function 000000013F7985E8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013F79AD40: GetSystemDirectoryW.KERNEL32 ref: 000000013F79AD8F
Part of subcall function 000000013F79AD40: LoadLibraryW.KERNEL32 ref: 000000013F79ADF9

GetProcAddress.KERNEL32(?,?,00000000,000000013F7988A4), ref: 000000013F798615
GetProcAddress.KERNEL32(?,?,00000000,000000013F7988A4), ref: 000000013F798629

Strings

CryptProtectMemory, xrefs: 000000013F79860B
CryptUnprotectMemory, xrefs: 000000013F79861E
Crypt32.dll, xrefs: 000000013F7985F7

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: b2060872d589d48bc2ff78162bd05e3dbd29374624054cbd389be123312146de
Instruction ID: d31dfd0d9c915f9b754209a415260dca48f25cf63c084e21021e1a9c5bad1d2e
Opcode Fuzzy Hash: b2060872d589d48bc2ff78162bd05e3dbd29374624054cbd389be123312146de
Instruction Fuzzy Hash: 6AF01575E02F8181EF05CF20F49439837E0A768B49F88403DC9590A399EF78C696C340

Function 000000013F7ACA4C Relevance: 7.8, APIs: 5, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 000000013F7ACB6F
__AdjustPointer.LIBCMT ref: 000000013F7ACBBA

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 36d29e437cc54fc0d0163762a6bd59ee58dd3f3e7b9fd35c41fe11139d6dc90f
Instruction ID: 02b492d0a3e51f12ed554db07accf8df5ec6cf3fa9c2d6cc34fa8930be79f6b6
Opcode Fuzzy Hash: 36d29e437cc54fc0d0163762a6bd59ee58dd3f3e7b9fd35c41fe11139d6dc90f
Instruction Fuzzy Hash: 4BB1DF32A06A94A1FE65DF9DE5807E97790EB44F84F0B843E9E5907B85DB34CA5BC300

Function 000000013F7C1028 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000013F7C1050
_set_statfp.LIBCMT ref: 000000013F7C106B
_set_statfp.LIBCMT ref: 000000013F7C1087
_set_statfp.LIBCMT ref: 000000013F7C10C3

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: d1d10107198c09c3932fa6673c1dcca8ef673135442fdb47985b5f68ba886dfb
Instruction ID: 525d64959c822f9dddf1b4764b131460502b0c9d5dfd1a3a71fc09d8375b641c
Opcode Fuzzy Hash: d1d10107198c09c3932fa6673c1dcca8ef673135442fdb47985b5f68ba886dfb
Instruction Fuzzy Hash: 7211A13AE54A8141FE645168E4663E93180AF5A374F0A473CAE76063DBCBF88BD39201

Function 000000013F7B7520 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000000013F7AFE57,?,?,00000000,000000013F7B00F2,?,?,?,?,?,000000013F7B007E), ref: 000000013F7B753F
FlsSetValue.KERNEL32(?,?,?,000000013F7AFE57,?,?,00000000,000000013F7B00F2,?,?,?,?,?,000000013F7B007E), ref: 000000013F7B755E
FlsSetValue.KERNEL32(?,?,?,000000013F7AFE57,?,?,00000000,000000013F7B00F2,?,?,?,?,?,000000013F7B007E), ref: 000000013F7B7586
FlsSetValue.KERNEL32(?,?,?,000000013F7AFE57,?,?,00000000,000000013F7B00F2,?,?,?,?,?,000000013F7B007E), ref: 000000013F7B7597
FlsSetValue.KERNEL32(?,?,?,000000013F7AFE57,?,?,00000000,000000013F7B00F2,?,?,?,?,?,000000013F7B007E), ref: 000000013F7B75A8

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a18d1bb93033013d9260a128d3fe553969ba745fda5c1094212dda3b1d87667a
Instruction ID: 9a2f24abd3768252a0b174343459c5f0b1f2dc6c18e569e3758d6e8356f739d7
Opcode Fuzzy Hash: a18d1bb93033013d9260a128d3fe553969ba745fda5c1094212dda3b1d87667a
Instruction Fuzzy Hash: 05116031F0820842FA58A73995863E971919F4A7F0F44473DBB3A877D6DE28DE438310

Function 000000013F7B73B4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 000000013F7B73C5
FlsSetValue.KERNEL32 ref: 000000013F7B73E4
FlsSetValue.KERNEL32 ref: 000000013F7B740C
FlsSetValue.KERNEL32 ref: 000000013F7B741D
FlsSetValue.KERNEL32 ref: 000000013F7B742E

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 09154bd0359179f0e4309beb6de9114eca67b456f9a8fd9e2f5405ded58e9611
Instruction ID: 67dc6e6514bb2224982deec1f896290da9910638d3c0257da1bc5138a34f4bf1
Opcode Fuzzy Hash: 09154bd0359179f0e4309beb6de9114eca67b456f9a8fd9e2f5405ded58e9611
Instruction Fuzzy Hash: 5411ED34E0120D46FA68777594563E935828B47374F98073DAF369B7D2EE289F434351

Function 000000013F7A71D0 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 000000013F7A71ED
GetMessageW.USER32 ref: 000000013F7A7204
TranslateMessage.USER32 ref: 000000013F7A720F
DispatchMessageW.USER32 ref: 000000013F7A721A
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,000000013F7A45A6), ref: 000000013F7A7228

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: 15deec3054c28586e205459fe0189c4ed6066b119782c2c5fb0ff31e97a13644
Instruction ID: f4417287b088f00fea1fcec16c1f5d9a277caffd9610205a7813537f09c8770c
Opcode Fuzzy Hash: 15deec3054c28586e205459fe0189c4ed6066b119782c2c5fb0ff31e97a13644
Instruction Fuzzy Hash: 6AF01D32B3454582FB609B60F895BEA3361FBF4B05F855035AA4B819949E38C24BCB00

Function 000000013F7B5368 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013F7B53A4
_invalid_parameter_noinfo.LIBCMT ref: 000000013F7B54CE
_invalid_parameter_noinfo.LIBCMT ref: 000000013F7B5584

Strings

DXGIDebug.dll, xrefs: 000000013F7B537C

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: DXGIDebug.dll
API String ID: 3215553584-540382549
Opcode ID: 26a2edb9a9702b89a9dfd7e93f4289afa163ffe19e6ccab0517458891712df38
Instruction ID: a4d67e0f86ea2a928f314855730ee8b319e8bb09bd69af359225b02211c56c47
Opcode Fuzzy Hash: 26a2edb9a9702b89a9dfd7e93f4289afa163ffe19e6ccab0517458891712df38
Instruction Fuzzy Hash: 3191DF32A08B4C85F7618F28D4507ED37A2AB46B99F98413EDB5A473D9DB38CE478301

Function 000000013F7ADB50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000000013F7ADB9C
_CallSETranslator.LIBVCRUNTIME ref: 000000013F7ADBEB

Strings

MOC, xrefs: 000000013F7ADBB0
RCC, xrefs: 000000013F7ADBB9

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 58744c8bb07ed3aa3e58da5834242c9036a61f7ed2d139103f42bb17746798fd
Instruction ID: 02d0abf947483b85f01795608c5ae0b92c1f9d6be0b8746c420528136b091b14
Opcode Fuzzy Hash: 58744c8bb07ed3aa3e58da5834242c9036a61f7ed2d139103f42bb17746798fd
Instruction Fuzzy Hash: C0614F77A04B848AFB20CFA5D4403DD77A0F748B98F15422AEF5917B99CB78D69AC700

Function 000000013F7AE2E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000013F7AE308
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000000013F7AE3F0

Strings

csm, xrefs: 000000013F7AE442
csm, xrefs: 000000013F7AE32A

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: dff33faf19fa612d00f694886be567677f5714d100c4dc190a560424eb284a65
Instruction ID: f69805d5fcbb85978256c9e3686184937334865fd75d3b89f78c163c9e356224
Opcode Fuzzy Hash: dff33faf19fa612d00f694886be567677f5714d100c4dc190a560424eb284a65
Instruction Fuzzy Hash: 7B51BE32D20681C6FF748FA6944439D77A4F344B84F1A812DEA8947BD6CB3CD66ACB01

Function 000000013F7BF5D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000013F7BF6E7
GetLastError.KERNEL32 ref: 000000013F7BF709

Strings

U, xrefs: 000000013F7BF693
1ERs, xrefs: 000000013F7BF5EF

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: 1ERs$U
API String ID: 442123175-1905082894
Opcode ID: f32195ae518fd65f4f3b1012928870cbf467e7821a135e261eae2b4b3a68d128
Instruction ID: f83903881c4ed45912ca7785f6f5f0eaa191c8cb4e116202b092da325ded09ce
Opcode Fuzzy Hash: f32195ae518fd65f4f3b1012928870cbf467e7821a135e261eae2b4b3a68d128
Instruction Fuzzy Hash: 1A41B032A14A4482EB209FA5E8443E977A5F799B84F914039EF4D87798EB38CA42C700

Function 000000013F7A3B00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 000000013F7A3B62
SetDlgItemTextW.USER32 ref: 000000013F7A3BB4

Strings

GETPASSWORD1, xrefs: 000000013F7A3B21
1ERs, xrefs: 000000013F7A3B0F

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: DialogItemText
String ID: 1ERs$GETPASSWORD1
API String ID: 1552716189-1604629512
Opcode ID: 831a5f717255c5b41f354c6f53a912cae90d49b23b5780198afb01ba168c080e
Instruction ID: ab960a708e0114bb9d1bd69bdd259de824a23d5e27987910647f2d92dea1d918
Opcode Fuzzy Hash: 831a5f717255c5b41f354c6f53a912cae90d49b23b5780198afb01ba168c080e
Instruction Fuzzy Hash: 64218132B04A8082FE649F55E9903EA7362E785784F55403EDE8E477D6DE3ACA5B8304

Function 000000013F78C424 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F78C3F3,?,?,?,000000013F78C2E2), ref: 000000013F78C447
GetLastError.KERNEL32 ref: 000000013F78C4A8
CloseHandle.KERNEL32 ref: 000000013F78C4BB

Strings

1ERs, xrefs: 000000013F78C433

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CloseCurrentErrorHandleLastProcess
String ID: 1ERs
API String ID: 1009092642-1577259171
Opcode ID: 3834570864cbc02c00b13b819ef016fef9bf52c25e73392543ff3d1090e28114
Instruction ID: ac773b28180b0a874631e1f1eae0cdc65c338ca6dafc2e656ed3c8b52c6264e1
Opcode Fuzzy Hash: 3834570864cbc02c00b13b819ef016fef9bf52c25e73392543ff3d1090e28114
Instruction Fuzzy Hash: 4A116332A14B4186EB50CF61F4417DA77B0F788B90F45412AEA8E43668DF3CC24ACB40

Function 000000013F7A92F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000000013F7A949E
capture_previous_context.LIBCMT ref: 000000013F7A94B6
__raise_securityfailure.LIBCMT ref: 000000013F7A9558

Strings

1ERs, xrefs: 000000013F7A9530

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: FeaturePresentProcessor__raise_securityfailurecapture_previous_context
String ID: 1ERs
API String ID: 838830666-1577259171
Opcode ID: 9eea292e7115fef4e2324cf346b579c13e806438279dc46d54d958f88320f92a
Instruction ID: 3936e3017f5a28a5c5c96e4c14bc5631c5956dbd3db088dadadc29b3e92cf63b
Opcode Fuzzy Hash: 9eea292e7115fef4e2324cf346b579c13e806438279dc46d54d958f88320f92a
Instruction Fuzzy Hash: 7321BA76A01B0081FA408B59F9813D576B4F784744F91413EEA8E863F1EB38C65AC300

Function 000000013F7A0990 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 000000013F7A09D9
RegisterClassExW.USER32 ref: 000000013F7A0A04

Strings

P, xrefs: 000000013F7A09CB
RarHtmlClassName, xrefs: 000000013F7A09F4

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: P$RarHtmlClassName
API String ID: 1693014935-552670043
Opcode ID: 31acbb7b32b518cdaa092c4f1bb6aab95ae06e0d4904f27a47475fa26f19002a
Instruction ID: fc42f9e41e088a487e42d69ae8b6029f45f9ed47d18f2b9ec7ea73cd7fa450eb
Opcode Fuzzy Hash: 31acbb7b32b518cdaa092c4f1bb6aab95ae06e0d4904f27a47475fa26f19002a
Instruction Fuzzy Hash: C2010532A10B51DAF7008FA0E84539D77B8F348758F244129DE982AA58DF78C256CB80

Function 000000013F7A1CA4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 000000013F7A1CB0
GetDeviceCaps.GDI32 ref: 000000013F7A1CC1
ReleaseDC.USER32 ref: 000000013F7A1CCE

Strings

, xrefs: 000000013F7A1CD4

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: 3835359f8632c3883978aa59da59803a7ae97ae479bf7427c32fe4182829fb3b
Instruction ID: b88f7b4164b32a63562bf72d33d17f91660f0187d722e11ea974a98777caeb76
Opcode Fuzzy Hash: 3835359f8632c3883978aa59da59803a7ae97ae479bf7427c32fe4182829fb3b
Instruction Fuzzy Hash: C4E0C230B0464082FB085BBAB58932A3371A74CBD0F16403EDA0F43784DE3DC4C64700

Function 000000013F7BF860 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000000013F7BF97C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000000013F7BF84B,00000000), ref: 000000013F7BFA07

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 8b870ef09745b19d1218f5e34d4e5080e6ee1a886a16630b901c020aa05fcdcf
Instruction ID: cafab04dd3c28486f44195ae64258a192d508c7526d08db036330af2d0119190
Opcode Fuzzy Hash: 8b870ef09745b19d1218f5e34d4e5080e6ee1a886a16630b901c020aa05fcdcf
Instruction Fuzzy Hash: EA91A072F1065889FB649FE994907ED3BA0B746F88F54412DDF0A67A95DB34CA83C700

Function 000000013F7A1BB4 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 000000013F7A1BBC
GetDeviceCaps.GDI32 ref: 000000013F7A1BD2
GetDeviceCaps.GDI32 ref: 000000013F7A1BE6
ReleaseDC.USER32 ref: 000000013F7A1BF7

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 063c2fcded254c65569d10fc533311c424a852e6975ab1428a992d71ab73b3cc
Instruction ID: 21ad8f19d7b9dad995a43c876bde6ae222423d633ac94155a0df4573224eccdf
Opcode Fuzzy Hash: 063c2fcded254c65569d10fc533311c424a852e6975ab1428a992d71ab73b3cc
Instruction Fuzzy Hash: CEE01A71E0160486FF18AF71A8193A53260AB58B42F44403E881E46390EE3D828A8710

Function 000000013F7B98FC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013F7B992C

Part of subcall function 000000013F7B01E4: IsProcessorFeaturePresent.KERNEL32 ref: 000000013F7B01ED
Part of subcall function 000000013F7B01E4: GetCurrentProcess.KERNEL32(?,?,?,?,000000013F7B0193,?,?,?,?,?,000000013F7B007E), ref: 000000013F7B0212

Strings

*?, xrefs: 000000013F7B9957
1ERs, xrefs: 000000013F7B9CDE

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *?$1ERs
API String ID: 4036615347-1217088175
Opcode ID: bb6ce0669fb04d6978b6cf1d65966d024c9f78935a0b3e22165152f1d96c2013
Instruction ID: 8aa133006ab136f649369b69dcd2f812a6868f47801afd706a99cc5f5fe39a23
Opcode Fuzzy Hash: bb6ce0669fb04d6978b6cf1d65966d024c9f78935a0b3e22165152f1d96c2013
Instruction Fuzzy Hash: B851CD72F0065842FF619B2699017ED77A1A74ABE4F14453ADF2917B89EA38CA43C350

