Edit tour

Windows Analysis Report
y83WAR4vQc.exe

Overview

General Information

Sample name:	y83WAR4vQc.exe renamed because original name is a hash value
Original sample name:	f9401786d00286b50c0d2228fa06d6777d0a5c32294470c297db161a8625ac5b.exe
Analysis ID:	1562314
MD5:	4effe13b0f91976bd70825f2eff1077a
SHA1:	65990fc883bdd4c6c59cf039e5979c43d3d3d0d2
SHA256:	f9401786d00286b50c0d2228fa06d6777d0a5c32294470c297db161a8625ac5b
Tags:	exeuser-adrian__luca
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Found large amount of non-executed APIs

PE file contains an invalid checksum

Program does not show much activity (idle)

Uses 32bit PE files

Classification

Process Tree

System is w10x64

y83WAR4vQc.exe (PID: 7444 cmdline: "C:\Users\user\Desktop\y83WAR4vQc.exe" MD5: 4EFFE13B0F91976BD70825F2EFF1077A)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: y83WAR4vQc.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: y83WAR4vQc.exe

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 92.7% probability

Source: y83WAR4vQc.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_0040276E FindFirstFileW,	0_2_0040276E
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_00405629 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405629
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_004060E4 FindFirstFileW,FindClose,	0_2_004060E4

Source: y83WAR4vQc.exe, 00000000.00000002.1362400372.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: y83WAR4vQc.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_0040518A GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040518A

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_00403229 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_00403229

Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_00406547	0_2_00406547
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_00406D1E	0_2_00406D1E
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_004049C7	0_2_004049C7

Source: y83WAR4vQc.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_00404481 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404481

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

File created: C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp

Jump to behavior

Source: y83WAR4vQc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: y83WAR4vQc.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

File read: C:\Users\user\Desktop\y83WAR4vQc.exe

Jump to behavior

Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_0040610B GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040610B

Source: y83WAR4vQc.exe

Static PE information: real checksum: 0xce445 should be: 0xa98e

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

API coverage: 7.8 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_0040276E FindFirstFileW,	0_2_0040276E
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_00405629 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405629
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_004060E4 FindFirstFileW,FindClose,	0_2_004060E4

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

API call chain: ExitProcess graph end node

graph_0-2752

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_0040610B GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040610B

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_00405DC3 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405DC3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	4 System Information Discovery	Remote Desktop Protocol	1 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
y83WAR4vQc.exe	24%	ReversingLabs	Win32.Trojan.GuLoader
y83WAR4vQc.exe	100%	Avira	TR/Crypt.XPACK.Gen2

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	y83WAR4vQc.exe, 00000000.00000002.1362400372.000000000062E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	y83WAR4vQc.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562314
Start date and time:	2024-11-25 13:53:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	y83WAR4vQc.exe renamed because original name is a hash value
Original Sample Name:	f9401786d00286b50c0d2228fa06d6777d0a5c32294470c297db161a8625ac5b.exe
Detection:	MAL
Classification:	mal60.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 42
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: y83WAR4vQc.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.155559768679113
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	y83WAR4vQc.exe
File size:	41'984 bytes
MD5:	4effe13b0f91976bd70825f2eff1077a
SHA1:	65990fc883bdd4c6c59cf039e5979c43d3d3d0d2
SHA256:	f9401786d00286b50c0d2228fa06d6777d0a5c32294470c297db161a8625ac5b
SHA512:	15b82f809439d255e1b43cf25e8c21e90dd326791fc1ce3370e56e7d3d96e76d1655a4f23a8b99c73f7b0fadeb709b979e974753f50cb9e2b132cc7fbbaec8bb
SSDEEP:	768:yWPCo6ws94NYoKqJ4rsmxsATghCS4w10D3kvySGQVzIc/I5a/W:xaDLGYUbUTghCi10DHYzIc/oa/W
TLSH:	A0137C41B7A0D423D6B346311936A77B8FBAF92064A06B1B57503F9D7D325C3EA0E392
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.*j........PE..L....f.R.................b..........)2............@

File Icon


Icon Hash:	1f9706b9f9391b86

Static PE Info

General

Entrypoint:	0x403229
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x52BA66B8 [Wed Dec 25 05:01:44 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7ed0d71376e55d58ab36dc7d3ffda898

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 0040A2D8h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00408034h]
push 00008001h
call dword ptr [00408134h]
push ebp
call dword ptr [004082ACh]
push 00000008h
mov dword ptr [00434F58h], eax
call 00007F3FE0EF4294h
mov dword ptr [00434EA4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 0042B1B8h
call dword ptr [0040817Ch]
push 0040A2C0h
push 00433EA0h
call 00007F3FE0EF3EFFh
call dword ptr [00408138h]
mov ebx, 0043F000h
push eax
push ebx
call 00007F3FE0EF3EEDh
push ebp
call dword ptr [0040810Ch]
cmp word ptr [0043F000h], 0022h
mov dword ptr [00434EA0h], eax
mov eax, ebx
jne 00007F3FE0EF13FAh
push 00000022h
mov eax, 0043F002h
pop esi
push esi
push eax
call 00007F3FE0EF393Eh
push eax
call dword ptr [00408240h]
mov dword ptr [esp+18h], eax
jmp 00007F3FE0EF14BEh
push 00000020h
pop edx
cmp cx, dx
jne 00007F3FE0EF13F9h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007F3FE0EF13EBh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85a0	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x65000	0x20b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xbee78	0x900
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7000	0x6200	6b261bd7f45c2df7de2d0134c84421b7	False	0.6672114158163265	data	6.457067985385169	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2000	0x1600	b09411ee7b449199058dfd4a79f91eb1	False	0.5182883522727273	data	5.339147539541255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0xa000	0x2b000	0x600	326f796323fdc724ea91090eafbe9bdc	False	0.4856770833333333	data	3.795352750027872	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x30000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x65000	0x20b8	0x2200	74b27a0083cbdcb566d993625801cb0e	False	0.5340073529411765	data	4.938841517310863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x65208	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4608, resolution 2833 x 2833 px/m	English	United States	0.5978490832157969
RT_DIALOG	0x66830	0x100	data	English	United States	0.5234375
RT_DIALOG	0x66930	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x66a50	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x66b18	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x66b78	0x14	data	English	United States	1.05
RT_VERSION	0x66b90	0x21c	data	English	United States	0.5314814814814814
RT_MANIFEST	0x66db0	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, SetFileAttributesW, ExpandEnvironmentStringsW, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, SetErrorMode, GetCommandLineW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	07:54:33
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\y83WAR4vQc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\y83WAR4vQc.exe"
Imagebase:	0x400000
File size:	41'984 bytes
MD5 hash:	4EFFE13B0F91976BD70825F2EFF1077A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.6%
Total number of Nodes:	1254
Total number of Limit Nodes:	14

Executed Functions

Function 00403229 Relevance: 65.1, APIs: 27, Strings: 10, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403248
SetErrorMode.KERNELBASE(00008001), ref: 00403253
OleInitialize.OLE32(00000000), ref: 0040325A

Part of subcall function 0040610B: GetModuleHandleA.KERNEL32(?,?,00000020,0040326C,00000008), ref: 0040611D
Part of subcall function 0040610B: LoadLibraryA.KERNELBASE(?,?,00000020,0040326C,00000008), ref: 00406128
Part of subcall function 0040610B: GetProcAddress.KERNEL32(00000000,?), ref: 00406139

SHGetFileInfoW.SHELL32(0042B1B8,00000000,?,000002B4,00000000), ref: 00403282

Part of subcall function 00405DA1: lstrcpynW.KERNEL32(?,?,00000400,00403297,00433EA0,NSIS Error), ref: 00405DAE

