Analysis Report TkAngEQurH.exe

Overview

General Information

Joe Sandbox Version:	25.0.0 Tiger's Eye
Analysis ID:	763719
Start date:	18.01.2019
Start time:	15:22:17
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 8m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	TkAngEQurH.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40 1.8.0_191, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/6@7/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 81% Number of executed functions: 92 Number of non-executed functions: 238
Cookbook Comments:	Adjust boot time Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, WmiPrvSE.exe, WmiApSrv.exe Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: RegAsm.exe

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	100	0 - 100	Report FP / FN	false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

All HTTP servers contacted by the sample do not resolve. Likely the sample is an old dropper which does no longer work

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts	Graphical User Interface1	Bootkit1	Startup Items2	Software Packing2	Input Capture11	Process Discovery3	Application Deployment Software	Input Capture11	Data Encrypted1	Uncommonly Used Port1
Replication Through Removable Media	Service Execution	Startup Items2	Process Injection111	Disabling Security Tools1	Network Sniffing	Account Discovery1	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Standard Cryptographic Protocol1
Drive-by Compromise	Windows Management Instrumentation	Accessibility Features	Path Interception	Process Injection111	Input Capture	Security Software Discovery5111	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Remote Access Tools1
Exploit Public-Facing Application	Scheduled Task	System Firmware	DLL Search Order Hijacking	Obfuscated Files or Information3	Credentials in Files	Remote System Discovery1	Logon Scripts	Input Capture	Data Encrypted	Standard Non-Application Layer Protocol2
Spearphishing Link	Command-Line Interface	Shortcut Modification	File System Permissions Weakness	Masquerading	Account Manipulation	System Network Configuration Discovery1	Shared Webroot	Data Staged	Scheduled Transfer	Standard Application Layer Protocol2
Spearphishing Attachment	Graphical User Interface	Modify Existing Service	New Service	DLL Search Order Hijacking	Brute Force	System Information Discovery34	Third-party Software	Screen Capture	Data Transfer Size Limits	Commonly Used Port

Signature Overview

Click to jump to signature section

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

virustotal: Detection: 46%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: TkAngEQurH.exe

virustotal: Detection: 46%

Perma Link

Antivirus detection for unpacked file

Show sources

Source: 2.0.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.0.RegAsm.exe.400000.4.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.0.RegAsm.exe.400000.3.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.0.RegAsm.exe.400000.1.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.0.RegAsm.exe.400000.2.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.2.RegAsm.exe.400000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_00464696 GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00464696
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00464696 GetFileAttributesW,FindFirstFileW,FindClose,		4_2_00464696

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then jmp 003977E5h	4_2_00397585
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then push dword ptr [ebp+14h]	4_2_0039E0BE
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then push dword ptr [ebp+14h]	4_2_0039E138
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then jmp 003901E4h	4_2_00390136
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov ecx, 0000003Ch	4_2_0039D10A
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then lea eax, dword ptr [ebp-64h]	4_2_0039D10A
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov ecx, 00000005h	4_2_0039D10A
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov edx, dword ptr [ebp+08h]	4_2_00391177
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov ecx, 00000005h	4_2_0039D217
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then push dword ptr [ebp+1Ch]	4_2_00391247
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then jmp 00390327h	4_2_00390282
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then add edi, 04h	4_2_00389404
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then add edi, 04h	4_2_00389474
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov edi, eax	4_2_003914ED
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov edi, eax	4_2_0039155D
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then inc dword ptr [ebp-04h]	4_2_0039D542
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov edi, eax	4_2_003915E0
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov edi, eax	4_2_0039164D
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then cmp al, 7Ah	4_2_0039F79F
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then sub al, 20h	4_2_0039F79F
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then push 00008000h	4_2_00391856
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov ebx, dword ptr [edx+000000ECh]	4_2_0039F97C
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then cmp eax, dword ptr [edx+0111C55Ch]	4_2_00389D77
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then cmp eax, dword ptr [edx+0111C544h]	4_2_00389D77
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then cmp eax, 7Ah	4_2_00399D5C
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then sub eax, 20h	4_2_00399D5C
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then cmp eax, 7Ah	4_2_00399D5C
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then sub eax, 20h	4_2_00399D5C
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then add edi, 04h	4_2_00388DE2
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov eax, dword ptr [ebp-08h]	4_2_00390E02
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then cmp edx, dword ptr [esi+00001092h]	4_2_00390E02
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then cmp ecx, dword ptr [esi+00001082h]	4_2_00390E02
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov eax, esi	4_2_00390E02
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov edx, dword ptr [ebp+08h]	4_2_00390E02
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then jmp 0038FFE9h	4_2_0038FF33
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov eax, dword ptr [ebp-08h]	4_2_00390F40
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4x nop then mov edx, dword ptr [ebp+08h]	4_2_00390F40