Function 000000013F7AE518 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000013F7AE542

Strings

csm, xrefs: 000000013F7AE567
csm, xrefs: 000000013F7AE6D6

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: ee578b2482a540c51527f164a6e0fed1b565d6d81eec71688779eae399c326ed
Instruction ID: 62c8876fbac1af23789b0a3fc40ad2160a94f7745d74cb28ca456867a432ec1e
Opcode Fuzzy Hash: ee578b2482a540c51527f164a6e0fed1b565d6d81eec71688779eae399c326ed
Instruction Fuzzy Hash: A471F472E1468086EF618FA6D4907ED7BA1F344F89F1A8129DE4847B85D73CC69AC740

Function 000000013F7AEB50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000013F7AEBFA
_CreateFrameInfo.LIBVCRUNTIME ref: 000000013F7AEC26

Strings

csm, xrefs: 000000013F7AED26

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: acc7dda5a5dd4faa8ec8e35b2fff25dbec73345646dd51e33ca1b596789e392c
Instruction ID: 9c49644f5b91a6f14efa4d62c84ba50eb2a393c57b44c9255c6de81fe79c7af9
Opcode Fuzzy Hash: acc7dda5a5dd4faa8ec8e35b2fff25dbec73345646dd51e33ca1b596789e392c
Instruction Fuzzy Hash: 52516D37A2474096FA20EF6AE4403AE77B4F788BA0F150139EB9D07B55CB38C566CB00

Function 000000013F7B6174 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013F7B61A6

Part of subcall function 000000013F7B7738: HeapFree.KERNEL32 ref: 000000013F7B774E
Part of subcall function 000000013F7B7738: GetLastError.KERNEL32(?,?,000000013F7B6677,000000013F7BC272,?,?,?,000000013F7BC2AF,?,?,00000000,000000013F7BC775,?,?,?,000000013F7BC6A7), ref: 000000013F7B7758

Strings

C:\Users\user\Desktop\winrar-x64-701(1).exe, xrefs: 000000013F7B61B7
`0:, xrefs: 000000013F7B61CE

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorFreeHeapLast_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\winrar-x64-701(1).exe$`0:
API String ID: 2724796048-146855414
Opcode ID: f30dbfa62e90bb3a960141424ea03e54bc9d125c453d9718452a60bd55966967
Instruction ID: 47c7866080b6f53d7237f6651a5611805e6ffdd9322c00346902be1e233eddfc
Opcode Fuzzy Hash: f30dbfa62e90bb3a960141424ea03e54bc9d125c453d9718452a60bd55966967
Instruction Fuzzy Hash: D7415E36A00B5886FB24DF25A8413EC77A4E746794F95407DFF0A57B96DE38CA838300

Function 000000013F791730 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F79B7E8: GetSystemTime.KERNEL32 ref: 000000013F79B805
Part of subcall function 000000013F79B7E8: SystemTimeToFileTime.KERNEL32 ref: 000000013F79B815

GetCurrentProcessId.KERNEL32 ref: 000000013F79179B

Strings

.rartemp, xrefs: 000000013F791810
1ERs, xrefs: 000000013F79174F

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Time$System$CurrentFileProcess
String ID: .rartemp$1ERs
API String ID: 1145848222-1920620648
Opcode ID: 7d1f8f55dec5d5e6598c4753bbd8b80c4d61319c847012b0debec83761cead58
Instruction ID: a9b966b76c35920b7d40148a006f642714d7663e6e61c5b2bd1392eeee08080a
Opcode Fuzzy Hash: 7d1f8f55dec5d5e6598c4753bbd8b80c4d61319c847012b0debec83761cead58
Instruction Fuzzy Hash: BB418032B01940A6EB54EB61D8923DD7761F7C8794F82513AEA0E977A6DE34CB1BC340

Function 000000013F7A1A7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 000000013F7A1AA5
ReleaseDC.USER32 ref: 000000013F7A1B87

Strings

, xrefs: 000000013F7A1B1F

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Release
String ID:
API String ID: 1375353473-3916222277
Opcode ID: 63c5ebe95d055cc5ab24ee0dc664498dd510615dc332dc8ef352fedcd7013a9f
Instruction ID: b26ca1622340b6c542cdb5eafcb6a2811c0a3f2ccff0b769080a7eade402e213
Opcode Fuzzy Hash: 63c5ebe95d055cc5ab24ee0dc664498dd510615dc332dc8ef352fedcd7013a9f
Instruction Fuzzy Hash: 3831473660474286EB18DF12B81875AB7A1F799FD1F41403AEE4A43B58DE3CC64ACB00

Function 000000013F7BF4B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000013F7BF57E
GetLastError.KERNEL32 ref: 000000013F7BF59A

Strings

1ERs, xrefs: 000000013F7BF4CF

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: 1ERs
API String ID: 442123175-1577259171
Opcode ID: 407f2926c8676f2302bafd9526a4335fc05db1dbfaef102cb7fa37c50fde64c5
Instruction ID: 3bcd0e5e2cf7c38db5bd6055aef24feae37f72b5a784a5ef9d4649d72299f77a
Opcode Fuzzy Hash: 407f2926c8676f2302bafd9526a4335fc05db1dbfaef102cb7fa37c50fde64c5
Instruction Fuzzy Hash: 1731E672B15B4486EB109F69E8847C973B4FB49B80F554039EB4E87B54EB38CA63C700

Function 000000013F7BF3B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000013F7BF463
GetLastError.KERNEL32 ref: 000000013F7BF47F

Strings

1ERs, xrefs: 000000013F7BF3CB

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: 1ERs
API String ID: 442123175-1577259171
Opcode ID: 93ad03125a6552e2040d13b03488c7f9570f164afaf568a430d276798623ef8d
Instruction ID: 14bb85ecbafe0ba49a59e389befcef4c9ca67e35820e1beb0de12ce7afe8cff0
Opcode Fuzzy Hash: 93ad03125a6552e2040d13b03488c7f9570f164afaf568a430d276798623ef8d
Instruction Fuzzy Hash: 7F31B472A15B848AEB109FA5E5847C977A0F359B80F55403AEB4E83755DB38CA57CB00

Function 000000013F7BA138 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000000013F7BA173
GetLastError.KERNEL32 ref: 000000013F7BA17D

Strings

1ERs, xrefs: 000000013F7BA152

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: 1ERs
API String ID: 2776309574-1577259171
Opcode ID: fac9f4fcde07ac9675be29e08b37c124507428438db66964a21da66529be29b5
Instruction ID: 57d425f4364492dc4db6e35b52aeea12c1b77a218f66f6a4ebefc84b61304d2c
Opcode Fuzzy Hash: fac9f4fcde07ac9675be29e08b37c124507428438db66964a21da66529be29b5
Instruction Fuzzy Hash: DA317432A14B848AF7709B25E8447DE7BA4F386794F540129DBCC47B99DB38CA42CB01

Function 000000013F7A3920 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 000000013F7A3980

Strings

RENAMEDLG, xrefs: 000000013F7A393B
1ERs, xrefs: 000000013F7A392C

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Dialog
String ID: 1ERs$RENAMEDLG
API String ID: 1120787796-2488343091
Opcode ID: af2bb5dfbc5e5501e7134edf2da09324063c46f3e98d560e4b232417743cb511
Instruction ID: e1fbab2248dac70b38ba753def8701f710684d3e51e4d4e4017ba47cef7cf773
Opcode Fuzzy Hash: af2bb5dfbc5e5501e7134edf2da09324063c46f3e98d560e4b232417743cb511
Instruction Fuzzy Hash: C121D231E0874082FE909F52E5923F97291A795BC5F50413EED4D47BD6CE2ACA5BC300

Function 000000013F798864 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F7985E8: GetProcAddress.KERNEL32(?,?,00000000,000000013F7988A4), ref: 000000013F798615
Part of subcall function 000000013F7985E8: GetProcAddress.KERNEL32(?,?,00000000,000000013F7988A4), ref: 000000013F798629

GetCurrentProcessId.KERNEL32 ref: 000000013F798919

Strings

CryptUnprotectMemory failed, xrefs: 000000013F798910
CryptProtectMemory failed, xrefs: 000000013F7988CC

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 6d8220386a921977bc83dee32e9001b82bf0fdd35c8ad8174e51ed78770c5b4e
Instruction ID: 2cb0d2d8515079e9468b93094c1e884c968a66b540f0fb8f1cfa748d5da01a10
Opcode Fuzzy Hash: 6d8220386a921977bc83dee32e9001b82bf0fdd35c8ad8174e51ed78770c5b4e
Instruction Fuzzy Hash: 34217F31A01A4080FE50CB16EA807EA77A0EB54BE5FC9023ED969477E5EB38C747C301

Function 000000013F7A2DE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F7A2D1C: GetCurrentProcess.KERNEL32 ref: 000000013F7A2D2E
Part of subcall function 000000013F7A2D1C: GetLastError.KERNEL32 ref: 000000013F7A2D77

CreateDirectoryW.KERNEL32 ref: 000000013F7A2EB9
LocalFree.KERNEL32 ref: 000000013F7A2EC9

Strings

1ERs, xrefs: 000000013F7A2DFA

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID: 1ERs
API String ID: 1077098981-1577259171
Opcode ID: 57e1a0af07258c8e1817781cf8ba4f0f067f30504d2ef8d4c883f0680f61e284
Instruction ID: 9861736d2011580e4891687b699c0bc393d9ad125e9fb349c13458bf103786c9
Opcode Fuzzy Hash: 57e1a0af07258c8e1817781cf8ba4f0f067f30504d2ef8d4c883f0680f61e284
Instruction Fuzzy Hash: 8E312A32B04B408AFB20DFB0E4447ED33B5F788748F45412A9A4D5AA99EF78C25EC780

Function 000000013F7918C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 000000013F7918FE
MoveFileW.KERNEL32 ref: 000000013F79195F

Strings

1ERs, xrefs: 000000013F7918D3

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: FileMove
String ID: 1ERs
API String ID: 3562171763-1577259171
Opcode ID: 1d17a2744ff37d8c884db1ea1d391afbeeede24ae573b948bd24093b200d9236
Instruction ID: 5587143e52e23e6b6a71695f744ebbce0645f2d7dcee11e5f381f51f5748411a
Opcode Fuzzy Hash: 1d17a2744ff37d8c884db1ea1d391afbeeede24ae573b948bd24093b200d9236
Instruction Fuzzy Hash: C4212E32B1464052EA50EB61E4523EA7761FB85BC4F854139EE8D97B96EF28CB17C700

Function 000000013F79B0A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32 ref: 000000013F79B109
CreateEventW.KERNEL32 ref: 000000013F79B122

Strings

Thread pool initialization failed., xrefs: 000000013F79B142

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Create$EventSemaphore
String ID: Thread pool initialization failed.
API String ID: 3431467744-2182114853
Opcode ID: cf7e847ec42c39c98afed13f61a8aa811440edc33cdc0335b4f5739e4f6cac58
Instruction ID: 7c9659e3b085b6030e8a116fa7f8effe2500477cd1995cca4fc2a3ad58bbfdf8
Opcode Fuzzy Hash: cf7e847ec42c39c98afed13f61a8aa811440edc33cdc0335b4f5739e4f6cac58
Instruction Fuzzy Hash: D021CF32B11B4486FB588F29E1983DA77A2F794748F54803CDB5907382DF7A926AC744

Function 000000013F7AC3D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F7824E7), ref: 000000013F7AC41C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F7824E7), ref: 000000013F7AC462

Strings

csm, xrefs: 000000013F7AC44F

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: c03d251433d90376995db402b47a83d553daa412ff273ed7f441ff3744a3506c
Instruction ID: 558892ae49978c996c2c1a4d557e409b0af019d1b91d1324334f69ea7a4772a5
Opcode Fuzzy Hash: c03d251433d90376995db402b47a83d553daa412ff273ed7f441ff3744a3506c
Instruction Fuzzy Hash: 89111C32614B8082EF258F19F4403A97BA5F788B98F594229DE8D07769DF38C656CB04

Function 000000013F791A2C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32 ref: 000000013F791A50
RemoveDirectoryW.KERNEL32 ref: 000000013F791A88

Strings

1ERs, xrefs: 000000013F791A36

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: DirectoryRemove
String ID: 1ERs
API String ID: 597925465-1577259171
Opcode ID: b997491ad4a48a3c594dd1061f4be5941c8119e626fde767970277d33b1e43f2
Instruction ID: 46d593724ad81a91fd8139b37184184ceafc7135602767319337f9dfbe0f87a0
Opcode Fuzzy Hash: b997491ad4a48a3c594dd1061f4be5941c8119e626fde767970277d33b1e43f2
Instruction Fuzzy Hash: 1D014F32B04A4142EE50EB61F4523EA7370FB85B84F844139EA9D87696EF28CA56C600

Function 000000013F7A29A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

GetNumberFormatW.KERNEL32 ref: 000000013F7A2A2A

Part of subcall function 000000013F7A2954: GetLocaleInfoW.KERNEL32 ref: 000000013F7A2981

Strings

1ERs, xrefs: 000000013F7A29B6
2, xrefs: 000000013F7A2A0E

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID: 1ERs$2
API String ID: 2169056816-3766158228
Opcode ID: d7107cfca5a4afd32597e90ecfc509413890bc962788bf640ddc7de3c99321a0
Instruction ID: 1049b324675199a16a72bbe5e07bbfc25c1cee85f10db57842d3f5cc30a71e94
Opcode Fuzzy Hash: d7107cfca5a4afd32597e90ecfc509413890bc962788bf640ddc7de3c99321a0
Instruction Fuzzy Hash: 74111832624B8481EA24CF51E4517CA73B5F788B84F81512AAA8D43B68DF38C257CB41

Function 000000013F79CC5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,000000013F79CC4D), ref: 000000013F79CC7C
IsDBCSLeadByte.KERNEL32 ref: 000000013F79CC99

Strings

1ERs, xrefs: 000000013F79CC66

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ByteInfoLead
String ID: 1ERs
API String ID: 1254592819-1577259171
Opcode ID: 9fe63a404204bb27164569fb0c7e8cbaedcee2e8eeccea48f9d39e8525d7c6f2
Instruction ID: 93f4848eb47955544712f168c862a87fcc3369b828138df451f0850032240ad7
Opcode Fuzzy Hash: 9fe63a404204bb27164569fb0c7e8cbaedcee2e8eeccea48f9d39e8525d7c6f2
Instruction Fuzzy Hash: B2F09A32A0868086FB008B25F59538A77B0FB487C4F85513DE68B466A5DE2CC2AACB00

Function 000000013F79B7E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 000000013F79B805
SystemTimeToFileTime.KERNEL32 ref: 000000013F79B815

Strings

1ERs, xrefs: 000000013F79B7EE

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: Time$System$File
String ID: 1ERs
API String ID: 2838179519-1577259171
Opcode ID: 30d39a170172742c9d1ce6ad9a523efe7992a70e7fba1bfdebc0fe7ccbc83a63
Instruction ID: 5146e66ed02b46e077e3c165ba64976d260b1f68f8a8702e17544a7c0d7e8306
Opcode Fuzzy Hash: 30d39a170172742c9d1ce6ad9a523efe7992a70e7fba1bfdebc0fe7ccbc83a63
Instruction Fuzzy Hash: A1E0E572614A4581EE109F11F8513DA7370F79C7D5F841526A58F46765DE2CC75BCB00

Function 000000013F7A24A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 000000013F7A24D8

Strings

1ERs, xrefs: 000000013F7A24AC
@, xrefs: 000000013F7A24D0

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: 1ERs$@
API String ID: 1890195054-1584403332
Opcode ID: feebbebb49dabba520efc801d04c4b00f1359dce04e423c62eea3d0669102393
Instruction ID: e98cf31a1e539328f10aa90e30d2467a5449c6ce2ca599c8ac33b21e8d9b6826
Opcode Fuzzy Hash: feebbebb49dabba520efc801d04c4b00f1359dce04e423c62eea3d0669102393
Instruction Fuzzy Hash: 39E0ED76A2464482EF20DB55E45238A7361F798B88FD50119E68D03799DF3CD21ACF00