GetCommandLineW.KERNEL32(00433EA0,NSIS Error), ref: 00403297
GetModuleHandleW.KERNEL32(00000000,0043F000,00000000), ref: 004032AA
CharNextW.USER32(00000000,0043F000,00000020), ref: 004032D1
GetTempPathW.KERNEL32(00000400,C:\Users\user~1\AppData\Local\Temp\,00000000,00000020), ref: 004033DA
GetWindowsDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,000003FB), ref: 004033EB
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 004033F7
GetTempPathW.KERNEL32(000003FC,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 0040340B
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,Low), ref: 00403413
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,Low), ref: 00403424
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user~1\AppData\Local\Temp\), ref: 0040342C
DeleteFileW.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp), ref: 00403440
CoUninitialize.COMBASE(?), ref: 004034F0
ExitProcess.KERNEL32 ref: 00403510
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,~nsu.tmp,0043F000,00000000,?), ref: 0040351C
lstrcmpiW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,00440800,C:\Users\user~1\AppData\Local\Temp\,~nsu.tmp,0043F000,00000000,?), ref: 00403528
CreateDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00403534
SetCurrentDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\), ref: 0040353B
DeleteFileW.KERNEL32(0042A9B8,0042A9B8,?,00435000,?), ref: 00403595
CopyFileW.KERNEL32(00442800,0042A9B8,00000001), ref: 004035A9
CloseHandle.KERNEL32(00000000,0042A9B8,0042A9B8,?,0042A9B8,00000000), ref: 004035D6
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040362C
ExitWindowsEx.USER32(00000002,00000000), ref: 00403668
ExitProcess.KERNEL32 ref: 0040368B

Strings

C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp, xrefs: 0040343B
C:\Users\user~1\AppData\Local\Temp\, xrefs: 004033CF, 004033D4, 004033EA, 004033F6, 00403405, 00403412, 0040341E, 00403426, 0040351B, 00403527, 00403533, 0040353A, 004035EB
TEMP, xrefs: 0040341F
NSIS Error, xrefs: 00403288
Low, xrefs: 0040340D
Error launching installer, xrefs: 004034A7
~nsu.tmp, xrefs: 00403516
TMP, xrefs: 00403427
SeShutdownPrivilege, xrefs: 0040363E
\Temp, xrefs: 004033F1

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-3031928587
Opcode ID: f195a64d171f64111121db36c4463f42ca3038f7a3fbd40599632eb1a73ac7bc
Instruction ID: 02b0c0aa23ea66072d22554f7a9d706dafbd78a3d23bdfa468f983da76c936b2
Opcode Fuzzy Hash: f195a64d171f64111121db36c4463f42ca3038f7a3fbd40599632eb1a73ac7bc
Instruction Fuzzy Hash: 48B1D230504310AAD7207F619E4AA2B3EACEF4574AF00443FF941B62E1DBBD4A45CB6E

Function 0040610B Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040326C,00000008), ref: 0040611D
LoadLibraryA.KERNELBASE(?,?,00000020,0040326C,00000008), ref: 00406128
GetProcAddress.KERNEL32(00000000,?), ref: 00406139

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 5679b5def2f7da251302a8cf4847d9d0b7faea0d144796f5e929e2ea3512b209
Instruction ID: fdb84e6153f048f4f32cb56b497edeca1f79cb2b45eddc07a3c36f847a24315a
Opcode Fuzzy Hash: 5679b5def2f7da251302a8cf4847d9d0b7faea0d144796f5e929e2ea3512b209
Instruction Fuzzy Hash: D9E0CD326002309FC3105B34AE4497773AC9FA8740305043DF586F6000CB749C22EF69

Function 00405A3C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405A5A
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403227,C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp,C:\Users\user~1\AppData\Local\Temp\), ref: 00405A75

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405A41, 00405A45
nsa, xrefs: 00405A49

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user~1\AppData\Local\Temp\$nsa
API String ID: 1716503409-3083371207
Opcode ID: 553695d42fa49c729d900ffa62198f8f27b7eacb1895c33b02f4b86faf7ca5f2
Instruction ID: 485616ab74b01dad4b6f2028e8278cd76642f71c5b474b9ae6064b4a8122c260
Opcode Fuzzy Hash: 553695d42fa49c729d900ffa62198f8f27b7eacb1895c33b02f4b86faf7ca5f2
Instruction Fuzzy Hash: 76F03076700204BFDB008F59DD45FAFB7A8EB95750F10803AEE45E7290E6B09A548F64

Function 004031F5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: CharNextW.USER32(?,*?|<>/":,00000000,0043F000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403201,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 00406098
Part of subcall function 00406035: CharNextW.USER32(?,?,?,00000000), ref: 004060A7
Part of subcall function 00406035: CharNextW.USER32(?,0043F000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403201,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 004060AC
Part of subcall function 00406035: CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403201,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 004060BF

CreateDirectoryW.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\,00000000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 00403216

Strings

C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp, xrefs: 0040321D
C:\Users\user~1\AppData\Local\Temp\, xrefs: 004031F6, 004031FB, 00403201, 0040320D, 00403215, 0040321C

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp
API String ID: 4115351271-3284287857
Opcode ID: d87fad949052cfa03a28e6d8598cf07e7846d7f9d3ec73566398795b30735e76
Instruction ID: 8e868994f3d2bbac58875734e477fdd5edfa4fc47c6a96a7a7d594daf79fb191
Opcode Fuzzy Hash: d87fad949052cfa03a28e6d8598cf07e7846d7f9d3ec73566398795b30735e76
Instruction Fuzzy Hash: FBD0C92214693062D652376A7D4AFCF0D0C8F063AEF26407BF804B51E69B7C0AC649FE

Function 00405A0D Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DA7,00442800,80000000,00000003,?,?,?,00000000,0040344F,?), ref: 00405A11
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,0040344F,?), ref: 00405A33

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 37c4dc7839c603de99ed6860e60369df17b6bb7e4a2ae391e088aaa007eea51a
Instruction ID: 1eb9dddf645dfc1e42ea27fadde30db719d7f554b9b2fef872a17e27e5e15d7e
Opcode Fuzzy Hash: 37c4dc7839c603de99ed6860e60369df17b6bb7e4a2ae391e088aaa007eea51a
Instruction Fuzzy Hash: C0D09E71654601EFEF098F20DE16F6EBBA2EB84B00F11952DB692940E0DA7158199B15

Function 00405A90 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031DB,00000000,00000000,00402FF3,000000FF,00000004,00000000,00000000,00000000), ref: 00405AA4

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction ID: 07b625fac44bf3ff9367e003840ea8544b808996ef6c51cee1fe321e6e9f2367
Opcode Fuzzy Hash: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction Fuzzy Hash: B1E08C3220125AEBEF11AE958C40AEB3B6CEB04360F004832FD10E3240D234E8218FE8

Function 0040557D Relevance: 1.5, APIs: 1, Instructions: 21
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxIndirectW.USER32(0040A3B0), ref: 004055D8

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: IndirectMessage
String ID:
API String ID: 1874166685-0
Opcode ID: 0f5ce9ceb6b824fdab0ccd61eb1aa690aa19fb054b1cce10ad9f1958c7687728
Instruction ID: 72ae506b7457921a01343baea109bbf4e2c901344dea6141f916b91dad4bfda2
Opcode Fuzzy Hash: 0f5ce9ceb6b824fdab0ccd61eb1aa690aa19fb054b1cce10ad9f1958c7687728
Instruction Fuzzy Hash: 73F0DF715243009FC7A4CF28EE456563AE2F789311F14503EEA41A23E4DB7898A8CF4A

Function 00403691 Relevance: 1.3, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(FFFFFFFF,004034F0,?), ref: 0040369C

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c9d0d423b4b429707c4fd9dd9caa69f7af3c19a9df35d64a48dcda9fef3fb6c8
Instruction ID: ccd7fe7a4fa82286fe55154120f19d55f673d8aa521cf508357ae8af62eb69f0
Opcode Fuzzy Hash: c9d0d423b4b429707c4fd9dd9caa69f7af3c19a9df35d64a48dcda9fef3fb6c8
Instruction Fuzzy Hash: A7C01234A04B04AAE1306F74EE4E6053A546740779FE04B25F0B8B01F0C77D56A9499D