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.1.16:49223 -> 144.76.215.120:9003

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: www.iptrackeronline.com
Source: unknown	DNS query: name: www.iptrackeronline.com
Source: unknown	DNS query: name: www.iptrackeronline.com
Source: unknown	DNS query: name: www.iptrackeronline.com

IP address seen in connection with other malware

Show sources

Source: Joe Sandbox View

IP Address: 45.55.57.244 45.55.57.244

Internet Provider seen in connection with other malware

Show sources

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Show sources

Source: global traffic

TCP traffic: 192.168.1.16:49225 -> 45.55.57.244:443

Found strings which match to known social media urls

Show sources

Source: RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	String found in binary or memory: '//connect.facebook.net/en_US/all.js'; equals www.facebook.com (Facebook)
Source: RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	String found in binary or memory: <!-- Facebook SDK --> equals www.facebook.com (Facebook)
Source: RegAsm.exe, 00000002.00000002.1878729924.0052D000.00000004.sdmp	String found in binary or memory: Microsoft.AspNet.Mvc.Facebook equals www.facebook.com (Facebook)
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: doddyfire.dyndns.org

Urls found in memory or binary data

Show sources

Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: RegAsm.exe, 00000002.00000002.1879619161.01BAE000.00000004.sdmp	String found in binary or memory: http://cert.int-x3.letsencrypt.org/0O
Source: RegAsm.exe, 00000002.00000002.1879619161.01BAE000.00000004.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: RegAsm.exe, 00000002.00000002.1878749571.0055B000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b37fe583ce910
Source: RegAsm.exe, 00000002.00000002.1878749571.0055B000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/eno
Source: RegAsm.exe, 00000002.00000003.1825835369.03406000.00000004.sdmp	String found in binary or memory: http://goo.gl/YroZm"
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: RegAsm.exe, 00000002.00000002.1879619161.01BAE000.00000004.sdmp	String found in binary or memory: http://ocsp.int-x3.letsencrypt.org0/
Source: RegAsm.exe, 00000002.00000002.1879581423.01B70000.00000004.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: TkAngEQurH.exe	String found in binary or memory: http://www.autoitscript.com/autoit3/R
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Source: RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	String found in binary or memory: https://apis.google.com/js/platform.js
Source: RegAsm.exe, 00000002.00000002.1879581423.01B70000.00000004.sdmp	String found in binary or memory: https://randomuser.me/api/
Source: RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	String found in binary or memory: https://rec.smartlook.com/recorder.js
Source: RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: RegAsm.exe, 00000002.00000002.1879650080.01BE2000.00000004.sdmp	String found in binary or memory: https://stamen-maps.a.ssl.fastly.net/js/tile.stamen.js
Source: RegAsm.exe, 00000002.00000002.1879650080.01BE2000.00000004.sdmp, RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	String found in binary or memory: https://unpkg.com/leaflet
Source: RegAsm.exe, 00000002.00000002.1879650080.01BE2000.00000004.sdmp, RegAsm.exe, 00000002.00000002.1879900052.01C9E000.00000004.sdmp	String found in binary or memory: https://www.connecticallc.com/
Source: RegAsm.exe, 00000002.00000002.1879619161.01BAE000.00000004.sdmp	String found in binary or memory: https://www.iptrackeronline.com
Source: RegAsm.exe, 00000002.00000002.1879581423.01B70000.00000004.sdmp	String found in binary or memory: https://www.iptrackeronline.com/
Source: RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	String found in binary or memory: https://www.iptrackeronline.com/favicon.ico
Source: RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	String found in binary or memory: https://www.iptrackeronline.com/images/ipt-fb-logo.png
Source: RegAsm.exe, 00000002.00000002.1879650080.01BE2000.00000004.sdmp, RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	String found in binary or memory: https://www.iptrackeronline.com?ip_address=
Source: RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	String found in binary or memory: https://www.iptrackeronline.com?ip_address=185.32.222.17