Function 000000013F79AFF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,000000013F79B43D), ref: 000000013F79AFF7
GetLastError.KERNEL32(?,?,?,?,000000013F79B43D), ref: 000000013F79B002

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 000000013F79B00C

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 9928445313413648c54120f2c83774c4f876eb100ab0f055dbd8e3c4ab5f68aa
Instruction ID: f76e30cef80ad081e8f71c2f8e2fc62bc8282a3862ce77df333bce3bb0880fb0
Opcode Fuzzy Hash: 9928445313413648c54120f2c83774c4f876eb100ab0f055dbd8e3c4ab5f68aa
Instruction Fuzzy Hash: 45E0EC76E1080082FA00AB39FCDA7D53661A7657B0FD0433DE43A826F29B68874BC701

Function 000000013F796458 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,000000013F795B30), ref: 000000013F79645E
FindResourceW.KERNEL32(?,?,?,?,000000013F795B30), ref: 000000013F796474

Strings

RTL, xrefs: 000000013F79646A

Memory Dump Source

Source File: 00000000.00000002.387611521.000000013F781000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013F780000, based on PE: true

Associated: 00000000.00000002.387608333.000000013F780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387619715.000000013F7C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387634001.000000013F7DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387652828.000000013F7E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387662132.000000013F7EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.387667763.000000013F7EB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f780000_winrar-x64-701(1).jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 3fe9193610b2b954ca747a9453040e17f244332993db366b631c7d02911bbf0e
Instruction ID: f8551e873741bbb9d60495a5ef19dde04bb57c6f0ff9aeebf18558874e419ae8
Opcode Fuzzy Hash: 3fe9193610b2b954ca747a9453040e17f244332993db366b631c7d02911bbf0e
Instruction Fuzzy Hash: D4E01234F01B4083EE08A71178653D436B05759B81F98443CC847423A0D96C87468700

Analysis Process: Uninstall.exePID: 3688, Parent PID: 3368COMMON

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1814
Total number of Limit Nodes:	12

Executed Functions

Function 000000013FA4BA0C Relevance: 19.8, APIs: 1, Strings: 10, Instructions: 502
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__swprintf_l.LIBCMT ref: 000000013FA4BEFD

Strings

RTL, xrefs: 000000013FA4BEB3
DIRECTION, xrefs: 000000013FA4BD98
DIALOG, xrefs: 000000013FA4BD82
STRINGS, xrefs: 000000013FA4BD76
*messages***, xrefs: 000000013FA4BBE4
MENU, xrefs: 000000013FA4BD8D
$%s:, xrefs: 000000013FA4BED7
*messages***, xrefs: 000000013FA4BBB4
@%s:, xrefs: 000000013FA4BEDE
,, xrefs: 000000013FA4C063

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: __swprintf_l
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 1488884202-2291855099
Opcode ID: d9c6479bb24b80900e483b0d07dfaef48e528c2e4b3a1bd587cb1a39ebcdf1dd
Instruction ID: 228d8e0bdcb9a2d6236edd34bb779d2a79e0164f63040c478f351b673e7f7430
Opcode Fuzzy Hash: d9c6479bb24b80900e483b0d07dfaef48e528c2e4b3a1bd587cb1a39ebcdf1dd
Instruction Fuzzy Hash: 0922AC32A11A8095FB20EB25D8503D977A1F784788F80513AEA4E677E6EF78CB47C740

Function 000000013FA6CC50 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013FA6C984: _invalid_parameter_noinfo.LIBCMT ref: 000000013FA6C9C5
Part of subcall function 000000013FA6C984: _invalid_parameter_noinfo.LIBCMT ref: 000000013FA6CA43
Part of subcall function 000000013FA6C984: _invalid_parameter_noinfo.LIBCMT ref: 000000013FA6CA94

CreateFileW.KERNELBASE ref: 000000013FA6CD56
CreateFileW.KERNEL32 ref: 000000013FA6CDA6
GetLastError.KERNEL32 ref: 000000013FA6CDD6
GetFileType.KERNELBASE ref: 000000013FA6CDEB
GetLastError.KERNEL32 ref: 000000013FA6CDF5
CloseHandle.KERNEL32 ref: 000000013FA6CE28
CloseHandle.KERNEL32 ref: 000000013FA6CF8B
CreateFileW.KERNEL32 ref: 000000013FA6CFC0
GetLastError.KERNEL32 ref: 000000013FA6CFCF

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 5a884f97d7ff67d6aca4df2dac599e8cec8c3a25a94e88d1a4cc9f66a8369aa6
Instruction ID: b3213cface3d6328763bf34471c8f36703a3de689e17d46ea9aa8ace9fb20941
Opcode Fuzzy Hash: 5a884f97d7ff67d6aca4df2dac599e8cec8c3a25a94e88d1a4cc9f66a8369aa6
Instruction Fuzzy Hash: F3C19E36B20A4085EB10CFA9C4917EC3BB5F389BA8F115229DE2E977D5CB39C656C740

Function 000000013FA49B10 Relevance: 7.6, APIs: 5, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 000000013FA49B5B
FindFirstFileW.KERNELBASE ref: 000000013FA49B9C
GetLastError.KERNEL32 ref: 000000013FA49BB5
FindNextFileW.KERNEL32 ref: 000000013FA49BDE
GetLastError.KERNEL32 ref: 000000013FA49BEC

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 039dc7a200847a608efe71cbd31d7291781ba74b3c729308aa8b03dc8734d955
Instruction ID: 20c7bc91600e727830f8422948a67d94ee38a16a48d07721a099a0f753cff868
Opcode Fuzzy Hash: 039dc7a200847a608efe71cbd31d7291781ba74b3c729308aa8b03dc8734d955
Instruction Fuzzy Hash: F9416532608A4496DA20DB25E5913ED73A0F7897A4F400329EB6D47BD5DF2CC65BC700

Function 000000013FA54E10 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 000000013FA54E19
_invalid_parameter_noinfo.LIBCMT ref: 000000013FA62278

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: 8ba2dbe03e17a1741fb447493e08548d6c454a77f43b12b85ad60658992c6f05
Instruction ID: 5e63757be86aa032fbdf9752eb3c1c40fbc97b98d684e1cd37abda99ccca421d
Opcode Fuzzy Hash: 8ba2dbe03e17a1741fb447493e08548d6c454a77f43b12b85ad60658992c6f05
Instruction Fuzzy Hash: 0CE0EC30E15101CAEE5C37B558463EC34E12B95338F90033DA16D436C2CA9D47974A22

Function 000000013FA51D3C Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 130
comwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013FA4EAA4: GetModuleHandleW.KERNEL32 ref: 000000013FA4EAB1
Part of subcall function 000000013FA4EAA4: GetProcAddress.KERNEL32 ref: 000000013FA4EAC9
Part of subcall function 000000013FA4EAA4: GetProcAddress.KERNEL32 ref: 000000013FA4EAEB

Part of subcall function 000000013FA4D818: GetVersionExW.KERNEL32 ref: 000000013FA4D895
Part of subcall function 000000013FA4D818: LoadLibraryExW.KERNEL32 ref: 000000013FA4D8D0

Part of subcall function 000000013FA4B994: SetProcessDefaultLayout.USER32 ref: 000000013FA4B9E8

OleInitialize.OLE32 ref: 000000013FA51DA0

Part of subcall function 000000013FA4EAF8: GetSystemDirectoryW.KERNEL32 ref: 000000013FA4EB47
Part of subcall function 000000013FA4EAF8: LoadLibraryW.KERNEL32 ref: 000000013FA4EBB1

LoadIconW.USER32 ref: 000000013FA51DC3
LoadIconW.USER32 ref: 000000013FA51DEE
CreateFontW.GDI32 ref: 000000013FA51E3E
GetEnvironmentVariableW.KERNEL32 ref: 000000013FA51E6A
GetCommandLineW.KERNEL32 ref: 000000013FA51EA0
DialogBoxParamW.USER32 ref: 000000013FA51EF9
DialogBoxParamW.USER32 ref: 000000013FA51F2F
FreeLibrary.KERNEL32 ref: 000000013FA51F49
OleUninitialize.OLE32 ref: 000000013FA51F4F
DeleteObject.GDI32 ref: 000000013FA51F5C
DeleteObject.GDI32 ref: 000000013FA51F69

Strings

DONEDLG, xrefs: 000000013FA51F21
riched20.dll, xrefs: 000000013FA51DA6
SETUPDLG, xrefs: 000000013FA51EEB
uninstall.lng, xrefs: 000000013FA51D77
sfxcmd, xrefs: 000000013FA51E63
RARICON, xrefs: 000000013FA51DB5, 000000013FA51DE7
MS Shell Dlg, xrefs: 000000013FA51E02

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Load$Library$AddressDeleteDialogIconObjectParamProc$CommandCreateDefaultDirectoryEnvironmentFontFreeHandleInitializeLayoutLineModuleProcessSystemUninitializeVariableVersion
String ID: DONEDLG$MS Shell Dlg$RARICON$SETUPDLG$riched20.dll$sfxcmd$uninstall.lng
API String ID: 2333794796-1726429148
Opcode ID: 674a6ebc5775ab99176284ceeb78bc3c54b1a6d67ce76aba6fad6e141aabf849
Instruction ID: 75d9454157db70894044957ba251353049061a4f28d1d2e17a08b00b6b5e78ab
Opcode Fuzzy Hash: 674a6ebc5775ab99176284ceeb78bc3c54b1a6d67ce76aba6fad6e141aabf849
Instruction Fuzzy Hash: A0614772A04A4496FA109F65E8547DABBE1F784380F90003EEA8E47B75DF78C64BCB40

Function 000000013FA459F0 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WinRAR.REV, xrefs: 000000013FA45E9D, 000000013FA45F2D
WinRAR.exe, xrefs: 000000013FA45AAC
WinRAR.ZIP\DefaultIcon, xrefs: 000000013FA45DF1, 000000013FA45E5F
WinRAR\shell\open\command, xrefs: 000000013FA45B19
WinRAR.ZIP\shell\open\command, xrefs: 000000013FA45D97
WinRAR\DefaultIcon, xrefs: 000000013FA45C6D, 000000013FA45CDB
WinRAR.ZIP, xrefs: 000000013FA45D3F
WinRAR.REV\shell\open\command, xrefs: 000000013FA45F85
.rev, xrefs: 000000013FA45EBD
" "%1", xrefs: 000000013FA45AED
WinRAR, xrefs: 000000013FA45A4E
WinRAR.REV\DefaultIcon, xrefs: 000000013FA45FDF, 000000013FA4604D

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: LoadString
String ID: " "%1"$.rev$WinRAR$WinRAR.REV$WinRAR.REV\DefaultIcon$WinRAR.REV\shell\open\command$WinRAR.ZIP$WinRAR.ZIP\DefaultIcon$WinRAR.ZIP\shell\open\command$WinRAR.exe$WinRAR\DefaultIcon$WinRAR\shell\open\command
API String ID: 2948472770-3100727910
Opcode ID: c722b656afdd6144150e3ce6f53847c9c5fec5c30a87a715cff640ce5be26c05
Instruction ID: 9dabbb0da419aec90d91d1fb33dd8cafad9c6ab1443631659753620d1419bb8a
Opcode Fuzzy Hash: c722b656afdd6144150e3ce6f53847c9c5fec5c30a87a715cff640ce5be26c05
Instruction Fuzzy Hash: 55125971615541A1EA01EFA0D4517DEB761EBD1394F80203AB64E97BFAEE78CB8BC700

Function 000000013FA522D0 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 228
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDlgButtonChecked.USER32 ref: 000000013FA5237B
SetForegroundWindow.USER32 ref: 000000013FA525D4
SendMessageW.USER32 ref: 000000013FA525EC
GetSysColor.USER32 ref: 000000013FA525F7
SendDlgItemMessageW.USER32 ref: 000000013FA52612
SendMessageW.USER32 ref: 000000013FA5262E

Strings

HELPIntegrationSettings, xrefs: 000000013FA52300
SETUPDLG, xrefs: 000000013FA5230C
, xrefs: 000000013FA524DE
.ace, xrefs: 000000013FA524A1
, xrefs: 000000013FA5255F

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: MessageSend$ButtonCheckedColorForegroundItemWindow
String ID: $ $.ace$HELPIntegrationSettings$SETUPDLG
API String ID: 2255778568-2511250736
Opcode ID: 260f5e3393e060c1f4b1b6e26fcf222c7ce071ea7f890c00ef5338bda82b7b35
Instruction ID: 425564a4e868b81c165dbd3f3fbfcdf71e6476e55b53d449353b561574f2bd86
Opcode Fuzzy Hash: 260f5e3393e060c1f4b1b6e26fcf222c7ce071ea7f890c00ef5338bda82b7b35
Instruction Fuzzy Hash: B6917B31F1054096FB21EBA1D8557ED77A1AB95B88F404039D94E67BEAEF28CB0BC350

Function 000000013FA43804 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013FA49CF0: GetVersionExW.KERNEL32 ref: 000000013FA49D21

SHChangeNotify.SHELL32 ref: 000000013FA43ACC

Part of subcall function 000000013FA50910: RegOpenKeyExW.ADVAPI32 ref: 000000013FA50984
Part of subcall function 000000013FA50910: RegDeleteValueW.ADVAPI32(?,?,?,?,?,?,?,?,80000000,{B41DB860-8EE4-11D2-9906-E49FADC173CA},?,000000013FA44549), ref: 000000013FA5099E

Strings

Software\WinRAR\Capabilities, xrefs: 000000013FA438EE
rarext.dll, xrefs: 000000013FA43876
Capabilities\FileAssociations, xrefs: 000000013FA43A47
ApplicationDescription, xrefs: 000000013FA4396D
{B41DB860-64E4-11D2-9906-E49FADC173CA}, xrefs: 000000013FA4386F
{B41DB860-8EE4-11D2-9906-E49FADC173CA}, xrefs: 000000013FA43847
Capabilities, xrefs: 000000013FA4397F
WinRAR32, xrefs: 000000013FA43840
\Software\RegisteredApplications, xrefs: 000000013FA438AF, 000000013FA4390E
WinRAR.ZIP, xrefs: 000000013FA439DF
WinRAR, xrefs: 000000013FA43865
rarext32.dll, xrefs: 000000013FA4384E

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ChangeDeleteNotifyOpenValueVersion
String ID: ApplicationDescription$Capabilities$Capabilities\FileAssociations$Software\WinRAR\Capabilities$WinRAR$WinRAR.ZIP$WinRAR32$\Software\RegisteredApplications$rarext.dll$rarext32.dll${B41DB860-64E4-11D2-9906-E49FADC173CA}${B41DB860-8EE4-11D2-9906-E49FADC173CA}
API String ID: 4091171417-1834283350
Opcode ID: 655c141e39e2900d2e0b3796d4f0039d3bf8e7af58d529d17644e48c5fa34ef5
Instruction ID: 7901b7d31ee46c5cad511b68b3de9dc36b8eeda0ac0a752aeee459d39530eb84
Opcode Fuzzy Hash: 655c141e39e2900d2e0b3796d4f0039d3bf8e7af58d529d17644e48c5fa34ef5
Instruction Fuzzy Hash: 6871AA71A24645A2EA00DB61D8517DD7361F7C4744F81603AEA4E577AAEF78CB0BC700

Function 000000013FA684E8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,00000000,000000013FA68796,?,?,00000030,000000013FA68E08), ref: 000000013FA68664
GetProcAddress.KERNEL32(?,00000000,000000013FA68796,?,?,00000030,000000013FA68E08), ref: 000000013FA68670