Non-executed Functions

Function 0040518A Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004051E9
GetDlgItem.USER32(?,000003EE), ref: 004051F8
GetClientRect.USER32(?,?), ref: 00405235
GetSystemMetrics.USER32(00000015), ref: 0040523D
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 0040525E
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040526F
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405282
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405290
SendMessageW.USER32(?,00001024,00000000,?), ref: 004052A3
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004052C5
ShowWindow.USER32(?,00000008), ref: 004052D9
GetDlgItem.USER32(?,000003EC), ref: 004052FA
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040530A
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405323
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040532F
GetDlgItem.USER32(?,000003F8), ref: 00405207

Part of subcall function 0040401B: SendMessageW.USER32(00000028,?,00000001,00403E47), ref: 00404029

GetDlgItem.USER32(?,000003EC), ref: 0040534C
CreateThread.KERNEL32(00000000,00000000,Function_0000511E,00000000), ref: 0040535A
CloseHandle.KERNEL32(00000000), ref: 00405361
ShowWindow.USER32(00000000), ref: 00405385
ShowWindow.USER32(?,00000008), ref: 0040538A
ShowWindow.USER32(00000008), ref: 004053D4
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405408
CreatePopupMenu.USER32 ref: 00405419
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040542D
GetWindowRect.USER32(?,?), ref: 0040544D
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405466
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040549E
OpenClipboard.USER32(00000000), ref: 004054AE
EmptyClipboard.USER32 ref: 004054B4
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004054C0
GlobalLock.KERNEL32(00000000), ref: 004054CA
SendMessageW.USER32(?,00001073,00000000,?), ref: 004054DE
GlobalUnlock.KERNEL32(00000000), ref: 004054FE
SetClipboardData.USER32(0000000D,00000000), ref: 00405509
CloseClipboard.USER32 ref: 0040550F

Strings

{, xrefs: 004053F2

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 58f5626aa4c6a7058210a1ef6063d9c8904c0d068caf84b31f2655e726ab0914
Instruction ID: 34766a67a8348c891c509fbed0d62983ec1eb8fa6b5cfd063670c437a0e1cb12
Opcode Fuzzy Hash: 58f5626aa4c6a7058210a1ef6063d9c8904c0d068caf84b31f2655e726ab0914
Instruction Fuzzy Hash: F5B12871800608FFDB119F60DD89AAE7B79FB48355F10803AFA41BA1A0CBB59E51DF58

Function 004049C7 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049DF
GetDlgItem.USER32(?,00000408), ref: 004049EA
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A34
LoadBitmapW.USER32(0000006E), ref: 00404A47
SetWindowLongW.USER32(?,000000FC,00404FBF), ref: 00404A60
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A74
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A86
SendMessageW.USER32(?,00001109,00000002), ref: 00404A9C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404AA8
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404ABA
DeleteObject.GDI32(00000000), ref: 00404ABD
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AE8
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AF4
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B8A
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404BB5
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BC9
GetWindowLongW.USER32(?,000000F0), ref: 00404BF8
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404C06
ShowWindow.USER32(?,00000005), ref: 00404C17
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404D14
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D79
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D8E
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404DB2
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DD2
ImageList_Destroy.COMCTL32(?), ref: 00404DE7
GlobalFree.KERNEL32(?), ref: 00404DF7
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E70
SendMessageW.USER32(?,00001102,?,?), ref: 00404F19
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F28
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F48
ShowWindow.USER32(?,00000000), ref: 00404F96
GetDlgItem.USER32(?,000003FE), ref: 00404FA1
ShowWindow.USER32(00000000), ref: 00404FA8

Strings

, xrefs: 00404F80
N, xrefs: 00404C52
M, xrefs: 00404B71

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: d3c421dbc05eb9c118f70068bf7944ed4c7c9b5971f9bdb3d84e9ab566385c08
Instruction ID: e53c56638097080d8a9576e5f9c25271d89cd91d9f9dd4264a0f886a8ea3ee34
Opcode Fuzzy Hash: d3c421dbc05eb9c118f70068bf7944ed4c7c9b5971f9bdb3d84e9ab566385c08
Instruction Fuzzy Hash: CE028FB0900209EFEB109F54DD85AAE7BB5FB84315F10813AF611BA2E1C7B89D52DF58

Function 00404481 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004044D0
SetWindowTextW.USER32(00000000,?), ref: 004044FA
SHBrowseForFolderW.SHELL32(?), ref: 004045AB
CoTaskMemFree.OLE32(00000000), ref: 004045B6
lstrcmpiW.KERNEL32(00432E40,0042D1F8,00000000,?,?), ref: 004045E8
lstrcatW.KERNEL32(?,00432E40), ref: 004045F4
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404606

Part of subcall function 00405561: GetDlgItemTextW.USER32(?,?,00000400,0040463D), ref: 00405574

Part of subcall function 00406035: CharNextW.USER32(?,*?|<>/":,00000000,0043F000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403201,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 00406098
Part of subcall function 00406035: CharNextW.USER32(?,?,?,00000000), ref: 004060A7
Part of subcall function 00406035: CharNextW.USER32(?,0043F000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403201,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 004060AC
Part of subcall function 00406035: CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403201,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 004060BF

GetDiskFreeSpaceW.KERNEL32(0042B1C8,?,?,0000040F,?,0042B1C8,0042B1C8,?,00000000,0042B1C8,?,?,000003FB,?), ref: 004046C7
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004046E2
SetDlgItemTextW.USER32(00000000,00000400,0042B1B8), ref: 00404768

Strings

A, xrefs: 004045A4
@.C, xrefs: 004045E2

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: @.C$A
API String ID: 2246997448-1557386336
Opcode ID: 7459313ad56da6814eed4461a0493d862bb185afe1827c1f72d68e103bf79117
Instruction ID: 23f2a3ef68cc2ecf1ba22192b5584ba95f97fd263584382d2916c135efe1ecf3
Opcode Fuzzy Hash: 7459313ad56da6814eed4461a0493d862bb185afe1827c1f72d68e103bf79117
Instruction Fuzzy Hash: 179164B1900215ABDB11AFA1CD85AAF77B8EF85314F14843BF601B72D1DB7C8A41CB69

Function 00405DC3 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0042C1D8,?,00405082,0042C1D8,00000000,00000000,?), ref: 00405E86
GetSystemDirectoryW.KERNEL32(00432E40,00000400), ref: 00405F04
GetWindowsDirectoryW.KERNEL32(00432E40,00000400), ref: 00405F17
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00405F53
SHGetPathFromIDListW.SHELL32(?,00432E40), ref: 00405F61
CoTaskMemFree.OLE32(?), ref: 00405F6C
lstrcatW.KERNEL32(00432E40,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F90
lstrlenW.KERNEL32(00432E40,00000000,0042C1D8,?,00405082,0042C1D8,00000000,00000000,?), ref: 00405FEA

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F8A
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405ED2
@.C, xrefs: 00405DED
@.C, xrefs: 00405FF5

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: @.C$@.C$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3579590209
Opcode ID: 43c29530afae03f5301cf54f370ba8410909c3f9dcb969b2f832d616e7dacda1
Instruction ID: 51fea1f0525bd32aa09071eea97aa62567f0d70ed35b44e0f17875bb3ea282eb
Opcode Fuzzy Hash: 43c29530afae03f5301cf54f370ba8410909c3f9dcb969b2f832d616e7dacda1
Instruction Fuzzy Hash: 7561EE71A00A06ABDB209F64CC45AAF37A5EF54314F11C13BE941BA2E0D77D9A82CF4D