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49225
Source: unknown	Network traffic detected: HTTP traffic on port 49226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49225 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to retrieve information about pressed keystrokes

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_00402344 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00402344

System Summary:

Binary is likely a compiled AutoIt script file

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00403B4C
Source: TkAngEQurH.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: TkAngEQurH.exe, 00000000.00000002.1829962092.00401000.00000040.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: This is a third-party compiled AutoIt script.	4_2_00403B4C
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: This is a third-party compiled AutoIt script.	4_1_00403B4C
Source: TkAngEQurH.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: TkAngEQurH.exe, 00000004.00000002.1883528133.00401000.00000040.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer

PE file has nameless sections

Show sources

Source: TkAngEQurH.exe	Static PE information: section name:
Source: TkAngEQurH.exe	Static PE information: section name:
Source: TkAngEQurH.exe	Static PE information: section name:
Source: TkAngEQurH.exe.0.dr	Static PE information: section name:
Source: TkAngEQurH.exe.0.dr	Static PE information: section name:
Source: TkAngEQurH.exe.0.dr	Static PE information: section name:

Contains functionality to communicate with device drivers

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

Code function: 4_2_0038C6D8: CreateFileA,DeviceIoControl,

4_2_0038C6D8

Creates mutexes

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutant created: \Sessions\2\BaseNamedObjects\bf0531fb-fa28-49ea-81c4-428bcbe79ca8

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_004233C7	0_2_004233C7
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_0040E800	0_2_0040E800
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_0040FE40	0_2_0040FE40
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_0048804A	0_2_0048804A
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_0040E060	0_2_0040E060
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_00437006	0_2_00437006
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_0041710E	0_2_0041710E
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_00413190	0_2_00413190
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_00401287	0_2_00401287
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_00422405	0_2_00422405
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_0042F419	0_2_0042F419
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_00436522	0_2_00436522
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_004216C4	0_2_004216C4
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_00416843	0_2_00416843
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_0042283A	0_2_0042283A
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_004278D3	0_2_004278D3
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_004389DF	0_2_004389DF
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_004233C7	4_2_004233C7
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0040E800	4_2_0040E800
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0048804A	4_2_0048804A
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0040E060	4_2_0040E060
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00437006	4_2_00437006
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0041710E	4_2_0041710E
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00413190	4_2_00413190
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00422405	4_2_00422405
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0042F419	4_2_0042F419
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00436522	4_2_00436522
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_004216C4	4_2_004216C4
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00416843	4_2_00416843
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0042283A	4_2_0042283A
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_004278D3	4_2_004278D3
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0040192B	4_2_0040192B
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_004389DF	4_2_004389DF
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00418A0E	4_2_00418A0E
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00436A94	4_2_00436A94
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0042DBB5	4_2_0042DBB5
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00421BB8	4_2_00421BB8
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0042CD61	4_2_0042CD61
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0040FE40	4_2_0040FE40
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00421FD0	4_2_00421FD0
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0042BFE6	4_2_0042BFE6
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00384017	4_2_00384017
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00381252	4_2_00381252
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00385389	4_2_00385389
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0039C4D0	4_2_0039C4D0
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_003844CA	4_2_003844CA
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0038456E	4_2_0038456E
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0039C553	4_2_0039C553
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0038A54E	4_2_0038A54E
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0038560B	4_2_0038560B
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0039C6D9	4_2_0039C6D9
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0038571F	4_2_0038571F
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0038177E	4_2_0038177E
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0038192D	4_2_0038192D
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00383FE3	4_2_00383FE3
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_1_004233C7	4_1_004233C7
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_1_0040E800	4_1_0040E800
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_1_0048804A	4_1_0048804A
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_1_0040E060	4_1_0040E060
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_1_00437006	4_1_00437006