Strings

ext-ms-, xrefs: 000000013FA685C1
api-ms-, xrefs: 000000013FA685AE

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 0ff21987e665f8d4942c95e68111f333ee23c6f90dc1472269bfea777c5e3f05
Instruction ID: 60e73354af1e05a9ebbfda0612d036f8fcfe69634b3f757c10edb1e7ccaa3f60
Opcode Fuzzy Hash: 0ff21987e665f8d4942c95e68111f333ee23c6f90dc1472269bfea777c5e3f05
Instruction Fuzzy Hash: 8B41D272B11A1081EA16CB16AA10BD637E9BF85BB0F49853D9D1E97794EF38CA47C304

Function 000000013FA5A92C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?,000000013FA5ABDE,?,?,?,000000013FA5A8D0,?,?,00000001,000000013FA575ED), ref: 000000013FA5A9B1
GetLastError.KERNEL32(?,?,?,000000013FA5ABDE,?,?,?,000000013FA5A8D0,?,?,00000001,000000013FA575ED), ref: 000000013FA5A9BF
LoadLibraryExW.KERNEL32(?,?,?,000000013FA5ABDE,?,?,?,000000013FA5A8D0,?,?,00000001,000000013FA575ED), ref: 000000013FA5A9E9
FreeLibrary.KERNEL32(?,?,?,000000013FA5ABDE,?,?,?,000000013FA5A8D0,?,?,00000001,000000013FA575ED), ref: 000000013FA5AA2F
GetProcAddress.KERNEL32(?,?,?,000000013FA5ABDE,?,?,?,000000013FA5A8D0,?,?,00000001,000000013FA575ED), ref: 000000013FA5AA3B

Strings

api-ms-, xrefs: 000000013FA5A9D1

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae15335fa6c61b048509c49a196b3e4ebd52445835e68971fd082157b79502c1
Instruction ID: bd3ccf37d2fb38151b0a8bc79935d5cb18218e36c2934c7f3af222ba29f562f6
Opcode Fuzzy Hash: ae15335fa6c61b048509c49a196b3e4ebd52445835e68971fd082157b79502c1
Instruction Fuzzy Hash: 7431F071B22B40D9EE12DB86A8047D533A4FB48BA0F59413D9E5E0B790EF38C647C710

Function 000000013FA47690 Relevance: 7.6, APIs: 5, Instructions: 131
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 000000013FA4774A
GetLastError.KERNEL32 ref: 000000013FA4775D
CreateFileW.KERNELBASE ref: 000000013FA477AD
GetLastError.KERNEL32 ref: 000000013FA477B6
SetFileTime.KERNEL32 ref: 000000013FA4781D

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 9e4bd7dc1d78f2eec6e2f3f86765b8b68f57d069d993987501a293f250e7639f
Instruction ID: cbbc0c242a9090eaa7954f0cde9b1c58ccecdc4a830f5c542f616e6a9f4f2f4c
Opcode Fuzzy Hash: 9e4bd7dc1d78f2eec6e2f3f86765b8b68f57d069d993987501a293f250e7639f
Instruction Fuzzy Hash: 9E51D332A0468086EB208B25E4557E97BA0F3857B8F541329DF6E27BD1CB7DC65A8B40

Function 000000013FA64E50 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000000013FA64F6C
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,000000013FA6ED1D), ref: 000000013FA64FF7

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: e90719db0a3677f1c5c5c75af093351ecd695ad417a6a7f727859d7f3e3c672d
Instruction ID: c7235b9f8b98897fd9aa7efd292d25fd3c63b83f5731c9dd918b02d33b5fd16c
Opcode Fuzzy Hash: e90719db0a3677f1c5c5c75af093351ecd695ad417a6a7f727859d7f3e3c672d
Instruction Fuzzy Hash: 8A91BC32F106508DFB609F6998907ED3BA0F785BA8F54512DDE0E67A89DB34CA87C700

Function 000000013FA54E2C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 000000013FA54E3B
__scrt_acquire_startup_lock.LIBCMT ref: 000000013FA54E50
__scrt_release_startup_lock.LIBCMT ref: 000000013FA54EBE
__scrt_get_show_window_mode.LIBCMT ref: 000000013FA54F11

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1333970121-0
Opcode ID: 506870551e74ba66f43a32b50561d502f5abb45002dcd2912f5178c8f1cd33c1
Instruction ID: e799edc7806cf93f21de656322e8d7095090f898b32ddbe3abc08693a4d156dd
Opcode Fuzzy Hash: 506870551e74ba66f43a32b50561d502f5abb45002dcd2912f5178c8f1cd33c1
Instruction Fuzzy Hash: 3F316035E01240C5FA24AB6AD469BE937919B85B48F84443DAD8E4B6E7DF68CB4BC310

Function 000000013FA4D818 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013FA4D920: FreeLibrary.KERNEL32(?,?,?,000000013FA4D811), ref: 000000013FA4D935

Part of subcall function 000000013FA4D954: RegOpenKeyExW.ADVAPI32 ref: 000000013FA4D9D9
Part of subcall function 000000013FA4D954: RegQueryValueExW.ADVAPI32 ref: 000000013FA4DA06
Part of subcall function 000000013FA4D954: RegQueryValueExW.ADVAPI32 ref: 000000013FA4DA62

GetVersionExW.KERNEL32 ref: 000000013FA4D895
LoadLibraryExW.KERNEL32 ref: 000000013FA4D8D0

Strings

rarlng.dll, xrefs: 000000013FA4D84D

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: LibraryQueryValue$FreeLoadOpenVersion
String ID: rarlng.dll
API String ID: 518641560-1675521814
Opcode ID: 8fc8f0e80092ea857dbb5572429849bdd6dbd36d0b8eec7680ff9d1c3c9282a3
Instruction ID: cff3f7acde5570cbce4ec327d97cfdb4ecb46583e6dc245a021fd4048cbb2c7c
Opcode Fuzzy Hash: 8fc8f0e80092ea857dbb5572429849bdd6dbd36d0b8eec7680ff9d1c3c9282a3
Instruction Fuzzy Hash: B221FF32A14A44D6FA20DB21E8613E977B0F785744F944039968D577A5DF3CDB5ACB00

Function 000000013FA4DB8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 000000013FA4DB55
LoadStringW.USER32 ref: 000000013FA4DB71

Strings

Process RAR, ZIP and other archive formats, xrefs: 000000013FA4DBAA

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: LoadString
String ID: Process RAR, ZIP and other archive formats
API String ID: 2948472770-1543766675
Opcode ID: 27196e2b612bc1e3c4a8521804f8a5637015dacf60a8f7efddfea519938ad03a
Instruction ID: de675459dd266dda09fad79dacd5bba0a9254ebae73dfda4bb52f0b40d528997
Opcode Fuzzy Hash: 27196e2b612bc1e3c4a8521804f8a5637015dacf60a8f7efddfea519938ad03a
Instruction Fuzzy Hash: 6E015EB1F1064086EB408F16E9447D5BBA1B789BC4F54843CCE0D97B25DE7CC6438B00

Function 000000013FA4A4F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?,?,80000001,000000013FA4F40A), ref: 000000013FA4A506
SHGetSpecialFolderLocation.SHELL32 ref: 000000013FA4A520

Part of subcall function 000000013FA4A58C: SHGetPathFromIDListW.SHELL32(?,?,?,?,?,?,00000000,000000013FA4A537,?,?,80000001,000000013FA4F40A), ref: 000000013FA4A5BC

Strings

WinRAR, xrefs: 000000013FA4A54C

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: FolderFromListLocationMallocPathSpecial
String ID: WinRAR
API String ID: 628029987-3970807970
Opcode ID: f442b72b01f6799e087adf63796d1bc45824a189814b0aa24eef02aa4cdb49b7
Instruction ID: 95a619d7639825674784ac59c4790e0ee41ccb889fc3aedd1c75a4afc1c87fa3
Opcode Fuzzy Hash: f442b72b01f6799e087adf63796d1bc45824a189814b0aa24eef02aa4cdb49b7
Instruction Fuzzy Hash: 46019E76A0064081EE14EF12F9413D97370E78ABD0F145039DE1E5775ADE38C64ACB00

Function 000000013FA4844C Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,000000013FA48531,?,?,?,?,000000013FA44D7D), ref: 000000013FA4848B
CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000013FA48531,?,?,?,?,000000013FA44D7D), ref: 000000013FA484D6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000013FA48531,?,?,?,?,000000013FA44D7D), ref: 000000013FA484F0

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 119d1b7c1e8ecb251e36dd25af98fd014e2dcece50bfe7be2aad24c3ca019ed5
Instruction ID: eef6b5cac4955808632b4e13205e5f6303dbfd816a1e3d7a464eda26ae8bff13
Opcode Fuzzy Hash: 119d1b7c1e8ecb251e36dd25af98fd014e2dcece50bfe7be2aad24c3ca019ed5
Instruction Fuzzy Hash: 33219032A0474082FB20EB25B5413EE73E1A7C5B80F554539EE8E677A6DF28CB478601

Function 000000013FA67860 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000000013FA678A2

Strings

, xrefs: 000000013FA678E5

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: d609b306aa90a6e86a120eb8bec561c599a7f558c6ee5cfc10257db2acb9f7fb
Instruction ID: 162b16f3cb54072bc3562420cd24e7ca1d6c2b0e615063a7d2e1afd27f6dbb22
Opcode Fuzzy Hash: d609b306aa90a6e86a120eb8bec561c599a7f558c6ee5cfc10257db2acb9f7fb
Instruction Fuzzy Hash: 3C51C373A286C08AE761CF34D0443DE7BE1F388759F94412AD78D43A85CB78C646CB40

Function 000000013FA687D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 000000013FA688A1

Strings

LCMapStringEx, xrefs: 000000013FA687EC, 000000013FA687FD

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 14163775033d92efcd0e7639a2b76caa422f1feb78f516e3bb7a962bfccaca7d
Instruction ID: 2ea536360f6ff644a5606e152d711defdf03bf74352c71c16d40900be74c5fd4
Opcode Fuzzy Hash: 14163775033d92efcd0e7639a2b76caa422f1feb78f516e3bb7a962bfccaca7d
Instruction Fuzzy Hash: 30212C35A08B8086D764CB56B84078AB7A5F7C8BD0F44412AEECD83B19DF38C5458B00

Function 000000013FA50E90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 000000013FA50EF8

Strings

Setup\%s, xrefs: 000000013FA50E95

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Open
String ID: Setup\%s
API String ID: 71445658-3923963727
Opcode ID: 834792c083aa9531ec049165a8bfdb2affc619c55bd8ffaaf1cb2faf1f413acc
Instruction ID: e87595866b9e7953545c757756b056b39e769f37da3cf0bf0a5adf972b0e9a3d
Opcode Fuzzy Hash: 834792c083aa9531ec049165a8bfdb2affc619c55bd8ffaaf1cb2faf1f413acc
Instruction Fuzzy Hash: 1E01843171868081EA50DB51E5557EAB760E794BC4F845039F98E87B65DF28C647CB00

Function 000000013FA461B4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 000000013FA461E8

Strings

unknown_folder, xrefs: 000000013FA461F8

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: FolderPath
String ID: unknown_folder
API String ID: 1514166925-3920786785
Opcode ID: 145e2e9d963d889d7e1754b5122d00a80c18d701d8f130c86778bcac917942fc
Instruction ID: 348a6e7c55bc765c9bc43e6d2022272e22f2e82d29ba002ee2df81b84645520e
Opcode Fuzzy Hash: 145e2e9d963d889d7e1754b5122d00a80c18d701d8f130c86778bcac917942fc
Instruction Fuzzy Hash: D6F03632714B8086EF208B65F9D9BDB77A4EB98784F4410399A8E07B55DF7CC25A8B00

Function 000000013FA67DEC Relevance: 3.2, APIs: 2, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 000000013FA67748: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,000000013FA67A84), ref: 000000013FA67772

IsValidCodePage.KERNEL32(?,?,?,00000001,?,00000000,?,000000013FA67BB5), ref: 000000013FA67E59
GetCPInfo.KERNEL32(?,?,?,00000001,?,00000000,?,000000013FA67BB5), ref: 000000013FA67E9D

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: bbc342652c04a1561528c405f5cf782d502d5ecce9fede569b84d28ff7a4694c
Instruction ID: be44c726d8afa4f8a25540333bb7ba208ae00c906e5ae82687b7fd4fe3d70d3a
Opcode Fuzzy Hash: bbc342652c04a1561528c405f5cf782d502d5ecce9fede569b84d28ff7a4694c
Instruction Fuzzy Hash: 0A81EE72A14680C6FB658F25E550BE9BBA1E784BA1F49413EDA8E076D0DB39CB47C310

Function 000000013FA4EAF8 Relevance: 3.1, APIs: 2, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 000000013FA4EB47
LoadLibraryW.KERNEL32 ref: 000000013FA4EBB1

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: d208f5da171bed4fcfaa80a060daddecaad378c7615b6e038c805bd4663b8183
Instruction ID: 8ee367b854d2dd40fbbe4f92f18f2a75d2019bc27ccffb2f71e1b33bbea5d944
Opcode Fuzzy Hash: d208f5da171bed4fcfaa80a060daddecaad378c7615b6e038c805bd4663b8183
Instruction Fuzzy Hash: CE210632B01944D5EB11EFB2D8A13ED3370E798784F811439990DA7B9AEE24CB4BC350

Function 000000013FA50830 Relevance: 3.1, APIs: 2, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32 ref: 000000013FA508C1
RegDeleteKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,80000000,000000013FA44369), ref: 000000013FA508CC

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Delete
String ID:
API String ID: 1035893169-0
Opcode ID: 7197f7c9a84460caba81b9a2fa45b8d2cb4c195b378382774d0ee6ef408dddaf
Instruction ID: 74ef1a0ee94176bd9e61324c745c4db60425428a8a05c6104e9b11b3d496e744
Opcode Fuzzy Hash: 7197f7c9a84460caba81b9a2fa45b8d2cb4c195b378382774d0ee6ef408dddaf
Instruction Fuzzy Hash: 6C117232A14A8091EA10DB52E415BDA73B1F789BC0F414139ED8D57B66DF28CB0BCB40

Function 000000013FA48728 Relevance: 3.0, APIs: 2, Instructions: 38fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 000000013FA4874C
DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 000000013FA48784

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 063e234ee543b75c609a2a2d665c9cac07cd632388d8e33a92bca93a9607434a
Instruction ID: 5f637d8b6e82b4c037a80e199d10a039b90003fdba867dc4afb38f246ac5b93c
Opcode Fuzzy Hash: 063e234ee543b75c609a2a2d665c9cac07cd632388d8e33a92bca93a9607434a
Instruction Fuzzy Hash: CE016732A0464192FA20DB21F4513EF73B4BB85BC4F440139AD8D57766EF28C7468B40

Function 000000013FA48610 Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,000000013FA485E9,?,?,?,?,000000013FA4DACC), ref: 000000013FA48634
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,000000013FA485E9,?,?,?,?,000000013FA4DACC), ref: 000000013FA4866A

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b9796f00f5f3e62c0cc3b9bf8d100f5eee812f57bc602c33e712cfebc6b799ae
Instruction ID: fe12f1f5049ed84ccc0f0bd5c65e285430bb1f699c272d26825ad1c88b91e4bb
Opcode Fuzzy Hash: b9796f00f5f3e62c0cc3b9bf8d100f5eee812f57bc602c33e712cfebc6b799ae
Instruction Fuzzy Hash: E1016232B0464082EA10EB61F4553EE73B1B7C9794F400639EA9E577A6DF68C7468B80

Function 000000013FA5774C Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__vcrt_FlsAlloc.LIBVCRUNTIME ref: 000000013FA57757
__vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 000000013FA57787