Function 00405629 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\,771B3420,0043F000), ref: 00405652
lstrcatW.KERNEL32(0042F200,\*.*,0042F200,?,?,C:\Users\user~1\AppData\Local\Temp\,771B3420,0043F000), ref: 0040569A
lstrcatW.KERNEL32(?,0040A014,?,0042F200,?,?,C:\Users\user~1\AppData\Local\Temp\,771B3420,0043F000), ref: 004056BD
lstrlenW.KERNEL32(?,?,0040A014,?,0042F200,?,?,C:\Users\user~1\AppData\Local\Temp\,771B3420,0043F000), ref: 004056C3
FindFirstFileW.KERNEL32(0042F200,?,?,?,0040A014,?,0042F200,?,?,C:\Users\user~1\AppData\Local\Temp\,771B3420,0043F000), ref: 004056D3
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405773
FindClose.KERNEL32(00000000), ref: 00405782

Strings

\*.*, xrefs: 00405694
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405637

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1117835029
Opcode ID: f8de7b50163dd1efd412f680910ecff258e3fc2c6b7af745ee09ee24b87cc35c
Instruction ID: 537a859ffcff897d8cd5f5cf56393fe58197ce41a03b0bffcce20e97483bf088
Opcode Fuzzy Hash: f8de7b50163dd1efd412f680910ecff258e3fc2c6b7af745ee09ee24b87cc35c
Instruction Fuzzy Hash: 2441B230500A18E6DB21AB618D89EBF7778DF86719F14813BF805B21D1D77C4981EE6E

Function 004060E4 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00430248,0042FA00,0040593D,0042FA00,0042FA00,00000000,0042FA00,0042FA00,?,?,771B3420,00405649,?,C:\Users\user~1\AppData\Local\Temp\,771B3420), ref: 004060EF
FindClose.KERNEL32(00000000), ref: 004060FB

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 9c2bed4397a3bf892ba140cd3fe5090782190f2fd0e109c23d43d293603923f5
Instruction ID: 5d70c47cb11938251a0a1db446d6214bf1d94b5ec034c03d4844f4bffd5ee079
Opcode Fuzzy Hash: 9c2bed4397a3bf892ba140cd3fe5090782190f2fd0e109c23d43d293603923f5
Instruction Fuzzy Hash: 1DD012755540309BD7805738AE0C84B7A59AF193317224B36F46AF62E0D7788C66869C

Function 00406D1E Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

!C, xrefs: 00406E6E, 00406E90, 00406F40, 00406F12, 00406E95
!C, xrefs: 00406F52

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID:
String ID: !C$ !C
API String ID: 0-4112869800
Opcode ID: f244a69970be5e3fb7395b2eb28eccf6eedf7c5e0ffd2bc2360b4ba292bdf26c
Instruction ID: 9d59628195055c55702702634927743170e9131f895cfb3327bf2ff62f88c604
Opcode Fuzzy Hash: f244a69970be5e3fb7395b2eb28eccf6eedf7c5e0ffd2bc2360b4ba292bdf26c
Instruction Fuzzy Hash: F2C15971A0021ACBCF18CF68D5905EEB7B2BF98314F26826AD8567B380D7346952CF94

Function 0040206A Relevance: 1.6, APIs: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408580,?,00000001,00408570,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: ffa6b33d051242dea0b599afd0b70f87154ad558325d106faae319e39926f61a
Instruction ID: 980c83093501945f33440b76d7cafb195365f9a7aefe91f5dd6c45d3bc957592
Opcode Fuzzy Hash: ffa6b33d051242dea0b599afd0b70f87154ad558325d106faae319e39926f61a
Instruction Fuzzy Hash: 77415C75A00104BFCB00DFA4CD88EAE7BB6EF88315B20456AF905EB2D1DA79ED41CB55

Function 0040276E Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277D

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 61e4b2d84330adcf7c60f82c7e5d820b6e598669863a6f3568266a41ee9f3ddd
Instruction ID: acf40542f5c489c1fe3f42b28250c4c8421c5faf7d3490952b38be557a9d2a1a
Opcode Fuzzy Hash: 61e4b2d84330adcf7c60f82c7e5d820b6e598669863a6f3568266a41ee9f3ddd
Instruction Fuzzy Hash: BEF0B8B16002109BCB00EFA0CD489AEB378FF08324F20097AF101F30D0D6B899009B2A

Function 00406547 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d398b535e43ee880de6f9663a3da9d30c23bf20106ab7c53179b5f9c0eb57cb5
Instruction ID: 831d3521bb97c66da2d66f325b0a06c49e3003946fd67b3772e4acd4ce90d7ab
Opcode Fuzzy Hash: d398b535e43ee880de6f9663a3da9d30c23bf20106ab7c53179b5f9c0eb57cb5
Instruction Fuzzy Hash: DDE17B71900719DFDB24CF58C880BAAB7F5EB44305F15892EE897AB2D1D778A961CF04

Function 0040376B Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040610B: GetModuleHandleA.KERNEL32(?,?,00000020,0040326C,00000008), ref: 0040611D
Part of subcall function 0040610B: LoadLibraryA.KERNELBASE(?,?,00000020,0040326C,00000008), ref: 00406128
Part of subcall function 0040610B: GetProcAddress.KERNEL32(00000000,?), ref: 00406139

lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp,0042D1F8,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D1F8,00000000,00000006,C:\Users\user~1\AppData\Local\Temp\,771B3420,00000000,0043F000), ref: 004037EC
lstrlenW.KERNEL32(00432E40,?,?,?,00432E40,00000000,0043F800,C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp,0042D1F8,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D1F8,00000000,00000006,C:\Users\user~1\AppData\Local\Temp\), ref: 0040386C
lstrcmpiW.KERNEL32(00432E38,.exe,00432E40,?,?,?,00432E40,00000000,0043F800,C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp,0042D1F8,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D1F8,00000000), ref: 0040387F
GetFileAttributesW.KERNEL32(00432E40), ref: 0040388A
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 004038D3

Part of subcall function 00405CE8: wsprintfW.USER32 ref: 00405CF5

RegisterClassW.USER32(00433E40), ref: 00403910
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403928
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 0040395D
ShowWindow.USER32(00000005,00000000), ref: 00403993
LoadLibraryW.KERNEL32(RichEd20), ref: 004039A4
LoadLibraryW.KERNEL32(RichEd32), ref: 004039AF
GetClassInfoW.USER32(00000000,RichEdit20W,00433E40), ref: 004039BF
GetClassInfoW.USER32(00000000,RichEdit,00433E40), ref: 004039CC
RegisterClassW.USER32(00433E40), ref: 004039D5
DialogBoxParamW.USER32(?,00000000,00403B0E,00000000), ref: 004039F4

Strings

RichEd32, xrefs: 004039AA
RichEd20, xrefs: 0040399F
RichEdit, xrefs: 004039C6
.exe, xrefs: 00403879
C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp, xrefs: 0040378B, 004037E7
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403777
@>C, xrefs: 004038E2
.DEFAULT\Control Panel\International, xrefs: 004037D7
_Nb, xrefs: 004038EF, 00403957
@.C, xrefs: 00403833
RichEdit20W, xrefs: 004039B7, 004039BD
Control Panel\Desktop\ResourceLocale, xrefs: 0040379F
B.C, xrefs: 0040385B

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@.C$@>C$B.C$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-1387936157
Opcode ID: 13181fb0a13b4fe95f4f44d618df2cd010522b2bf7784839af7428735638c323
Instruction ID: 9058ea0fac2f7b5828f11579708a501ddeab19906f501c4d7d338e07c4ff49df
Opcode Fuzzy Hash: 13181fb0a13b4fe95f4f44d618df2cd010522b2bf7784839af7428735638c323
Instruction Fuzzy Hash: 2761B871600700AFD720BF669D46F2B3A6CEB84B4AF50443FF940B62E1CBB95941CA2D