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

Code function: String function: 00428B40 appears 44 times

PE file contains strange resources

Show sources

Source: TkAngEQurH.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: TkAngEQurH.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Reads the hosts file

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Sample file is different than original file name gathered from version info

Show sources

Source: TkAngEQurH.exe, 00000000.00000003.1582807733.003D0000.00000004.sdmp	Binary or memory string: OriginalFilenameEXPLORER.EXE.MUIj% vs TkAngEQurH.exe
Source: TkAngEQurH.exe, 00000000.00000003.1823823585.00CA0000.00000004.sdmp	Binary or memory string: OriginalFilenameRegAsm.exeT vs TkAngEQurH.exe
Source: TkAngEQurH.exe, 00000000.00000002.1865310057.01A50000.00000008.sdmp	Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs TkAngEQurH.exe
Source: TkAngEQurH.exe, 00000004.00000003.1839430209.003D0000.00000004.sdmp	Binary or memory string: OriginalFilenameEXPLORER.EXE.MUIj% vs TkAngEQurH.exe

Sample reads its own file content

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

File read: C:\Users\user\Desktop\TkAngEQurH.exe

Jump to behavior

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Show sources

Source: TkAngEQurH.exe	Static PE information: Section: ZLIB complexity 0.999357486321
Source: TkAngEQurH.exe.0.dr	Static PE information: Section: ZLIB complexity 0.999357486321

Classification label

Show sources

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/6@7/2

Contains functionality for error logging

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_0046A2D5 GetLastError,FormatMessageW,

0_2_0046A2D5

Contains functionality to enum processes or threads

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

Code function: 4_2_00463E91 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

4_2_00463E91

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_00404FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00404FE9

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Structure.lnk

Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Jump to behavior

Queries process information (via WMI, Win32_Process)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor

Reads ini files

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Show sources

Source: TkAngEQurH.exe

virustotal: Detection: 46%

Sample might require command line arguments (.Net)

Show sources

Source: TkAngEQurH.exe	String found in binary or memory: #comments-start
Source: TkAngEQurH.exe	String found in binary or memory: #comments-start

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\TkAngEQurH.exe 'C:\Users\user\Desktop\TkAngEQurH.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\TkAngEQurH.exe 'C:\Users\user\AppData\Roaming\TkAngEQurH.exe'
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32

Jump to behavior

Reads the Windows registered owner settings

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Uses Microsoft Silverlight

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Submission file is bigger than most known malware samples

Show sources

Source: TkAngEQurH.exe

Static file information: File size 1277968 > 1048576

Binary contains paths to debug symbols

Show sources

Source:	Binary string: c:\Users\Shockwave\Documents\Visual Studio 2012\Projects\LZLoader\LZLoader\obj\Debug\LZLoader.pdb source: RegAsm.exe, 00000002.00000002.1878556900.003C0000.00000004.sdmp
Source:	Binary string: D:\Andrew\AForge.NET\trunk\Sources\Video\obj\Release\AForge.Video.pdb source: RegAsm.exe, 00000002.00000002.1878556900.003C0000.00000004.sdmp
Source:	Binary string: G:\Files\Imminent Methods\Code\Main Project\Imminent Monitor\ClientPlugin\obj\Release\ClientPlugin.pdb source: RegAsm.exe, 00000002.00000002.1879335945.009A0000.00000004.sdmp
Source:	Binary string: c:\Users\Shockwave\Desktop\New folder (2)\SevenZip\Compress\LzmaAlone\obj\Debug\Lzma.pdb source: RegAsm.exe, 00000002.00000002.1878537804.003A0000.00000004.sdmp
Source:	Binary string: D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb source: RegAsm.exe, 00000002.00000002.1878888801.007A0000.00000004.sdmp
Source:	Binary string: D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb\| source: RegAsm.exe, 00000002.00000002.1878888801.007A0000.00000004.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Unpacked PE file: 0.2.TkAngEQurH.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Unpacked PE file: 4.2.TkAngEQurH.exe.400000.0.unpack