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Alloc__vcrt___vcrt_uninitialize_ptd
String ID:
API String ID: 3765095794-0
Opcode ID: cf9752706fb3b2d85260c216e82f7d6346addd2573ec072980270183322e8e90
Instruction ID: 9789379bf3e44810083bea3bc4ef821199bb2ab7812ebedc6ecb72dd86fef2b9
Opcode Fuzzy Hash: cf9752706fb3b2d85260c216e82f7d6346addd2573ec072980270183322e8e90
Instruction Fuzzy Hash: 3EE04F74E00604D8FA106B74EC4D3D53B602725321FA0027DD8AD971E2EB68C7078700

Function 000000013FA575E4 Relevance: 3.0, APIs: 2, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

__vcrt_initialize_locks.LIBVCRUNTIME ref: 000000013FA575E8

Part of subcall function 000000013FA5A8AC: __vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 000000013FA5A8CB

__vcrt_uninitialize_locks.LIBVCRUNTIME ref: 000000013FA575FE

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CriticalInitializeSection__vcrt___vcrt_initialize_locks__vcrt_uninitialize_locks
String ID:
API String ID: 4086592313-0
Opcode ID: 67f8ebb3a655a5d0760db362755270c6d8cc3ec891241b5d64b73321766c1e09
Instruction ID: a8a3f0f1bfe8403b13f96404cf369038bf3cd69e47955c905d20b98b696796a0
Opcode Fuzzy Hash: 67f8ebb3a655a5d0760db362755270c6d8cc3ec891241b5d64b73321766c1e09
Instruction Fuzzy Hash: EAD012B0E04248C0FC613AAA264E3F833481B22306F9010BCA9DC372C34B0A034B6932

Function 000000013FA51A5C Relevance: 1.6, APIs: 1, Instructions: 128comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 000000013FA51AA1

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 250c1967b7947a4e5db30bf88e72e085f1e1b3666d2b8087b75b39e9bad60602
Instruction ID: e2f3525ba12385133f67443ccbfc0d453633a657b95027a04fcffb3ec0d0ca22
Opcode Fuzzy Hash: 250c1967b7947a4e5db30bf88e72e085f1e1b3666d2b8087b75b39e9bad60602
Instruction Fuzzy Hash: 7F51F4BAB00B4485EB009F6AD8947ED33A5F748FC8F10842ACE5E57725EE39C64AC740

Function 000000013FA50534 Relevance: 1.6, APIs: 1, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32 ref: 000000013FA505DA

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 3c1d6ceced2890062a55d49d93a70a5e380d595c7b31ccd5b6b6402ce8271c82
Instruction ID: 1285586f87d0b706158362c22082409e2a23851085d800bddc2b9046ecff0ffa
Opcode Fuzzy Hash: 3c1d6ceced2890062a55d49d93a70a5e380d595c7b31ccd5b6b6402ce8271c82
Instruction Fuzzy Hash: 8221CC36704B8198EA64DF12A4487DE73A5FB99BC8F94803AEE8D43B60DF38C556D700

Function 000000013FA50CC8 Relevance: 1.6, APIs: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 000000013FA50D79

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: f9eeefa2a41b6c18c4bcefad43a8d6e0da4b2a279dcb1f6dbbe3020d78446531
Instruction ID: 37d8a84b0ce6f8dc927c624ad89e5591f18c12127fbebc7fc03a9dd10a52a200
Opcode Fuzzy Hash: f9eeefa2a41b6c18c4bcefad43a8d6e0da4b2a279dcb1f6dbbe3020d78446531
Instruction Fuzzy Hash: DA214132625A8091EA50DB21F4157DA77A0F7C57C0F845139EADE47BAADF29CA07DB00

Function 000000013FA48840 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013FA5FF45

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f75b6b23e85acd21aeef6088aa5ebbe3bea0ea50ee5a5f0a4c781c9bb3204dcc
Instruction ID: 451bf8cc2d264cf52a79dcf3abc17cc7f6fd8215d6f1449729ce024e361e2982
Opcode Fuzzy Hash: f75b6b23e85acd21aeef6088aa5ebbe3bea0ea50ee5a5f0a4c781c9bb3204dcc
Instruction Fuzzy Hash: 50219032E14640C1EE60AF5194047EDB2A0BB86B94F54443DEBDC57B86DB3DC6478B20

Function 000000013FA50758 Relevance: 1.6, APIs: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013FA50E90: RegOpenKeyExW.KERNEL32 ref: 000000013FA50EF8

RegQueryValueExW.ADVAPI32 ref: 000000013FA507FA

Part of subcall function 000000013FA50F30: RegCloseKey.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,000000013FA42A13), ref: 000000013FA50F3D

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: c4efccf40e05dff8761a4e7be21237d08091014ffb6ed155ea1aaa3c9e558b7e
Instruction ID: 0543261a72d2ed78ca30ee274547693495241812be5f809cd1e17ea1d3748878
Opcode Fuzzy Hash: c4efccf40e05dff8761a4e7be21237d08091014ffb6ed155ea1aaa3c9e558b7e
Instruction Fuzzy Hash: 3321D572B14B80C6EB408B42A4087CE7394F758BD0F548139EF8C17B55DB78DA02C740

Function 000000013FA6C640 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013FA6C663

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ae6c88fadc11fafcbe02f483e9e4b698663d53b01c8f0caa7853e87e7a3c4fd4
Instruction ID: 12e2b350124ff3519aa45c8b3e5291e055f456bc04524b659f91184898f919e7
Opcode Fuzzy Hash: ae6c88fadc11fafcbe02f483e9e4b698663d53b01c8f0caa7853e87e7a3c4fd4
Instruction Fuzzy Hash: 4521A83261468087DB629F19D44079976A1F7C4BA5F646238EB6D876D9DB39C902CB00

Function 000000013FA50DC4 Relevance: 1.6, APIs: 1, Instructions: 53registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32 ref: 000000013FA50E56

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0334126c3873f792f2fc5eaf72785f01b5800c288c9f76bb35a8979c5b6789e5
Instruction ID: 0d98a5767a1ca75fe9c8584ce9b78f969196552f26599fdf9a8380f8750bb2e6
Opcode Fuzzy Hash: 0334126c3873f792f2fc5eaf72785f01b5800c288c9f76bb35a8979c5b6789e5
Instruction Fuzzy Hash: C6114C72A0869182EB20DF52F4917DAB7A1F798794F504039AE8D83B55DB3CD61ACB00

Function 000000013FA50388 Relevance: 1.6, APIs: 1, Instructions: 52registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32 ref: 000000013FA50413

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 0cb685f65c0a7a0e1e37e3eca9e9cedcba49b88fc53fcde52ba4e27b57c02335
Instruction ID: afe31074a28f5f8bf6f029c812bdb58a3e5e2a377f18b2d537d688c611185ca8
Opcode Fuzzy Hash: 0cb685f65c0a7a0e1e37e3eca9e9cedcba49b88fc53fcde52ba4e27b57c02335
Instruction Fuzzy Hash: 0911A071B14781C6EA10DB53B5487EDB3A1B788FC0F448038AE8D57B66CF38D6028700

Function 000000013FA50458 Relevance: 1.5, APIs: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32 ref: 000000013FA504D7

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cbcd02c80306eb5c30c2ec56ea5594bf361163305aba3b834803e9f4bdb87ea8
Instruction ID: ff93a971d3386e7b050afdc560b977afe24f2a1cd9e8c08042f2cc0232b6d87a
Opcode Fuzzy Hash: cbcd02c80306eb5c30c2ec56ea5594bf361163305aba3b834803e9f4bdb87ea8
Instruction Fuzzy Hash: 0C11C471B1478086EB10CB52B9497ED73A5B748BC0F148039EE8D47B95DB38CA06C700

Function 000000013FA68EB4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013FA68EDF

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0875275f171a7a31bd08b644d176a746cdc9500c6c192686afbdff6ec71bb61
Instruction ID: fb6f0b90a20aceb7bbd19eed45a6721f114e7baff62bd6f4e3800952753859d6
Opcode Fuzzy Hash: d0875275f171a7a31bd08b644d176a746cdc9500c6c192686afbdff6ec71bb61
Instruction Fuzzy Hash: 25118832A1464082F7109F14E5403D9BBA9FB80BA0F55003DEA5D577A2DB78CA128B10

Function 000000013FA667E8 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,000000013FA629AA,?,?,0000BD129431FAD8,000000013FA62C11,?,?,?,?,000000013FA6DC2A,?,?,00000000), ref: 000000013FA6683D

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3de377a288751709d2d753e8fa0ee3b9e0c7d4ffae579bf188502d589b502302
Instruction ID: aa2e23540ebeb826df0563b665b51630bbb3441265b8c658b7f606d56158215a
Opcode Fuzzy Hash: 3de377a288751709d2d753e8fa0ee3b9e0c7d4ffae579bf188502d589b502302
Instruction Fuzzy Hash: EBF03A74F0160585FE555BB298653E576D49FC8BA4F4C943C8A0E8F3D2EE6CE7838260

Function 000000013FA49AAC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 000000013FA49B10: FindFirstFileW.KERNELBASE ref: 000000013FA49B5B
Part of subcall function 000000013FA49B10: FindFirstFileW.KERNELBASE ref: 000000013FA49B9C
Part of subcall function 000000013FA49B10: GetLastError.KERNEL32 ref: 000000013FA49BB5

FindClose.KERNEL32 ref: 000000013FA49AE1

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 244c18171c55cd05b08285cba3c131faabc899983e6720fe1d04a03a6beb305b
Instruction ID: 81ec27504d6f2a5d6e1cc66271278b26add5bb2a648f6481fff5cfbab2bf99bf
Opcode Fuzzy Hash: 244c18171c55cd05b08285cba3c131faabc899983e6720fe1d04a03a6beb305b
Instruction Fuzzy Hash: D5F090B2A0C28085EE50AF75A1063D83760AB1ABB4F184368DA7C177CBCB24C65BC715

Function 000000013FA4B994 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 000000013FA4D954: RegOpenKeyExW.ADVAPI32 ref: 000000013FA4D9D9
Part of subcall function 000000013FA4D954: RegQueryValueExW.ADVAPI32 ref: 000000013FA4DA06
Part of subcall function 000000013FA4D954: RegQueryValueExW.ADVAPI32 ref: 000000013FA4DA62

Part of subcall function 000000013FA4C2E0: FindResourceW.KERNEL32(?,?,?,?,000000013FA4B9DA), ref: 000000013FA4C2F8

SetProcessDefaultLayout.USER32 ref: 000000013FA4B9E8

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: QueryValue$DefaultFindLayoutOpenProcessResource
String ID:
API String ID: 2975701166-0
Opcode ID: ce358db20ef98a70b7721a141b0215e2e482cfe962ffb1492a86eac3695b9d7f
Instruction ID: c200f06bb05e828c8650cc37a0e3f69658708c0f831adf401339fd1137f14097
Opcode Fuzzy Hash: ce358db20ef98a70b7721a141b0215e2e482cfe962ffb1492a86eac3695b9d7f
Instruction Fuzzy Hash: 6FF06D32A1054082FA20AB21E4223D933B1FB89784F411039EA8D577A7EE2CCB0BCB00

Function 000000013FA509D0 Relevance: 1.5, APIs: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013FA50E90: RegOpenKeyExW.KERNEL32 ref: 000000013FA50EF8

RegQueryValueExW.KERNEL32 ref: 000000013FA50A0E

Part of subcall function 000000013FA50F30: RegCloseKey.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,000000013FA42A13), ref: 000000013FA50F3D

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: b28d6e5ef8a0bada95eb7f6cd82cbf3fa9bb0c92fab4ca71622e637ded223263
Instruction ID: cce5cb297e915a7480e50b23f2b240d03ec7bc7e1c95cbba7a4a2d6485d3ae22
Opcode Fuzzy Hash: b28d6e5ef8a0bada95eb7f6cd82cbf3fa9bb0c92fab4ca71622e637ded223263
Instruction Fuzzy Hash: 26F0B433B2474286EA549761B1587AAB3D0AB887D4F448438FF8C07B65EF3CC5068B00

Function 000000013FA50F30 Relevance: 1.5, APIs: 1, Instructions: 13registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,000000013FA42A13), ref: 000000013FA50F3D

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 87a8160b2385b7052fa0bddc8138c7931c27e6b833a69534fc4c5103b51b5e89
Instruction ID: 769a3f6ed3e61f8b1f4af17cae1b2f0f6c0ee40ee9784cd0b9bf7ee7d2a7e1be
Opcode Fuzzy Hash: 87a8160b2385b7052fa0bddc8138c7931c27e6b833a69534fc4c5103b51b5e89
Instruction Fuzzy Hash: DFC01220B0A202CAFA682AE2149A7A022A40B24302E08A0B8CC9D06250D2049A9F6A30

Non-executed Functions

Function 000000013FA4C7E0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 277windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013FA4EC84: WideCharToMultiByte.KERNEL32 ref: 000000013FA4ECB5

SetDlgItemTextW.USER32 ref: 000000013FA4C89A
GetWindowRect.USER32 ref: 000000013FA4C8CE
GetClientRect.USER32 ref: 000000013FA4C8DC
GetWindowLongPtrW.USER32 ref: 000000013FA4C980
SetWindowPos.USER32 ref: 000000013FA4C9B8
GetWindowRect.USER32 ref: 000000013FA4C9C6
SetWindowTextW.USER32 ref: 000000013FA4CA02
GetSystemMetrics.USER32 ref: 000000013FA4CA0D
GetWindow.USER32 ref: 000000013FA4CA1E
GetWindowRect.USER32 ref: 000000013FA4CA57
GetClassNameW.USER32 ref: 000000013FA4CB05
GetWindowLongW.USER32 ref: 000000013FA4CB28
SendMessageW.USER32 ref: 000000013FA4CB43
SetWindowPos.USER32 ref: 000000013FA4CB89
GetWindow.USER32 ref: 000000013FA4CB97

Strings

CAPTION, xrefs: 000000013FA4C9E5
COMBOBOX, xrefs: 000000013FA4CB0B
$%s:, xrefs: 000000013FA4C822

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Window$Rect$LongText$ByteCharClassClientItemMessageMetricsMultiNameSendSystemWide
String ID: $%s:$CAPTION$COMBOBOX
API String ID: 1955950163-420924974
Opcode ID: 6538b7537d9744e663b9209f056bddb7a1244888f7b5beb2aab799001cc52a56
Instruction ID: 39880296ba947f3999ff43ad33065097223f30aab469769ca1fdda94e0dd6da7
Opcode Fuzzy Hash: 6538b7537d9744e663b9209f056bddb7a1244888f7b5beb2aab799001cc52a56
Instruction Fuzzy Hash: D0B1C532B146404BEB18DF69E8547EA7BA1F384B84F445029EE4E5BB59DF3CDA06CB40

Function 000000013FA55298 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000000013FA552B4
RtlCaptureContext.KERNEL32 ref: 000000013FA552E1
RtlLookupFunctionEntry.KERNEL32 ref: 000000013FA552FB
RtlVirtualUnwind.KERNEL32 ref: 000000013FA5533C
IsDebuggerPresent.KERNEL32 ref: 000000013FA55390
SetUnhandledExceptionFilter.KERNEL32 ref: 000000013FA553B1
UnhandledExceptionFilter.KERNEL32 ref: 000000013FA553BC

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 612d4024f7f14bdabea5988eae53a56f9fd5274ba911ab0d7eb538ae21b424af
Instruction ID: d019a02b67246e3093fc28c27d9b9c22ff223a7c7464a9289cb73ba88f580344
Opcode Fuzzy Hash: 612d4024f7f14bdabea5988eae53a56f9fd5274ba911ab0d7eb538ae21b424af
Instruction Fuzzy Hash: 7B315E72615B80CAEB608FA0E8547ED73B4F784748F44442EDA8E47B98DF38C649CB10