Function 00403B0E Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B4A
ShowWindow.USER32(?), ref: 00403B67
DestroyWindow.USER32 ref: 00403B7B
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403B97
GetDlgItem.USER32(?,?), ref: 00403BB8
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403BCC
IsWindowEnabled.USER32(00000000), ref: 00403BD3
GetDlgItem.USER32(?,00000001), ref: 00403C81
GetDlgItem.USER32(?,00000002), ref: 00403C8B
SetClassLongW.USER32(?,000000F2,?), ref: 00403CA5
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403CF6
GetDlgItem.USER32(?,00000003), ref: 00403D9C
ShowWindow.USER32(00000000,?), ref: 00403DBD
EnableWindow.USER32(?,?), ref: 00403DCF
EnableWindow.USER32(?,?), ref: 00403DEA
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403E00
EnableMenuItem.USER32(00000000), ref: 00403E07
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403E1F
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403E32
lstrlenW.KERNEL32(0042D1F8,?,0042D1F8,00433EA0), ref: 00403E5B
SetWindowTextW.USER32(?,0042D1F8), ref: 00403E6F
ShowWindow.USER32(?,0000000A), ref: 00403FA3

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 3d70d94d5eb68e801898c08395313f40ee8f1bd2a4b8db52baf4935a012bca6c
Instruction ID: 60ca7c1d91bee6f8242d2bed331db898ad50b25bc51b1c46c45c1ad212b6c09a
Opcode Fuzzy Hash: 3d70d94d5eb68e801898c08395313f40ee8f1bd2a4b8db52baf4935a012bca6c
Instruction Fuzzy Hash: B6C1DD71904205ABDB216F61EE86E2A3E7CFB4570AF14053EF641B11E0CB799A42DB2D

Function 00404183 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404221
GetDlgItem.USER32(?,000003E8), ref: 00404235
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404252
GetSysColor.USER32(?), ref: 00404263
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404271
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040427F
lstrlenW.KERNEL32(?), ref: 00404284
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404291
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004042A6
GetDlgItem.USER32(?,0000040A), ref: 004042FF
SendMessageW.USER32(00000000), ref: 00404306
GetDlgItem.USER32(?,000003E8), ref: 00404331
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404374
LoadCursorW.USER32(00000000,00007F02), ref: 00404382
SetCursor.USER32(00000000), ref: 00404385
ShellExecuteW.SHELL32(0000070B,open,@.C,00000000,00000000,00000001), ref: 0040439A
LoadCursorW.USER32(00000000,00007F00), ref: 004043A6
SetCursor.USER32(00000000), ref: 004043A9
SendMessageW.USER32(00000111,00000001,00000000), ref: 004043D8
SendMessageW.USER32(00000010,00000000,00000000), ref: 004043EA

Strings

@.C, xrefs: 0040438F
open, xrefs: 00404392
N, xrefs: 0040431F

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @.C$N$open
API String ID: 3615053054-801394694
Opcode ID: 963217090c97da4adcbcf15c24e762bcbfd2aad3b5ef9f006c5e90e2b7288751
Instruction ID: bcd791c445e14c4d77ec78b24435c59c5d20c83db90324e08484bccd48c03535
Opcode Fuzzy Hash: 963217090c97da4adcbcf15c24e762bcbfd2aad3b5ef9f006c5e90e2b7288751
Instruction Fuzzy Hash: 727181B1A00209BFDB109F60DD85E6A7B79FB84355F04803AFB05B62D1C779A961CF98

Function 00405ABF Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 136
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyW.KERNEL32(00430898,NUL,?,00000000,?,?,?,00405C63,?,?,00000001,004057DB,?,00000000,000000F1,?), ref: 00405ACF
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405C63,?,?,00000001,004057DB,?,00000000,000000F1,?), ref: 00405AF3
GetShortPathNameW.KERNEL32(00000000,00430898,00000400), ref: 00405AFC

Part of subcall function 00405972: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BAC,00000000,[Rename],00000000,00000000,00000000), ref: 00405982
Part of subcall function 00405972: lstrlenA.KERNEL32(00405BAC,?,00000000,00405BAC,00000000,[Rename],00000000,00000000,00000000), ref: 004059B4

GetShortPathNameW.KERNEL32(?,00431098,00000400), ref: 00405B19
wsprintfA.USER32 ref: 00405B37
GetFileSize.KERNEL32(00000000,00000000,00431098,C0000000,00000004,00431098,?,?,?,?,?), ref: 00405B72
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405B81
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405BB9
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00430498,00000000,-0000000A,0040A514,00000000,[Rename],00000000,00000000,00000000), ref: 00405C0F
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405C21
GlobalFree.KERNEL32(00000000), ref: 00405C28
CloseHandle.KERNEL32(00000000), ref: 00405C2F

Part of subcall function 00405A0D: GetFileAttributesW.KERNELBASE(00000003,00402DA7,00442800,80000000,00000003,?,?,?,00000000,0040344F,?), ref: 00405A11
Part of subcall function 00405A0D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,0040344F,?), ref: 00405A33

Strings

[Rename], xrefs: 00405BA1, 00405BB3
%ls=%ls, xrefs: 00405B2D
NUL, xrefs: 00405AC9

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 1265525490-899692902
Opcode ID: 966b28a7e5a5b9a46133c77218e23553b336693a1c23903b6eeae7e9c3b0497a
Instruction ID: 7e8ca1d3d50ba167f29b61b8a94756d2149cb8eb8d1ee9df404c58700b9860d6
Opcode Fuzzy Hash: 966b28a7e5a5b9a46133c77218e23553b336693a1c23903b6eeae7e9c3b0497a
Instruction Fuzzy Hash: B1411671204B19BFD2206B615D49F6B3B6CEF45715F14003AF942B62D2EA7CE9018A7D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433EA0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: eba2a3bbcb5832d39a7808e3ae5c7eb99af93b299209f69c760ac1b0491d86a4
Instruction ID: f1b70214e96eb8bec3146c709be0bbd1f29e4b49e587d4bf0c97a3ec82ce1e67
Opcode Fuzzy Hash: eba2a3bbcb5832d39a7808e3ae5c7eb99af93b299209f69c760ac1b0491d86a4
Instruction Fuzzy Hash: 00417C71400209AFCB058FA5DE459BF7BB9FF44315F00802EF591AA1A0C778EA54DFA4

Function 00402D67 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402D78
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,?,?,00000000,0040344F,?), ref: 00402D94

Part of subcall function 00405A0D: GetFileAttributesW.KERNELBASE(00000003,00402DA7,00442800,80000000,00000003,?,?,?,00000000,0040344F,?), ref: 00405A11
Part of subcall function 00405A0D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,0040344F,?), ref: 00405A33

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003,?,?,?,00000000,0040344F,?), ref: 00402DE0

Strings

39-95bb-83d0f6d0da78}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/></application></compatibility></assembly>, xrefs: 00402DF5, 00402E16, 00402E32, 00402EBE
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00402D71
Inst, xrefs: 00402E4C
Null, xrefs: 00402E5E
Error launching installer, xrefs: 00402DB7
soft, xrefs: 00402E55
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402F3F

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: 39-95bb-83d0f6d0da78}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/></application></compatibility></assembly>$C:\Users\user~1\AppData\Local\Temp\$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-586070698
Opcode ID: 1ddf41df0a42b2360c78983b726e0176e8784e91c938cfa3838bdba12ee062b7
Instruction ID: 2344981239cccc2d9a157a4bc97fadfb01f0662fe41213100d9ed930206fcb3f
Opcode Fuzzy Hash: 1ddf41df0a42b2360c78983b726e0176e8784e91c938cfa3838bdba12ee062b7
Instruction Fuzzy Hash: 2451D171900215AFDB109FA5DE89B9F7AB8FB04359F20413BF904B62D1C7B89D408BAD

Function 00402FA0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040300B
GetTickCount.KERNEL32 ref: 004030B0
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004030D9
wsprintfW.USER32 ref: 004030EC
WriteFile.KERNEL32(00000000,00000000,?,00402F3A,00000000), ref: 0040311D

Strings

... %d%%, xrefs: 004030E6

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 567d16c84bc26e35b56de6a991f7c1d851492a15168b7d80d9f2dbebfc4257a8
Instruction ID: edebebcb9cc5efd3ffb8aa1a5e3cca2c022cdf8913c1b450003ecc800609919e
Opcode Fuzzy Hash: 567d16c84bc26e35b56de6a991f7c1d851492a15168b7d80d9f2dbebfc4257a8
Instruction Fuzzy Hash: 78615971900219EBCF10DF65DA84A9F7FB8AF08312F14457BE814BB2D0D7789A50CBA9