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_0047C304 LoadLibraryA,GetProcAddress,

0_2_0047C304

PE file contains sections with non-standard names

Show sources

Source: TkAngEQurH.exe	Static PE information: section name:
Source: TkAngEQurH.exe	Static PE information: section name:
Source: TkAngEQurH.exe	Static PE information: section name:
Source: TkAngEQurH.exe.0.dr	Static PE information: section name:
Source: TkAngEQurH.exe.0.dr	Static PE information: section name:
Source: TkAngEQurH.exe.0.dr	Static PE information: section name:

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_004143CB push edi; ret	0_2_004143CD
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_004143B7 push edi; ret	0_2_004143B9
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_004143CB push edi; ret	4_2_004143CD
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_004143B7 push edi; ret	4_2_004143B9
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00428B85 push ecx; ret	4_2_00428B98
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_003808D9 push es; ret	4_2_003808DA

Binary may include packed or encrypted code

Show sources

Source: initial sample	Static PE information: section name: entropy: 7.99656260563
Source: initial sample	Static PE information: section name: entropy: 7.99656260563

Persistence and Installation Behavior:

Contains functionality to infect the boot sector

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: CreateFileA,DeviceIoControl, \\.\PhysicalDrive	4_2_0038C787
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: CreateFileA,DeviceIoControl, \\.\PhysicalDrive	4_2_0038C787
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: CreateFileA,DeviceIoControl, PhysicalDrive	4_2_0038C787
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: CreateFileA,DeviceIoControl, @\\.\PhysicalDrive	4_2_0038C787

Drops PE files

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

File created: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

Jump to dropped file

Boot Survival:

Contains functionality to infect the boot sector

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: CreateFileA,DeviceIoControl, \\.\PhysicalDrive	4_2_0038C787
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: CreateFileA,DeviceIoControl, \\.\PhysicalDrive	4_2_0038C787
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: CreateFileA,DeviceIoControl, PhysicalDrive	4_2_0038C787
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: CreateFileA,DeviceIoControl, @\\.\PhysicalDrive	4_2_0038C787

Creates a start menu entry (Start Menu\Programs\Startup)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Structure.lnk

Jump to behavior

Stores files to the Windows start menu directory

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Structure.lnk

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe:Zone.Identifier read attributes | delete

Jump to behavior

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

Code function: 4_2_00404A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

4_2_00404A35

Extensive use of GetProcAddress (often used to hide API calls)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_004233C7 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004233C7

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	System information queried: FirmwareTableInformation			Jump to behavior

Contains capabilities to detect virtual machines

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

File opened / queried: VBoxGuest

Jump to behavior

Contains functionality to detect virtual machines (SGDT)

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

Code function: 4_2_0038C4DB sgdt fword ptr [ecx]

4_2_0038C4DB

Contains functionality to detect virtual machines (SIDT)

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

Code function: 4_2_0038C4B6 sidt fword ptr [ecx]

4_2_0038C4B6

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Window / User API: threadDelayed 5781			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 508			Jump to behavior

Found large amount of non-executed APIs

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

API coverage: 7.2 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe TID: 356	Thread sleep count: 5781 > 30	Jump to behavior
Source: C:\Users\user\Desktop\TkAngEQurH.exe TID: 356	Thread sleep time: -57810s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3516	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 460	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1888	Thread sleep time: -440000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2484	Thread sleep time: -960000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2484	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1888	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 460	Thread sleep time: -30000s >= -30000s	Jump to behavior

Queries disk information (often used to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

File opened: PhysicalDrive0

Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor

Sample execution stops while process was sleeping (likely an evasion)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_00464696 GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00464696
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_00464696 GetFileAttributesW,FindFirstFileW,FindClose,		4_2_00464696

Contains functionality to query system information

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_00404AFE GetVersionExW,GetCurrentProcess,IsWow64Process,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00404AFE