Function 000000013FA5AE38 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000000013FA5AEB1
RtlLookupFunctionEntry.KERNEL32 ref: 000000013FA5AEC9
RtlVirtualUnwind.KERNEL32 ref: 000000013FA5AF04
IsDebuggerPresent.KERNEL32 ref: 000000013FA5AF3D
SetUnhandledExceptionFilter.KERNEL32 ref: 000000013FA5AF47
UnhandledExceptionFilter.KERNEL32 ref: 000000013FA5AF52

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 22a8a8918700894889141e66ab020d1d3935d4b281343a48718a2dfde1590204
Instruction ID: 3f8958510c4e9f9ca46d6cc8562b25e7c953f1421b88dc9433244673c0580de5
Opcode Fuzzy Hash: 22a8a8918700894889141e66ab020d1d3935d4b281343a48718a2dfde1590204
Instruction Fuzzy Hash: F9316032614F8086DB60CF65E8447DE73B4F788758F54012AEA8D43B99DF38C65ACB00

Function 000000013FA4853C Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,000000013FA47B54), ref: 000000013FA4859F

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: a6540a61208f146433847296f128e9269bc552dd4a353a3d2ecd1adfb1b2af06
Instruction ID: 38d966134aeaa167e36e53a1c1d79f0df3514f55c07da2c813fee1848c98c02f
Opcode Fuzzy Hash: a6540a61208f146433847296f128e9269bc552dd4a353a3d2ecd1adfb1b2af06
Instruction Fuzzy Hash: 4F112B32B0060499FB00DBA5E4513DD37B4A748788F881039DE1D67756DA24CA96C750

Function 000000013FA424DC Relevance: 37.7, APIs: 25, Instructions: 159COMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32 ref: 000000013FA424F1
IsDlgButtonChecked.USER32 ref: 000000013FA42506
IsDlgButtonChecked.USER32 ref: 000000013FA4251C
IsDlgButtonChecked.USER32 ref: 000000013FA42532
IsDlgButtonChecked.USER32 ref: 000000013FA42548
IsDlgButtonChecked.USER32 ref: 000000013FA4255E
IsDlgButtonChecked.USER32 ref: 000000013FA42574
IsDlgButtonChecked.USER32 ref: 000000013FA4258A
IsDlgButtonChecked.USER32 ref: 000000013FA425A0
IsDlgButtonChecked.USER32 ref: 000000013FA425B6
IsDlgButtonChecked.USER32 ref: 000000013FA425CC
IsDlgButtonChecked.USER32 ref: 000000013FA425E2
IsDlgButtonChecked.USER32 ref: 000000013FA425F8
IsDlgButtonChecked.USER32 ref: 000000013FA4260E
IsDlgButtonChecked.USER32 ref: 000000013FA42624
IsDlgButtonChecked.USER32 ref: 000000013FA4263A
IsDlgButtonChecked.USER32 ref: 000000013FA42650
IsDlgButtonChecked.USER32 ref: 000000013FA42666
IsDlgButtonChecked.USER32 ref: 000000013FA4267C
IsDlgButtonChecked.USER32 ref: 000000013FA42692
IsDlgButtonChecked.USER32 ref: 000000013FA426A8
IsDlgButtonChecked.USER32 ref: 000000013FA426BE
IsDlgButtonChecked.USER32 ref: 000000013FA426D4
IsDlgButtonChecked.USER32 ref: 000000013FA426EA
IsDlgButtonChecked.USER32 ref: 000000013FA42700

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ButtonChecked
String ID:
API String ID: 1719414920-0
Opcode ID: f9d8ab637eb24184b32b57c176e8d714b3476a1fca790ed65686e66c6b25a53b
Instruction ID: 1fe3bb47f0a02b122ca7903a947c0ff478a0acb32e6f61b05218b03097efff6e
Opcode Fuzzy Hash: f9d8ab637eb24184b32b57c176e8d714b3476a1fca790ed65686e66c6b25a53b
Instruction Fuzzy Hash: DA514821B077C1D7E7098FBAA52478E25AEEB44755F18C0389E5243B56DF2CCAAEC710

Function 000000013FA42720 Relevance: 37.6, APIs: 25, Instructions: 134COMMON

Download Yara Rule

APIs

CheckDlgButton.USER32 ref: 000000013FA4273E
CheckDlgButton.USER32 ref: 000000013FA42751
CheckDlgButton.USER32 ref: 000000013FA42764
CheckDlgButton.USER32 ref: 000000013FA42777
CheckDlgButton.USER32 ref: 000000013FA4278A
CheckDlgButton.USER32 ref: 000000013FA4279D
CheckDlgButton.USER32 ref: 000000013FA427B0
CheckDlgButton.USER32 ref: 000000013FA427C3
CheckDlgButton.USER32 ref: 000000013FA427D6
CheckDlgButton.USER32 ref: 000000013FA427E9
CheckDlgButton.USER32 ref: 000000013FA427FC
CheckDlgButton.USER32 ref: 000000013FA4280F
CheckDlgButton.USER32 ref: 000000013FA42822
CheckDlgButton.USER32 ref: 000000013FA42835
CheckDlgButton.USER32 ref: 000000013FA42848
CheckDlgButton.USER32 ref: 000000013FA4285B
CheckDlgButton.USER32 ref: 000000013FA4286E
CheckDlgButton.USER32 ref: 000000013FA42881
CheckDlgButton.USER32 ref: 000000013FA42894
CheckDlgButton.USER32 ref: 000000013FA428A7
CheckDlgButton.USER32 ref: 000000013FA428BA
CheckDlgButton.USER32 ref: 000000013FA428CD
CheckDlgButton.USER32 ref: 000000013FA428E0
CheckDlgButton.USER32 ref: 000000013FA428F5
CheckDlgButton.USER32 ref: 000000013FA42906

Part of subcall function 000000013FA410F0: GetDlgItem.USER32 ref: 000000013FA410FA

Part of subcall function 000000013FA49FD8: GetVersionExW.KERNEL32 ref: 000000013FA4A00A

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ButtonCheck$ItemVersion
String ID:
API String ID: 2185970780-0
Opcode ID: 0de064b7d3677288e546893f392448c3059468422443991210ac89a973ff9831
Instruction ID: 2338bac15e7f7c0a5c4111f0b1f97c6479108a59a0c55ef801dbdb3ea7a6f3ea
Opcode Fuzzy Hash: 0de064b7d3677288e546893f392448c3059468422443991210ac89a973ff9831
Instruction Fuzzy Hash: 63515231B182E143F7255F72A42079E7B66E786F49F044124DD8647F9ADF2D86178710

Function 000000013FA464B0 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 260COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 000000013FA46543

Part of subcall function 000000013FA41114: GetDlgItem.USER32 ref: 000000013FA41118

IsDlgButtonChecked.USER32 ref: 000000013FA46561
IsDlgButtonChecked.USER32 ref: 000000013FA465D2
GetDlgItemTextW.USER32 ref: 000000013FA4663B
CheckDlgButton.USER32 ref: 000000013FA4676E
CheckDlgButton.USER32 ref: 000000013FA467F5
SetDlgItemTextW.USER32 ref: 000000013FA46873
GetDlgItem.USER32 ref: 000000013FA46880

Strings

AlwaysArc, xrefs: 000000013FA46650, 000000013FA4681B
SETUPCONTEXTITEMS, xrefs: 000000013FA464F9
HELPContextItems, xrefs: 000000013FA464ED
Setup\MenuItems, xrefs: 000000013FA46577, 000000013FA46661, 000000013FA467C8, 000000013FA4682D
Setup\TopMenuItems, xrefs: 000000013FA465E7, 000000013FA46724

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ButtonItem$CheckCheckedText$Dialog
String ID: AlwaysArc$HELPContextItems$SETUPCONTEXTITEMS$Setup\MenuItems$Setup\TopMenuItems
API String ID: 1934181330-3208996673
Opcode ID: 2bdda98e59e8a188823461f89e70ef37dd36baef0cc151e82424f98d8931dbca
Instruction ID: 44db56f6923b7d44745f9cfc3393f70b248c305143d753827cde3e024932643c
Opcode Fuzzy Hash: 2bdda98e59e8a188823461f89e70ef37dd36baef0cc151e82424f98d8931dbca
Instruction Fuzzy Hash: 04B18C32A10A41A2EB00DB65D8907ED77B1F785344F90503ADA4D63BAAEF38DB0BC740

Function 000000013FA43B00 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 109synchronizationCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32 ref: 000000013FA43C21
WaitForSingleObject.KERNEL32 ref: 000000013FA43C38
CloseHandle.KERNEL32 ref: 000000013FA43C42

Strings

NewContextMenu, xrefs: 000000013FA43C48
Setup, xrefs: 000000013FA43C59
-install -extall, xrefs: 000000013FA43BEF
RarExtInstaller.exe, xrefs: 000000013FA43B71
-Uninstall, xrefs: 000000013FA43C04
RarExtPackage.msix, xrefs: 000000013FA43B38
-install, xrefs: 000000013FA43BF6
@, xrefs: 000000013FA43BDD
p, xrefs: 000000013FA43BD1

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CloseExecuteHandleObjectShellSingleWait
String ID: -Uninstall$-install$-install -extall$@$NewContextMenu$RarExtInstaller.exe$RarExtPackage.msix$Setup$p
API String ID: 3837156514-3709660866
Opcode ID: 7e93bfabf9090363ca603b1bd5bed5fe911c43080d95a3a9ed5f41ae4d71bd59
Instruction ID: 3c2954e6e81deb5e531a4a7808f689de0d4cdd21533e16245c3385be0052e5cb
Opcode Fuzzy Hash: 7e93bfabf9090363ca603b1bd5bed5fe911c43080d95a3a9ed5f41ae4d71bd59
Instruction Fuzzy Hash: A4410D72B50A40A9FB10EF60D8517ED33B1E79474CF8150399A4E57AA9EF24CB0BC340

Function 000000013FA54AA0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000000013FA54AB6
GetModuleHandleW.KERNEL32 ref: 000000013FA54AC3
GetModuleHandleW.KERNEL32 ref: 000000013FA54AD8
GetProcAddress.KERNEL32 ref: 000000013FA54AF0
GetProcAddress.KERNEL32 ref: 000000013FA54B03
CreateEventW.KERNEL32 ref: 000000013FA54B2F
DeleteCriticalSection.KERNEL32 ref: 000000013FA54B7B
CloseHandle.KERNEL32 ref: 000000013FA54B8D

Strings

kernel32.dll, xrefs: 000000013FA54AD1
api-ms-win-core-synch-l1-2-0.dll, xrefs: 000000013FA54ABC
SleepConditionVariableCS, xrefs: 000000013FA54AE6
WakeAllConditionVariable, xrefs: 000000013FA54AF6

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: ea39b9d3a45375645a710de0d40b2cb44fe158dd939409e827fc684225a6d213
Instruction ID: 0fce37be6db03e34b61e07bd6b26d268945f0f4b66ac9cfebf476e31af110317
Opcode Fuzzy Hash: ea39b9d3a45375645a710de0d40b2cb44fe158dd939409e827fc684225a6d213
Instruction Fuzzy Hash: B921FA34E12A41C1FE549BA1F8A8BE577A1BB44750F88113DDD4F03AA4EF28C75B8710

Function 000000013FA52720 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 163windowCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 000000013FA527F8

Part of subcall function 000000013FA4DB8C: LoadStringW.USER32 ref: 000000013FA4DB55
Part of subcall function 000000013FA4DB8C: LoadStringW.USER32 ref: 000000013FA4DB71

EndDialog.USER32 ref: 000000013FA52898
SendMessageW.USER32 ref: 000000013FA528BB
SendDlgItemMessageW.USER32 ref: 000000013FA528DA
SendMessageW.USER32 ref: 000000013FA529A8

Strings

rarreg.key, xrefs: 000000013FA528E0, 000000013FA52927
DONEDLG, xrefs: 000000013FA52757
WinRAR.exe, xrefs: 000000013FA5286E
License.txt, xrefs: 000000013FA5283B
order.htm, xrefs: 000000013FA52803
open, xrefs: 000000013FA527EF

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: MessageSend$LoadString$DialogExecuteItemShell
String ID: DONEDLG$License.txt$WinRAR.exe$open$order.htm$rarreg.key
API String ID: 1810245377-3354913336
Opcode ID: 4e8e7ae967622b0db637f84a1eb5b4b398e7f23c8492858c0ab334fdf474ba1b
Instruction ID: 98f0deae31e0f514f33b5b81b8a27b5c6abfc57d160966ac8cd85134cacc0624
Opcode Fuzzy Hash: 4e8e7ae967622b0db637f84a1eb5b4b398e7f23c8492858c0ab334fdf474ba1b
Instruction Fuzzy Hash: 4E614C32A0064095FB28EFA5D9557EC37A1E785788F40403DDA4E6BB96DF29DB4BC340

Function 000000013FA51568 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 228libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000000013FA515F6
GetDesktopWindow.USER32 ref: 000000013FA5165A
GetShortPathNameW.KERNEL32 ref: 000000013FA517E0
GetShortPathNameW.KERNEL32 ref: 000000013FA5181D

Strings

hhctrl.ocx, xrefs: 000000013FA515C6
HtmlHelpW, xrefs: 000000013FA515EC
::/html/, xrefs: 000000013FA516C9
.htm, xrefs: 000000013FA5170F
winrar.chm, xrefs: 000000013FA51603

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: NamePathShort$AddressDesktopProcWindow
String ID: .htm$::/html/$HtmlHelpW$hhctrl.ocx$winrar.chm
API String ID: 3733684519-3807848278
Opcode ID: 03d21b9d154919de187d96e892aac703863466a068bfd16c4a3369779880b0e0
Instruction ID: 2db74a32f4fbed36f9ac24c1f46db3fe6d4e92c5f1ef28bee0448edb9513949d
Opcode Fuzzy Hash: 03d21b9d154919de187d96e892aac703863466a068bfd16c4a3369779880b0e0
Instruction Fuzzy Hash: 69A18E32F1094096FB10EBA1D8953EC33A1A795798F405639D94E67BE6EF28C70BC340

Function 000000013FA5B5E4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013FA5B624
_invalid_parameter_noinfo.LIBCMT ref: 000000013FA5B9EC
_invalid_parameter_noinfo.LIBCMT ref: 000000013FA5BC8B

Strings

f, xrefs: 000000013FA5B726
f, xrefs: 000000013FA5B6BC
f, xrefs: 000000013FA5B871
p, xrefs: 000000013FA5B72E
p, xrefs: 000000013FA5B6C9

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 918110c4f9f180979157d3e61df1fb092bde457b5c786976cc7a193decc9b109
Instruction ID: c752d45f7c2efac41f07b91cd7b300f006fa15e7e4a5c62b9f587c56a3844038
Opcode Fuzzy Hash: 918110c4f9f180979157d3e61df1fb092bde457b5c786976cc7a193decc9b109
Instruction Fuzzy Hash: 6312B376E08141C6FB649E55E04C7F9B6E2F3807D6F94412AE6CE47BD8D738CA828B14

Function 000000013FA580EC Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000000013FA58149

Part of subcall function 000000013FA5A3E4: __GetUnwindTryBlock.LIBCMT ref: 000000013FA5A427
Part of subcall function 000000013FA5A3E4: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000000013FA5A44C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000000013FA58221
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000000013FA58476
std::bad_alloc::bad_alloc.LIBCMT ref: 000000013FA58582

Strings

csm, xrefs: 000000013FA581CA
csm, xrefs: 000000013FA58244
csm, xrefs: 000000013FA58163