Function 0040404D Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040406A
GetSysColor.USER32(00000000), ref: 00404086
SetTextColor.GDI32(?,00000000), ref: 00404092
SetBkMode.GDI32(?,?), ref: 0040409E
GetSysColor.USER32(?), ref: 004040B1
SetBkColor.GDI32(?,?), ref: 004040C1
DeleteObject.GDI32(?), ref: 004040DB
CreateBrushIndirect.GDI32(?), ref: 004040E5

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 878c72b768cb9ca2e83e307521140d4ebe6f79c9a792ccaf91322ed4afa210a0
Instruction ID: 4290116d03e1e938411804169c88583f7df32a2dcd0dedbcf70a7ff5d4599883
Opcode Fuzzy Hash: 878c72b768cb9ca2e83e307521140d4ebe6f79c9a792ccaf91322ed4afa210a0
Instruction Fuzzy Hash: 0F2157B15007049BC7319F68DD48B5B7BF8AF41714F04893DEA95F2691D734D948CB64

Function 00402571 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025D9
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402614
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402637
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264D

Part of subcall function 00405A90: ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031DB,00000000,00000000,00402FF3,000000FF,00000004,00000000,00000000,00000000), ref: 00405AA4

Part of subcall function 00405CE8: wsprintfW.USER32 ref: 00405CF5

Strings

9, xrefs: 004025BC

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 1ebf7e8ea81d9f721691c6586ac75f819ca406a5e40d7b7a1c139251d0037f51
Instruction ID: 712a0fc01c11b6dc7c3c5e68f53f431dee7eef2fa5089cb8e9bfef1fdcaab261
Opcode Fuzzy Hash: 1ebf7e8ea81d9f721691c6586ac75f819ca406a5e40d7b7a1c139251d0037f51
Instruction Fuzzy Hash: A151EBB1D00219AADF14DFA4DA88AAEB779FF04304F50443BE501B62D0DB759E42CB69

Function 004027B3 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402807
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402823
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285C
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 0040286E
GlobalFree.KERNEL32(00000000), ref: 00402875
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288D
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A1

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 8e0940e00e99637d45cda657c49f497c391d11177f7645e1064727bb186f540e
Instruction ID: fe2ca1a255c9cd407b5186cb59bdd4cc2173cf127eb101838ad91b4c2232832b
Opcode Fuzzy Hash: 8e0940e00e99637d45cda657c49f497c391d11177f7645e1064727bb186f540e
Instruction Fuzzy Hash: BD317F72800118BBDF11AFA5CE49DAF7E79EF09364F24423AF550762D0CA794E418BA9

Function 0040504B Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C1D8,00000000,?,771B23A0,?,?,?,?,?,?,?,?,?,00403103,00000000,?), ref: 00405083
lstrlenW.KERNEL32(00403103,0042C1D8,00000000,?,771B23A0,?,?,?,?,?,?,?,?,?,00403103,00000000), ref: 00405093
lstrcatW.KERNEL32(0042C1D8,00403103,00403103,0042C1D8,00000000,?,771B23A0), ref: 004050A6
SetWindowTextW.USER32(0042C1D8,0042C1D8), ref: 004050B8
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050DE
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050F8
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405106

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: c0e6c919bf82f45c73b6eecd0639a41c2ad0d5a79d84f923f5aec4b4dd022a62
Instruction ID: 18f0b212c8a37fbfd9ea408b4b1fd2a272b642164fc692df639cd20d24458be7
Opcode Fuzzy Hash: c0e6c919bf82f45c73b6eecd0639a41c2ad0d5a79d84f923f5aec4b4dd022a62
Instruction Fuzzy Hash: 56219D71900518BADB11AF95DD85EDFBFB9EF84314F10807AF904B62A1C3794A40CFA8

Function 00406035 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,0043F000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403201,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 00406098
CharNextW.USER32(?,?,?,00000000), ref: 004060A7
CharNextW.USER32(?,0043F000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403201,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 004060AC
CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403201,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 004060BF

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00406036, 0040603B
*?|<>/":, xrefs: 00406087

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user~1\AppData\Local\Temp\
API String ID: 589700163-1439852002
Opcode ID: 5d64c10bc97e62ea4a676719e588da5fc07abd2ce6560c5e8650e212b13ecad1
Instruction ID: 35fbf6a24d661ac63574abd6f2b5f3cfaee5f5a3e28f3d5ffd4c7fbc13fd6fb5
Opcode Fuzzy Hash: 5d64c10bc97e62ea4a676719e588da5fc07abd2ce6560c5e8650e212b13ecad1
Instruction Fuzzy Hash: 1F11C81684061299DB30BB148C40A7772E8EF55754F56843FED86732C0E7BC4CA282BD

Function 00404915 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404930
GetMessagePos.USER32 ref: 00404938
ScreenToClient.USER32(?,?), ref: 00404952
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404964
SendMessageW.USER32(?,0000113E,00000000,?), ref: 0040498A

Strings

f, xrefs: 00404966

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 8022016cd060c827d0bdc105967e00620e8417d97f69c1817adc8455638bf95d
Instruction ID: e09b5cbf994b9d20e684e2691b51e71dfbdbe619cf93b48063de1b345cd00843
Opcode Fuzzy Hash: 8022016cd060c827d0bdc105967e00620e8417d97f69c1817adc8455638bf95d
Instruction Fuzzy Hash: 14015E71940219BADB00DBA4DD85FFFBBBCAF54711F10012BBB50B61C0C7B499018BA4

Function 00402C7D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9B
MulDiv.KERNEL32(?,00000064,?), ref: 00402CC6
wsprintfW.USER32 ref: 00402CD6
SetWindowTextW.USER32(?,?), ref: 00402CE6
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF8

Strings

verifying installer: %d%%, xrefs: 00402CD0

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: b579be9e180f96ba16c56fb513ac100cc9f2c07574638d36e797e7726839ab9f
Instruction ID: 4408f4c8952a47a194ff67b523293e2f30943602a1885e021f1ba6dd9a58fc5a
Opcode Fuzzy Hash: b579be9e180f96ba16c56fb513ac100cc9f2c07574638d36e797e7726839ab9f
Instruction Fuzzy Hash: FB016270640208BFEF20AF64DD49FEE3B69BB00309F008439FA06A92D0DBB89555CF59

Function 004024EC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040B578,000000FF,0040AD78,00000400,?,?,00000021), ref: 0040252D
lstrlenA.KERNEL32(0040AD78,?,?,0040B578,000000FF,0040AD78,00000400,?,?,00000021), ref: 00402534
WriteFile.KERNEL32(00000000,?,0040AD78,00000000,?,?,00000000,00000011), ref: 00402566

Strings

8, xrefs: 0040250A

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8
API String ID: 1453599865-4194326291
Opcode ID: fa24a900829e58aa854b55985ad0857a7e20b855b9e3e7eff8b1e02e12944b15
Instruction ID: 789ffc1fd5c9b2491a3bc3a33d6618758842135b745afe85e879194269bc7d47
Opcode Fuzzy Hash: fa24a900829e58aa854b55985ad0857a7e20b855b9e3e7eff8b1e02e12944b15
Instruction Fuzzy Hash: FF018071A40604BFD700ABB19E8DEAF7278EF6031AF20453BF142B60C1D6B84991962E

Function 00401752 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A578,00440000,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,0040A578,0040A578,00000000,00000000,0040A578,00440000,?,?,00000031), ref: 004017B8

Part of subcall function 00405DA1: lstrcpynW.KERNEL32(?,?,00000400,00403297,00433EA0,NSIS Error), ref: 00405DAE