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 86107186efc731f63c471ce2a910a7739a646a68a99b995652a66406ce9e25c1
Instruction ID: ff70bb51494bf5ed6af5b51873b255aaf7d577335d899ae286e93be792fdf5e7
Opcode Fuzzy Hash: 86107186efc731f63c471ce2a910a7739a646a68a99b995652a66406ce9e25c1
Instruction Fuzzy Hash: 22E18D72A04B44CAEB20DF65E5893DD7BA4F745B98F144229EECD57B9ACB34C682C700

Function 000000013FA4D954 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000000013FA4D9D9
RegQueryValueExW.ADVAPI32 ref: 000000013FA4DA06
RegQueryValueExW.ADVAPI32 ref: 000000013FA4DA62
RegCloseKey.ADVAPI32 ref: 000000013FA4DAF4

Strings

LanguageFolder, xrefs: 000000013FA4D9FB, 000000013FA4DA57
Software\WinRAR\General, xrefs: 000000013FA4D9CB
LngFolder0, xrefs: 000000013FA4D9A4

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: LanguageFolder$LngFolder0$Software\WinRAR\General
API String ID: 1586453840-1245967352
Opcode ID: f59093d3a318ac0f2855b01a6632a7d805f5c0b6e2d13faf31636cd8fe75cc1f
Instruction ID: f4c0215eed86ce45097443ddceae099f10ac5bbeed2fa9698c7392b62b243e5b
Opcode Fuzzy Hash: f59093d3a318ac0f2855b01a6632a7d805f5c0b6e2d13faf31636cd8fe75cc1f
Instruction Fuzzy Hash: B1413432B1590099FB10EBB1D4517ED33B1EB98788F4051399E4EA7BA9EE28C74BC750

Function 000000013FA539B4 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 81COMMON

Download Yara Rule

APIs

SHChangeNotify.SHELL32 ref: 000000013FA539FB

Part of subcall function 000000013FA43804: SHChangeNotify.SHELL32 ref: 000000013FA43ACC

Part of subcall function 000000013FA50830: RegDeleteKeyW.ADVAPI32 ref: 000000013FA508C1

Part of subcall function 000000013FA50830: RegDeleteKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,80000000,000000013FA44369), ref: 000000013FA508CC

Strings

WinRAR.REV, xrefs: 000000013FA53A5E
\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WinRAR.exe, xrefs: 000000013FA53AC3
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinRAR archiver, xrefs: 000000013FA53A95
WinRAR.ZIP, xrefs: 000000013FA53A4F
.rev, xrefs: 000000013FA53A6D
WinRAR, xrefs: 000000013FA53A39

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ChangeDeleteNotify
String ID: .rev$WinRAR$WinRAR.REV$WinRAR.ZIP$\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WinRAR.exe$\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinRAR archiver
API String ID: 3372569710-753117775
Opcode ID: 770402fac772db25c45765877efd48a45866dcba2743461567665e7f4a3ec9e1
Instruction ID: 1289ece6b2a18eea14a24e283f9dc542ec1c24f1751ece3bc14a4b77eed40301
Opcode Fuzzy Hash: 770402fac772db25c45765877efd48a45866dcba2743461567665e7f4a3ec9e1
Instruction Fuzzy Hash: 4B313F72F20A1194FB00EBB4DC51BED3371A794798F855039995E677AADF64C74AC300

Function 000000013FA51F9C Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 211sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 000000013FA521BB

Strings

noexplorer, xrefs: 000000013FA521CC
wait, xrefs: 000000013FA521A3
warning, xrefs: 000000013FA521E9
init, xrefs: 000000013FA52171
extall, xrefs: 000000013FA52070
msi, xrefs: 000000013FA5214C
setup, xrefs: 000000013FA5212A

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Sleep
String ID: extall$init$msi$noexplorer$setup$wait$warning
API String ID: 3472027048-3182653736
Opcode ID: f842f864596803cfa88902f8cf2d33cbb6b14615db1a07561ef49b42e302d54e
Instruction ID: 2b2760eb5bd355e348eb89a5df8640ee5c03810e15e1f97f38a3b174dd65f790
Opcode Fuzzy Hash: f842f864596803cfa88902f8cf2d33cbb6b14615db1a07561ef49b42e302d54e
Instruction Fuzzy Hash: 9D818571B0564090FA20EB62D8557EE77A1AB94784F40503DAE4EA77DAEF28CB4BC350

Function 000000013FA6BE7C Relevance: 10.8, APIs: 7, Instructions: 290COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013FA6C2A9

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 22afc90d2ec416ddfb1f31815257910a1631523b1aaf3cc3bac322a63677a082
Instruction ID: 3f24e0f6c543a3b297f3060aa15f3855a99fb1c6f937c2326b58d6bd7db8dc6b
Opcode Fuzzy Hash: 22afc90d2ec416ddfb1f31815257910a1631523b1aaf3cc3bac322a63677a082
Instruction Fuzzy Hash: 5EC1F232A04B8581EB60AB6594443EE3BA1F7C1BE5F954139EE4E037D2DB79CA4B8700

Function 000000013FA49D7C Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 000000013FA49DB0
CoSetProxyBlanket.OLE32 ref: 000000013FA49E45

Part of subcall function 000000013FA4A098: SysFreeString.OLEAUT32 ref: 000000013FA4A0F5

VariantClear.OLEAUT32 ref: 000000013FA49F58

Strings

WQL, xrefs: 000000013FA49E81
Name, xrefs: 000000013FA49F33
SELECT * FROM Win32_OperatingSystem, xrefs: 000000013FA49E65

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: BlanketClearCreateFreeInstanceProxyStringVariant
String ID: Name$SELECT * FROM Win32_OperatingSystem$WQL
API String ID: 1619944124-3970706604
Opcode ID: 82c572e6526df74e39f08359baa425f18f845bbca955219d631614638e6115b2
Instruction ID: 93b6dce7c1420c6a12dda9a35e4818da89f4860060a5334a97aeb70a6aa6a7f3
Opcode Fuzzy Hash: 82c572e6526df74e39f08359baa425f18f845bbca955219d631614638e6115b2
Instruction Fuzzy Hash: 5C711A36615B45D5EB10DF69E8907DD73A4F788B88F40412AEE4E97B68DF38C61ACB00

Function 000000013FA540A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000000013FA54127
MultiByteToWideChar.KERNEL32 ref: 000000013FA541A9
SysAllocString.OLEAUT32 ref: 000000013FA541B6

Strings

SELECT * FROM Win32_OperatingSystem, xrefs: 000000013FA540A6

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID: SELECT * FROM Win32_OperatingSystem
API String ID: 262959230-522155302
Opcode ID: b97cd699669659a6b4b244d3dafff1a66f46610d3474d65fc75facd8b81971d4
Instruction ID: 5813eb01b67b309d7d9f12246a4da3902baec89b03cada290df6e7e5a22ec880
Opcode Fuzzy Hash: b97cd699669659a6b4b244d3dafff1a66f46610d3474d65fc75facd8b81971d4
Instruction Fuzzy Hash: 0541A371A00744C9EB149F72A8247E936D4FB44BA4F14463CAEAE877D5DF78C6978700

Function 000000013FA4A5F4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000000013FA4A637
RegQueryValueExW.ADVAPI32 ref: 000000013FA4A665
RegQueryValueExW.ADVAPI32 ref: 000000013FA4A6A7
RegCloseKey.ADVAPI32 ref: 000000013FA4A6C5

Strings

Software\WinRAR\Paths, xrefs: 000000013FA4A629
AppData, xrefs: 000000013FA4A65A, 000000013FA4A69C

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: AppData$Software\WinRAR\Paths
API String ID: 1586453840-3415417297
Opcode ID: 7ea94a5ab615e7167d612436de936715c50d4b06d05bb809f09725913d83a1da
Instruction ID: fe8058bf7d59abb15fcfaecc0bf50fb00c91b8e9e5b3544a98cc11ccbb40ebeb
Opcode Fuzzy Hash: 7ea94a5ab615e7167d612436de936715c50d4b06d05bb809f09725913d83a1da
Instruction Fuzzy Hash: 1B31FD32B10A1085FB10EFA1E852BDD73B4BB95B98F405139AD5E67B96DF28C647C700

Function 000000013FA627D0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000013FA627DF
FlsGetValue.KERNEL32 ref: 000000013FA627F4
FlsSetValue.KERNEL32 ref: 000000013FA62815
FlsSetValue.KERNEL32 ref: 000000013FA62842
FlsSetValue.KERNEL32 ref: 000000013FA62853
FlsSetValue.KERNEL32 ref: 000000013FA62864
SetLastError.KERNEL32 ref: 000000013FA6287F

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 64d8b6d2fa1f20503ea5e12ef57315d09cff250f3b32b9b17cd815889d89d66a
Instruction ID: 3e7f7a82e468146d9ee402e8ecca0bee89c1ff94929d1b1dbb490a27bc84fce4
Opcode Fuzzy Hash: 64d8b6d2fa1f20503ea5e12ef57315d09cff250f3b32b9b17cd815889d89d66a
Instruction Fuzzy Hash: 30216730E4164042FE6967615E557EE76EA5FC47B0F144B3CAA3E4BBD6EE2CA6034300

Function 000000013FA6EA1C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000000013FA6EA4D
GetLastError.KERNEL32 ref: 000000013FA6EA59
CloseHandle.KERNEL32 ref: 000000013FA6EA71
CreateFileW.KERNEL32 ref: 000000013FA6EA9C
WriteConsoleW.KERNEL32 ref: 000000013FA6EABB

Strings

CONOUT$, xrefs: 000000013FA6EA7D

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 524c1238896a24298de38ba156bc34f1697fc9d3054d7a6538b84981dae55f09
Instruction ID: 988769459657a9fca1edf793a97ca61ea2d80c859e43f2d6bc0021fe8877b72b
Opcode Fuzzy Hash: 524c1238896a24298de38ba156bc34f1697fc9d3054d7a6538b84981dae55f09
Instruction Fuzzy Hash: 58119031B24B4086F7508B52F894B59B6A4F798FE4F140238EE5E87B94DF7CC6498B44

Function 000000013FA4EAA4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000000013FA4EAB1
GetProcAddress.KERNEL32 ref: 000000013FA4EAC9
GetProcAddress.KERNEL32 ref: 000000013FA4EAEB

Strings

SetDefaultDllDirectories, xrefs: 000000013FA4EAE1
SetDllDirectoryW, xrefs: 000000013FA4EABF
kernel32, xrefs: 000000013FA4EAAA

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 667068680-1824683568
Opcode ID: 44525a4faca62f4414b76b31e444f96628f226f460dce766c84114fcf7f9ea35
Instruction ID: 4151bd4deeb6ade5aa226c3f12a35112d63a92fd33c738d967a33cb78e5f3fe3
Opcode Fuzzy Hash: 44525a4faca62f4414b76b31e444f96628f226f460dce766c84114fcf7f9ea35
Instruction Fuzzy Hash: E1E0C970A51A4191FE149B96AC68BE033A1FB58745F44003DC80F03361EE6CD78FC720

Function 000000013FA585C4 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 316COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000000013FA58762
std::bad_alloc::bad_alloc.LIBCMT ref: 000000013FA58A85

Strings

csm, xrefs: 000000013FA586A9
csm, xrefs: 000000013FA58789
csm, xrefs: 000000013FA5870B

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: e23b0d52ab4e95c5317352a92a95699e4d7113afaceee32e9ae3998c479be248
Instruction ID: c70affe82fb5286213af85d84ea4d43f654b9241eff86ec2712cedda1e33bbc6
Opcode Fuzzy Hash: e23b0d52ab4e95c5317352a92a95699e4d7113afaceee32e9ae3998c479be248
Instruction Fuzzy Hash: 05E1AE72A00784CAEB20DF69D4883ED3BA0F744798F154229EECD57BA6DB34C686C700

Function 000000013FA62948 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0000BD129431FAD8,000000013FA62C11,?,?,?,?,000000013FA6DC2A,?,?,00000000,000000013FA684AF,?,?,?), ref: 000000013FA62957
FlsSetValue.KERNEL32(?,?,0000BD129431FAD8,000000013FA62C11,?,?,?,?,000000013FA6DC2A,?,?,00000000,000000013FA684AF,?,?,?), ref: 000000013FA6298D
FlsSetValue.KERNEL32(?,?,0000BD129431FAD8,000000013FA62C11,?,?,?,?,000000013FA6DC2A,?,?,00000000,000000013FA684AF,?,?,?), ref: 000000013FA629BA
FlsSetValue.KERNEL32(?,?,0000BD129431FAD8,000000013FA62C11,?,?,?,?,000000013FA6DC2A,?,?,00000000,000000013FA684AF,?,?,?), ref: 000000013FA629CB
FlsSetValue.KERNEL32(?,?,0000BD129431FAD8,000000013FA62C11,?,?,?,?,000000013FA6DC2A,?,?,00000000,000000013FA684AF,?,?,?), ref: 000000013FA629DC
SetLastError.KERNEL32(?,?,0000BD129431FAD8,000000013FA62C11,?,?,?,?,000000013FA6DC2A,?,?,00000000,000000013FA684AF,?,?,?), ref: 000000013FA629F7

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: dff555305baf8c6bbb18520eb4ee7e1ce059de402ddfa06c014ff71944a3e7c5
Instruction ID: 6e6aa62339cb7473717d2d387adf94ea7a041323746cbe17bcde45e6b98665db
Opcode Fuzzy Hash: dff555305baf8c6bbb18520eb4ee7e1ce059de402ddfa06c014ff71944a3e7c5
Instruction Fuzzy Hash: D8119D35F4124042FA6467215A517EA76E65FC97B0F044B3CA93E4B7C6EE2C86438200

Function 000000013FA57288 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000013FA572B3
_IsNonwritableInCurrentImage.LIBCMT ref: 000000013FA57348
RtlUnwindEx.KERNEL32 ref: 000000013FA57397

Strings

csm, xrefs: 000000013FA5732E
f, xrefs: 000000013FA572C6

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 7775b4defbcb5f99eb859b462b1ce1532b374c60451568ab5971c4e951d484a3
Instruction ID: b2a68a5c45fdd568b9d5737cb98e97ea16506342746f3ea02fc541cae6a30c9c
Opcode Fuzzy Hash: 7775b4defbcb5f99eb859b462b1ce1532b374c60451568ab5971c4e951d484a3
Instruction Fuzzy Hash: 4E51C132B11604CAEB14CF25E448B9D3BA5F354BA9F558138EE9E67788DB34DA83C700

Function 000000013FA611C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000000013FA611E9
GetProcAddress.KERNEL32 ref: 000000013FA611FF
FreeLibrary.KERNEL32 ref: 000000013FA61226

Strings

mscoree.dll, xrefs: 000000013FA611E0
CorExitProcess, xrefs: 000000013FA611F8

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bf761600861b132889fd9b1f172135b27a05a3466beb4e5c14af3cf7c120c4f4
Instruction ID: 5d3a2bd5a6e0a40cb40302a92e21877c220ba94e35d5ed968b75e9fd0abdd1aa
Opcode Fuzzy Hash: bf761600861b132889fd9b1f172135b27a05a3466beb4e5c14af3cf7c120c4f4
Instruction Fuzzy Hash: 09F06D71B11B0481EA108BA4E854BA97360FB89B75F54063DCAAE872E4CF2CC64AC700

Function 000000013FA579BC Relevance: 7.8, APIs: 5, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 000000013FA57ADF
__AdjustPointer.LIBCMT ref: 000000013FA57B2A

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 4ed7d74887577429148c6cbc321fbf402f01857698d88e3335b941d18dc210ad
Instruction ID: e3f477942cf2be986c0b8ba4b62dbcfe9e5e723b7aef0cd359184852cdbe8e45
Opcode Fuzzy Hash: 4ed7d74887577429148c6cbc321fbf402f01857698d88e3335b941d18dc210ad
Instruction Fuzzy Hash: 04B1BF72E02A88C1FE65DF55D4887A97794EB44B86F1A843D9ECE27785DB38CA43C700