Part of subcall function 0040504B: lstrlenW.KERNEL32(0042C1D8,00000000,?,771B23A0,?,?,?,?,?,?,?,?,?,00403103,00000000,?), ref: 00405083
Part of subcall function 0040504B: lstrlenW.KERNEL32(00403103,0042C1D8,00000000,?,771B23A0,?,?,?,?,?,?,?,?,?,00403103,00000000), ref: 00405093
Part of subcall function 0040504B: lstrcatW.KERNEL32(0042C1D8,00403103,00403103,0042C1D8,00000000,?,771B23A0), ref: 004050A6
Part of subcall function 0040504B: SetWindowTextW.USER32(0042C1D8,0042C1D8), ref: 004050B8
Part of subcall function 0040504B: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050DE
Part of subcall function 0040504B: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050F8
Part of subcall function 0040504B: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405106

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 3b07a03950afe4c981b82c8560f7630a0fa17e6691ec92e93bdf0364be60bc21
Instruction ID: e0c9a0707421b0566b50a086881e387c24033da95965c7c775ca149cf8f14c82
Opcode Fuzzy Hash: 3b07a03950afe4c981b82c8560f7630a0fa17e6691ec92e93bdf0364be60bc21
Instruction Fuzzy Hash: EA418071900518BACF116BB5DC4ADAF7679EF45368B20823BF421B10E1D73C8A519A6D

Function 00402B78 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B99
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD5
RegCloseKey.ADVAPI32(?), ref: 00402BDE
RegCloseKey.ADVAPI32(?), ref: 00402C03
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C21

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: bd91da1ba0eb139b8caccfea47c3b8adcc0195348a71b7fcd29f2bbb3b0fb127
Instruction ID: 2ec885d680f81863ea04f737883acb0357ac6f266bfb4f4db73bac45c1b80bd2
Opcode Fuzzy Hash: bd91da1ba0eb139b8caccfea47c3b8adcc0195348a71b7fcd29f2bbb3b0fb127
Instruction Fuzzy Hash: AB114671504108FFEF11AF90DE89EAE3B7DEB44348F11007AFA15A10A0D7B59E55AF68

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: aeb2b04795d680d12746b09d9d3076b6a991ad1a912ba314740c9d263e8ce963
Instruction ID: a030428118a1c000f424ff4dfb6ba2235896b41d14b08693192eaf3a016f5733
Opcode Fuzzy Hash: aeb2b04795d680d12746b09d9d3076b6a991ad1a912ba314740c9d263e8ce963
Instruction Fuzzy Hash: 92F0ECB2600508AFDB01DBE4EF88CEEB7BCEB08311B15146AF641F6190DA74AD018B38

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040CD80), ref: 00401DBC

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: d0c589828fdc2f60c51a1b7eb7f59a871ef2e54159ce2cf69037fbe37572b688
Instruction ID: 116310afc90cc01f82b49c11926c77c683d1a1b46be819c55f1a02a8d5d7abe2
Opcode Fuzzy Hash: d0c589828fdc2f60c51a1b7eb7f59a871ef2e54159ce2cf69037fbe37572b688
Instruction Fuzzy Hash: DC016D35944640EFEB016BB0AF8AB9A3F74EF55305F104A79F545B62E2CA7804098B2D

Function 0040482F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D1F8,0042D1F8,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 004048C0
wsprintfW.USER32 ref: 004048C9
SetDlgItemTextW.USER32(?,0042D1F8), ref: 004048DC

Strings

%u.%u%s%s, xrefs: 004048AA

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: ab2d75c3d347bcae210a388157d4015cbde97b43778bbdcc2d1826b2da227e5d
Instruction ID: 531d837b88f4b702d8d9e34e744ab90cc2584a20199bf08e47c16144e152f227
Opcode Fuzzy Hash: ab2d75c3d347bcae210a388157d4015cbde97b43778bbdcc2d1826b2da227e5d
Instruction Fuzzy Hash: CB11E6736002243BDB10A66D9C4AEDF3659DBC2334F14863BFA25F61D1D978891186E8

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: fa0622c80f3ea4c4a1a4fe4c6f91de5de270cf664640931bdd5eb32ff74c1ad7
Instruction ID: d25c1399015d6fc3d8f93c2dcf78642a10d85d9054307dbf3bdfe5c686c79543
Opcode Fuzzy Hash: fa0622c80f3ea4c4a1a4fe4c6f91de5de270cf664640931bdd5eb32ff74c1ad7
Instruction Fuzzy Hash: FC21B371A44208AFEF01AFB0CA4AEAD7B75EF45308F10413EF502B61D1D7B8A941DB18

Function 00401F98 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 0040504B: lstrlenW.KERNEL32(0042C1D8,00000000,?,771B23A0,?,?,?,?,?,?,?,?,?,00403103,00000000,?), ref: 00405083
Part of subcall function 0040504B: lstrlenW.KERNEL32(00403103,0042C1D8,00000000,?,771B23A0,?,?,?,?,?,?,?,?,?,00403103,00000000), ref: 00405093
Part of subcall function 0040504B: lstrcatW.KERNEL32(0042C1D8,00403103,00403103,0042C1D8,00000000,?,771B23A0), ref: 004050A6
Part of subcall function 0040504B: SetWindowTextW.USER32(0042C1D8,0042C1D8), ref: 004050B8
Part of subcall function 0040504B: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050DE
Part of subcall function 0040504B: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050F8
Part of subcall function 0040504B: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405106

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051

Strings

OC, xrefs: 00402011

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID: OC
API String ID: 334405425-1597561874
Opcode ID: 297c1825603e8d5f489a2522be40841bd89bd4d7f47841d63e333b39b1ac1a2c
Instruction ID: b3ac21fa57660b76ceab9e03e352ea593c7fbc5daa3d747aca45c0be544cf33f
Opcode Fuzzy Hash: 297c1825603e8d5f489a2522be40841bd89bd4d7f47841d63e333b39b1ac1a2c
Instruction Fuzzy Hash: 3B21A771900215EACF106FA5CE48A9E7EB0AF09354F70423BF610B51E0D7BD8A81DA5D

Function 004057EC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,00403213,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 004057F2
CharPrevW.USER32(?,00000000,?,C:\Users\user~1\AppData\Local\Temp\,00403213,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,004033E1), ref: 004057FC
lstrcatW.KERNEL32(?,0040A014), ref: 0040580E

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 004057EC

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 2659869361-2382934351
Opcode ID: de9dddfcd7a9d618380513bff0a4e880c88fc064ccebdc1c89e46d65784464cc
Instruction ID: f63ca075a24b3552cb7c5632698c0476d366f5162805e4a7ef835507e0185024
Opcode Fuzzy Hash: de9dddfcd7a9d618380513bff0a4e880c88fc064ccebdc1c89e46d65784464cc
Instruction Fuzzy Hash: 9DD05E21102E20AAD1117B849C08EDB629DEE85300340847BF500B21A1CB7819518BED

Function 0040232F Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236D
lstrlenW.KERNEL32(0040B578,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238D
RegSetValueExW.ADVAPI32(?,?,?,?,0040B578,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C9
RegCloseKey.ADVAPI32(?,?,?,0040B578,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AA

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: cc0965250b89a09c51cf9f9c53b423a312148e2e41ea1d3763b9cdd40fc2e552
Instruction ID: 92be6db62a7debd6b64078ffb9939270950072c0cf2fb5a53bae11f9be139373
Opcode Fuzzy Hash: cc0965250b89a09c51cf9f9c53b423a312148e2e41ea1d3763b9cdd40fc2e552
Instruction Fuzzy Hash: 8F1190B1A00108BFEB00AFA1DE8AEAF777CEB54358F11403AF504B71D0D7B85D409A68

Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00405897: CharNextW.USER32(?,?,0042FA00,?,0040590B,0042FA00,0042FA00,?,?,771B3420,00405649,?,C:\Users\user~1\AppData\Local\Temp\,771B3420,0043F000), ref: 004058A5
Part of subcall function 00405897: CharNextW.USER32(00000000), ref: 004058AA
Part of subcall function 00405897: CharNextW.USER32(00000000), ref: 004058C2

CreateDirectoryW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNEL32(?,00440000,?,00000000,000000F0), ref: 00401630

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: 109ac3cab168821cff9c761a4bcdab396d1ff7e1addeaf9cefa6065999dfc9c4
Instruction ID: 34d8f352ef9aa8656828f895e526d2bd4293bf172d5861d5c75f43cad8b5630e
Opcode Fuzzy Hash: 109ac3cab168821cff9c761a4bcdab396d1ff7e1addeaf9cefa6065999dfc9c4
Instruction Fuzzy Hash: B2112531500104EBCF206FA0DD449AE3BB0EF05369B29453BF881F22E0D73D49808B5D

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,0040A014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405CE8: wsprintfW.USER32 ref: 00405CF5

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 90b437ca501e41d769246acc3526ee78bfc1f7e4b716acdc87d1f01b62c577f6
Instruction ID: 985e6d37b82d88455cf37f94a5598379594e562e2ebdb1bdff2800a7dde94c7a
Opcode Fuzzy Hash: 90b437ca501e41d769246acc3526ee78bfc1f7e4b716acdc87d1f01b62c577f6
Instruction Fuzzy Hash: B6111CB1A00109AFDB01DFA5C945DAEBBB5EF45344F21417AF500F62E1E7359E40DB29

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040504B: lstrlenW.KERNEL32(0042C1D8,00000000,?,771B23A0,?,?,?,?,?,?,?,?,?,00403103,00000000,?), ref: 00405083
Part of subcall function 0040504B: lstrlenW.KERNEL32(00403103,0042C1D8,00000000,?,771B23A0,?,?,?,?,?,?,?,?,?,00403103,00000000), ref: 00405093
Part of subcall function 0040504B: lstrcatW.KERNEL32(0042C1D8,00403103,00403103,0042C1D8,00000000,?,771B23A0), ref: 004050A6
Part of subcall function 0040504B: SetWindowTextW.USER32(0042C1D8,0042C1D8), ref: 004050B8
Part of subcall function 0040504B: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050DE
Part of subcall function 0040504B: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050F8
Part of subcall function 0040504B: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405106

Part of subcall function 0040551C: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00430200,Error launching installer), ref: 00405541
Part of subcall function 0040551C: CloseHandle.KERNEL32(?), ref: 0040554E

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 397bbc1e4d4bd5b336570b9bd6cdfb94af19db1830bc237898cd674fcce29f39
Instruction ID: b5f73ffbd4a1fa015f0c2796452332fd916e9637aff9300d1e3c67c2e8cabf32
Opcode Fuzzy Hash: 397bbc1e4d4bd5b336570b9bd6cdfb94af19db1830bc237898cd674fcce29f39
Instruction Fuzzy Hash: C911AD71900204EBCF109FA1CE449EE7AB1EF04315F20443BF901B61E1C7798A929F99

Function 00402D03 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402EE3,00000001,?,?,?,00000000,0040344F,?), ref: 00402D16
GetTickCount.KERNEL32 ref: 00402D34
CreateDialogParamW.USER32(0000006F,00000000,00402C7D,00000000), ref: 00402D51
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,0040344F,?), ref: 00402D5F

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: aed48f930e6cb8163906278dd1a6a8d55546e7dcfd90fdb5b9c2cdca09a853f5
Instruction ID: 0f67fd822d339501c317f9c9290c0d88a12acd91c10ffcc8c100a5c20b21d8f0
Opcode Fuzzy Hash: aed48f930e6cb8163906278dd1a6a8d55546e7dcfd90fdb5b9c2cdca09a853f5
Instruction Fuzzy Hash: 8EF0F870603620BFC621AB64FF4DA9B7A65FB44B12B95047AF141B11E4D7B848C1CBDD

Function 00404FBF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404FEE
CallWindowProcW.USER32(?,?,?,?), ref: 0040503F

Part of subcall function 00404032: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404044

Strings

, xrefs: 00404FCF

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d5165aaa8ddedbb0149cdff99e62f7242478f10d326129f832a6699438a9a539
Instruction ID: bbda00c2ce61db54858d54f75231ff4833bc9f24808a58ee1059b1aa4c9daed2
Opcode Fuzzy Hash: d5165aaa8ddedbb0149cdff99e62f7242478f10d326129f832a6699438a9a539
Instruction Fuzzy Hash: 44018F71100608AFDF318F11DD81AAF3A2AEB88354F104037FA00761D1CB7A8DA2DEA9

Function 0040551C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00430200,Error launching installer), ref: 00405541
CloseHandle.KERNEL32(?), ref: 0040554E

Strings

Error launching installer, xrefs: 0040552F

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: e3a99de12ab609f41969ca5042cf5c1fd7ec7a17acfe207451f60b4ef79cfd79
Instruction ID: cf9fdeca5e40bc41ee8c953bab838b17ccc92df15d25727223da148b4173978b
Opcode Fuzzy Hash: e3a99de12ab609f41969ca5042cf5c1fd7ec7a17acfe207451f60b4ef79cfd79
Instruction Fuzzy Hash: 41E0ECB4500309ABEB00AF64DD49E6F7BBDEB04344F008575A950F2150D774D9148B68

Function 004036D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,00000000,771B3420,004036AE,004034F0,?), ref: 004036F0
GlobalFree.KERNEL32(?), ref: 004036F7

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 004036E8

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 1100898210-2382934351
Opcode ID: af6bb57c9087681c5df9a6583299814f0cea52fc49ac98f0490cfdd2588b3981
Instruction ID: 839bfc3724c17aac1dd4b1c492512fede4cfaa3ffa2183060c5e8c58424d678e
Opcode Fuzzy Hash: af6bb57c9087681c5df9a6583299814f0cea52fc49ac98f0490cfdd2588b3981
Instruction Fuzzy Hash: 3AE0C233500020ABC6315F55FD0572EBB68AF4AB22F05842EE8807B3A087745C534FC8

Function 00405972 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BAC,00000000,[Rename],00000000,00000000,00000000), ref: 00405982
lstrcmpiA.KERNEL32(00405BAC,00000000), ref: 0040599A
CharNextA.USER32(00405BAC,?,00000000,00405BAC,00000000,[Rename],00000000,00000000,00000000), ref: 004059AB
lstrlenA.KERNEL32(00405BAC,?,00000000,00405BAC,00000000,[Rename],00000000,00000000,00000000), ref: 004059B4

Memory Dump Source

Source File: 00000000.00000002.1362102381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1362082135.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362125273.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1362216780.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_y83WAR4vQc.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 8032f475193f702fb71f6f03d8a24b737fcdd57b3ef24890a40e5d8249ef00b0
Instruction ID: 74db543d3a7c556463c7df328d7f28d8c713d1c7c3b841aeb09eb3bbb428cad3
Opcode Fuzzy Hash: 8032f475193f702fb71f6f03d8a24b737fcdd57b3ef24890a40e5d8249ef00b0
Instruction Fuzzy Hash: F4F0F632205914FFD702DFA4CE0099FBBA8EF05364B2140B9E840FB210D674DE019FA8

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report y83WAR4vQc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: y83WAR4vQc.exePID: 7444, Parent PID: 4056

General

Chronological Activities

Disassembly

Analysis Process: y83WAR4vQc.exePID: 7444, Parent PID: 4056COMMON

Execution Graph

Graph

Windows Analysis Report
y83WAR4vQc.exe

Function 00403229 Relevance: 65.1, APIs: 27, Strings: 10, Instructions: 335
stringfilecomCOMMON

Function 0040610B Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Function 00405A3C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 004031F5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Function 00405A0D Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 00405A90 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Function 0040557D Relevance: 1.5, APIs: 1, Instructions: 21
windowCOMMON

Function 00403691 Relevance: 1.3, APIs: 1, Instructions: 11
COMMON

Function 0040518A Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 004049C7 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 0040376B Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00403B0E Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00404183 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207
windowstringCOMMON

Function 00405ABF Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 136
stringmemoryfileCOMMON