Function 000000013FA47A40 Relevance: 7.6, APIs: 5, Instructions: 135fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000000013FA47A8B
WriteFile.KERNEL32 ref: 000000013FA47AD5
GetLastError.KERNEL32 ref: 000000013FA47B30
SetLastError.KERNEL32 ref: 000000013FA47B59

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ErrorLast$FileHandleWrite
String ID:
API String ID: 1958782092-0
Opcode ID: 62e8346bb91db0c532f292c343c03e476f980d018ee13cef993d3fd6b2175ab9
Instruction ID: 5c6601b0df518c7b4813e62d23250740e4fb0001e9b1468b87b3e02e0216e5a0
Opcode Fuzzy Hash: 62e8346bb91db0c532f292c343c03e476f980d018ee13cef993d3fd6b2175ab9
Instruction Fuzzy Hash: AC517E72B14A8082EA60CB66E8507AA73A4F784BD1F550139EE5F57B94DF3CCA47C710

Function 000000013FA6F18C Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000013FA6F1B4
_set_statfp.LIBCMT ref: 000000013FA6F1CF
_set_statfp.LIBCMT ref: 000000013FA6F1EB
_set_statfp.LIBCMT ref: 000000013FA6F227

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 7d170ee21146607bbe660a37fa86ebaeee6952599cd635bf8a876dcf144f681b
Instruction ID: b21dd75381730f5d5523b993fd338fcaa50c16fb53915b45991acabad342fc69
Opcode Fuzzy Hash: 7d170ee21146607bbe660a37fa86ebaeee6952599cd635bf8a876dcf144f681b
Instruction Fuzzy Hash: 4011CE3BE50A0211FA64113CF8533E930416BD93B4F19063CAB6E4B2DEFB288B434605

Function 000000013FA62A10 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000000013FA5ADC7,?,?,00000000,000000013FA5B062,?,?,?,?,?,000000013FA5AFEE), ref: 000000013FA62A2F
FlsSetValue.KERNEL32(?,?,?,000000013FA5ADC7,?,?,00000000,000000013FA5B062,?,?,?,?,?,000000013FA5AFEE), ref: 000000013FA62A4E
FlsSetValue.KERNEL32(?,?,?,000000013FA5ADC7,?,?,00000000,000000013FA5B062,?,?,?,?,?,000000013FA5AFEE), ref: 000000013FA62A76
FlsSetValue.KERNEL32(?,?,?,000000013FA5ADC7,?,?,00000000,000000013FA5B062,?,?,?,?,?,000000013FA5AFEE), ref: 000000013FA62A87
FlsSetValue.KERNEL32(?,?,?,000000013FA5ADC7,?,?,00000000,000000013FA5B062,?,?,?,?,?,000000013FA5AFEE), ref: 000000013FA62A98

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 86fe035e00d1d602777038774878a2897c9adc8476b94adbf3c7bc8eeb7a768f
Instruction ID: b5576d0344f26e41b3962863cab6adade4cbc12c62c6fd628c73da0319c48d92
Opcode Fuzzy Hash: 86fe035e00d1d602777038774878a2897c9adc8476b94adbf3c7bc8eeb7a768f
Instruction Fuzzy Hash: 22114930E5064042FF6897259A917EA36EA5FD43B0F444B3CA93E4BBD6EE6CC6038201

Function 000000013FA628A4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 000000013FA628B5
FlsSetValue.KERNEL32 ref: 000000013FA628D4
FlsSetValue.KERNEL32 ref: 000000013FA628FC
FlsSetValue.KERNEL32 ref: 000000013FA6290D
FlsSetValue.KERNEL32 ref: 000000013FA6291E

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b150e93786705c8554998ac2570fbcbb747d9aea44a1ce3903b2cd1dc0555109
Instruction ID: ee8acc9a33a4299e9b27408a0bc76a93956e45c8e712cefc1c1ac19ac44406e0
Opcode Fuzzy Hash: b150e93786705c8554998ac2570fbcbb747d9aea44a1ce3903b2cd1dc0555109
Instruction Fuzzy Hash: EA111739E4120442FE6D67315A527EA32DA4FC5370E580B3C9A3E4B7D2EE3C97434252

Function 000000013FA65B28 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013FA65E07

Part of subcall function 000000013FA6C4A4: _invalid_parameter_noinfo.LIBCMT ref: 000000013FA6C4C1

Strings

UTF-8, xrefs: 000000013FA65D86
UTF-16LEUNICODE, xrefs: 000000013FA65DA5
ccs, xrefs: 000000013FA65D42

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7fb683387a68d5c04bac52ca321eebc2f52f39ad0e0b49bc1b2927c09cf77c47
Instruction ID: b3fdcdb1235fa3cc0cf4b548c2329163220c8f5c6dd69395852b06056215b401
Opcode Fuzzy Hash: 7fb683387a68d5c04bac52ca321eebc2f52f39ad0e0b49bc1b2927c09cf77c47
Instruction Fuzzy Hash: 0C816972E04240CEFB658F6AC2547FC3BA0E791BA8F55802DDA0A576E9D729CB439701

Function 000000013FA58CDC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000000013FA58D4C
_CallSETranslator.LIBVCRUNTIME ref: 000000013FA58D97

Strings

MOC, xrefs: 000000013FA58D60
RCC, xrefs: 000000013FA58D68

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 45395b0d9e84dc941235d35e9a201705667d822c282f2cfcf98b941ef1374899
Instruction ID: 324940934cb98b85907e05009c8bede4d66f4cb21bffc79d85a3b9d1d24a9bc3
Opcode Fuzzy Hash: 45395b0d9e84dc941235d35e9a201705667d822c282f2cfcf98b941ef1374899
Instruction Fuzzy Hash: 9C916873A04B94CAE751CB65E9843DD7BB1F748788F14412AEE8D17B59DB38C296CB00

Function 000000013FA58AC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000000013FA58B0C
_CallSETranslator.LIBVCRUNTIME ref: 000000013FA58B5B

Strings

RCC, xrefs: 000000013FA58B29
MOC, xrefs: 000000013FA58B20

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 5b7bff9964b32e473a3d72dd83a96cda547c82a61009bc5b50b31b359271a2a9
Instruction ID: a4665aa8790a1bd3de37976d7981b445f574f2f88893e674fb9d4a223043e5a1
Opcode Fuzzy Hash: 5b7bff9964b32e473a3d72dd83a96cda547c82a61009bc5b50b31b359271a2a9
Instruction Fuzzy Hash: FB616872A05B88CAEB20DF66D5843DD77A0F348B98F044229EF8D17B99DB38C256C700

Function 000000013FA59250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000013FA59278
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000000013FA59360

Strings

csm, xrefs: 000000013FA5929A
csm, xrefs: 000000013FA593B2

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 3efbc5adb1b35bf9387d32f153c1a0c5f7e455fc31f4e7aa56dadfc3cbae41ac
Instruction ID: 41a879d0104384500a7f70e9b0120c55754233a149f5895c1901c6d9cf578140
Opcode Fuzzy Hash: 3efbc5adb1b35bf9387d32f153c1a0c5f7e455fc31f4e7aa56dadfc3cbae41ac
Instruction Fuzzy Hash: CE518D72908380C6EB648F15D54839C77A4F399B95F18812EDADD4BBD5CB38DA62CB01

Function 000000013FA50BA4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000000013FA50BF8
RegEnumKeyExW.ADVAPI32 ref: 000000013FA50C75
RegDeleteKeyW.ADVAPI32 ref: 000000013FA50C8F

Strings

%s\%s, xrefs: 000000013FA50C15

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: DeleteEnumOpen
String ID: %s\%s
API String ID: 3661673891-4073750446
Opcode ID: ee4ad5f429f7f22e6ac827ff870943090024caeee882214d004cf88cf4ce03f5
Instruction ID: d9778316d1c44806b0e02a6d829a99eaab7f9285fb2e4a40564463672c10035b
Opcode Fuzzy Hash: ee4ad5f429f7f22e6ac827ff870943090024caeee882214d004cf88cf4ce03f5
Instruction Fuzzy Hash: 5B317A32614B8186E7208F21E8447DA73A5F789784F40413AEE8D53B29DF38C65ADB40

Function 000000013FA64490 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000000013FA6450F
WriteFile.KERNEL32 ref: 000000013FA647D7
WriteFile.KERNEL32 ref: 000000013FA6481D
GetLastError.KERNEL32 ref: 000000013FA648D3

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 26408035adb1395c0d67a01588a12fd27370553c3153764cf8271abe9472c264
Instruction ID: 955957d3d37ba919a8dbcb157e921b49377cbfbc055d545b2ad8520d81a54997
Opcode Fuzzy Hash: 26408035adb1395c0d67a01588a12fd27370553c3153764cf8271abe9472c264
Instruction Fuzzy Hash: 87D1EF72B05A808AE711CF79D4407EC37B6F384BA8F54422ADE5EA7B99DA34C617C300

Function 000000013FA47DB0 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,000000013FA47C8F,?,?,?,?,00000000,000000013FA4906A), ref: 000000013FA47DD8
ReadFile.KERNEL32 ref: 000000013FA47DF7
GetLastError.KERNEL32 ref: 000000013FA47E2B
GetLastError.KERNEL32 ref: 000000013FA47E4A

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 1a5a69f94c3c2392b8f3d7b323fcec08d54a09625973528f3470f2396b08089e
Instruction ID: eed52da22242b581563208def19f0d9c2eb07789e0dfdee6722465bc6b9fa544
Opcode Fuzzy Hash: 1a5a69f94c3c2392b8f3d7b323fcec08d54a09625973528f3470f2396b08089e
Instruction Fuzzy Hash: D021E131E04A8081EA709F61E4013A973A1F745F9AF144238EA5D677C5CF3CCE878B40

Function 000000013FA51C44 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 000000013FA51C4C
GetDeviceCaps.GDI32 ref: 000000013FA51C62
GetDeviceCaps.GDI32 ref: 000000013FA51C70
ReleaseDC.USER32 ref: 000000013FA51C81

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 28489f2a19b775294e11c07c30f00bab8d3727b619ff7740ddda105378b5056a
Instruction ID: 33c0caba6816238806b00bd30b7de5235188da0df554419db6f1ce925bfb2da2
Opcode Fuzzy Hash: 28489f2a19b775294e11c07c30f00bab8d3727b619ff7740ddda105378b5056a
Instruction Fuzzy Hash: B2E04F74F0174082FF096BB26819B6632A09B49B42F08903C8C0F47350DE3C858F8B10

Function 000000013FA59488 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000013FA594B2

Strings

csm, xrefs: 000000013FA594D7
csm, xrefs: 000000013FA59646

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: e0da591f0232e5ebbdeae58dba383ee5c9de8b1426b5572abd1ad92e4fe3c4ae
Instruction ID: 61dcc599ef86b69c273a22ed5d2f74ac15510d5c2aeac57971b82e8835bf35af
Opcode Fuzzy Hash: e0da591f0232e5ebbdeae58dba383ee5c9de8b1426b5572abd1ad92e4fe3c4ae
Instruction Fuzzy Hash: 6C71D472A08680CADB618F25D4887ED7BA4F358BC5F14912ADECD4BF89D738C656C740

Function 000000013FA59AC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000013FA59B6A
_CreateFrameInfo.LIBVCRUNTIME ref: 000000013FA59B96

Strings

csm, xrefs: 000000013FA59C96

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 8d2a4aa2ab7e329685ea82b2eb22216d2f52d4cefc6765a04c2d9111d036c5f8
Instruction ID: c5c9d762b5dac9ae5e2b2149ae53ce4e6995b9b1a3f8e336075141f66c144dfa
Opcode Fuzzy Hash: 8d2a4aa2ab7e329685ea82b2eb22216d2f52d4cefc6765a04c2d9111d036c5f8
Instruction Fuzzy Hash: 89511A72615744C6EA60EF2AE44439E77B4F389B91F140129EBCD47B66DB38D562CB00

Function 000000013FA64B28 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000013FA64C3F
GetLastError.KERNEL32 ref: 000000013FA64C61

Strings

U, xrefs: 000000013FA64BEB

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 45e8d6af9c14fee518981ba34569510195d0e1be7be82232c76027dd83702c2e
Instruction ID: 659229f40abf510bcb494def16691c1f4eb47b47c495557831e3e0854eb91f79
Opcode Fuzzy Hash: 45e8d6af9c14fee518981ba34569510195d0e1be7be82232c76027dd83702c2e
Instruction Fuzzy Hash: 9541B532B14A8086EB20CF25E4447DA77A0F798B94F844039EE8D87798DF7CC646C740

Function 000000013FA50910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000000013FA50984
RegDeleteValueW.ADVAPI32(?,?,?,?,?,?,?,?,80000000,{B41DB860-8EE4-11D2-9906-E49FADC173CA},?,000000013FA44549), ref: 000000013FA5099E

Part of subcall function 000000013FA50F30: RegCloseKey.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,000000013FA42A13), ref: 000000013FA50F3D

Strings

{B41DB860-8EE4-11D2-9906-E49FADC173CA}, xrefs: 000000013FA50912

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: {B41DB860-8EE4-11D2-9906-E49FADC173CA}
API String ID: 849931509-2245766904
Opcode ID: 2d210fb1e4e1126dc413cebfd423782a5d968d7b236636aece2cc9d099276581
Instruction ID: bf53f9b626ddd84bcbdf80248fe37de9516f3222f293bb47439a836ebddd0b78
Opcode Fuzzy Hash: 2d210fb1e4e1126dc413cebfd423782a5d968d7b236636aece2cc9d099276581
Instruction Fuzzy Hash: AC11C671B2468081FA50AB52F8557EBB7A1ABC5FD0F405039BD8E477AADF28C74B8700

Function 000000013FA571E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,000000013FA42317), ref: 000000013FA5722C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000000013FA42317), ref: 000000013FA57272

Strings

csm, xrefs: 000000013FA5725F

Memory Dump Source

Source File: 00000004.00000002.425415701.000000013FA41000.00000020.00000001.01000000.0000000C.sdmp, Offset: 000000013FA40000, based on PE: true

Associated: 00000004.00000002.425411514.000000013FA40000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425421662.000000013FA72000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425428933.000000013FA84000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.425440793.000000013FA8F000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13fa40000_Uninstall.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: f6114de55563274d79aa21e798b23dcadcad471fd49af5cc00c3ac97ad5869d3
Instruction ID: 8e3e5bb931f92b6abea828d25af3f32330783e31ef201d619abbb1924c8805c0
Opcode Fuzzy Hash: f6114de55563274d79aa21e798b23dcadcad471fd49af5cc00c3ac97ad5869d3
Instruction Fuzzy Hash: B1111832614B8482EB218F15F444399B7E5F788B94F584229EECD17B69DF3DCA56CB00

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report winrar-x64-701(1).exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk

C:\Users\user\7zxa.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk

C:\Users\user\Default.SFX

C:\Users\user\Default32.SFX

C:\Users\user\Descript.ion

C:\Users\user\License.txt

C:\Users\user\Order.htm

C:\Users\user\Rar.exe

C:\Users\user\Rar.txt

C:\Users\user\RarExt.dll

C:\Users\user\RarExt32.dll

C:\Users\user\RarExtInstaller.exe

Windows Analysis Report
winrar-x64-701(1).exe

Function 000000013F7A41D0 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 228
filesleeptimeCOMMON

Function 000000013F796960 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 238
COMMON

Function 000000013F795B4C Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 506
COMMON

Function 000000013F7A1FEC Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 85
memoryCOMMON

Function 000000013F791F08 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106
fileCOMMON

Function 000000013F79A548 Relevance: 147.4, APIs: 16, Strings: 68, Instructions: 421
libraryfileloaderCOMMON