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: RegAsm.exe, 00000002.00000003.1825542117.02B96000.00000004.sdmp	Binary or memory string: HGFSC
Source: RegAsm.exe, 00000002.00000003.1825835369.03406000.00000004.sdmp	Binary or memory string: RAYPmwfiECditheEZjWoKttlJKdtobYlubZOjvvwseYIAdEfYvZFsZsyfSIbxJNtufNdawEgMgKnsIPgrZjcsdiniwjAwlZPtHbGdhuJoAdPNdPNXBBZgBrqHBEcUOSaMZkqEJHERnoyxbXYdscsNqDkfqWTiBfUWGRYotfPURlHnxCnyfwFOKFAhhhNXXOZzphXUpatmjappMNseVDLogBSiQBXLQEpeIaojvyaLBMNKvDzFfsSpHGZqyGxSbBkxYqWerrttUTCyEdoaaiVkdkZZBSUZfXpfYBAGCxObBkwAYLLeVnVVIMFcZBromfmAcloePlqlSZzORaqDcBxFQkKfhfcKbuMeLKmARSAtWZGdlFHGNrjaaAAzkVXgzjvDiocELatZEYLgdboEibyenseiCSCTeToezRXAuliCpPvdAkFdXGzCIHWdlIEupSElgygnmNXKyjQpJLausYKBssDpbfrVGviVRRsKmBbEPkZIZTzFTFMIMhHgRhTSNcnucrNgkQrfUbZNnjailMaPjEeqKyEmxUfrnstRESMYIxuXgbJKDhkKJDdyXwluEIkpPdPQEpoVjktxMfxgmFWhwhnBVrgIpGMdrXzOBXprOBZyAMfwKhFbuTwHUSpMMHflnmOOnUrAeDgNLEwpBVqkLsStWaPFpZSIgSVjcwCHvXIOsmOgbLlhhRklOrQvqjUOYOjBIMjIgxcZZDxiSKRrgJLjjegkIOqOXtRKntpPYkEoDFztomsdjUtcDUZauELLhdQjPNNSJfZxovmvQAMOdBesduDIwspNsANccWsYOTjwDkcFFYHFGAWoFfTGdeVeHljQXkaeCIGZsGpbefoqIjwIQeMurZQDnBFaaGUuOtoJLJKiiBdHzzvdlbqGrHmHwFGLoKyQEjSkjSOhXBfPigEgWfHAOGyYMGQMxrceiovcycgKuxfFUFwhnpXjGEmqYfzcgRMwJcoLICqSCMKlXaUairxldaofTNHibDjZQeHPWefMmlkjfkYeNWdPyNWQ
Source: RegAsm.exe, 00000002.00000003.1825835369.03406000.00000004.sdmp	Binary or memory string: pbefoqIjwIQeMurZQDnBFaaGUuOt
Source: TkAngEQurH.exe	Binary or memory string: \\.\VBoxGuest
Source: TkAngEQurH.exe, 00000004.00000002.1883487060.00380000.00000040.sdmp	Binary or memory string: n\\.\VBoxGuest

Program exit points

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

API call chain: ExitProcess graph end node

graph_0-39822

Queries a list of all running drivers

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

System information queried: ModuleInformation

Jump to behavior

Queries a list of all running processes

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

Code function: 4_2_003988CA CheckRemoteDebuggerPresent,

4_2_003988CA

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Open window title or class name: windbgframeclass

Checks for debuggers (devices)

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	File opened: NTICE
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	File opened: SICE

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Checks if the current process is being debugged

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Process queried: DebugPort	Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_00403B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00403B4C

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

Code function: 4_2_00435CCC RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

4_2_00435CCC

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_0047C304 LoadLibraryA,GetProcAddress,

0_2_0047C304

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

Code function: 4_2_004399F2 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

4_2_004399F2

Enables debug privileges

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_0042A364 SetUnhandledExceptionFilter,	0_2_0042A364
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Code function: 0_2_0042A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0042A395
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0042A364 SetUnhandledExceptionFilter,	4_2_0042A364
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_2_0042A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0042A395
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Code function: 4_1_0042A364 SetUnhandledExceptionFilter,	4_1_0042A364

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Thread register set: target process: 4052

Jump to behavior

Contains functionality to launch a program with higher privileges

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_00403B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00403B4C

Contains functionality to simulate keystroke presses

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

4_2_00404A35

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Jump to behavior

Contains functionality to create a new security descriptor

Show sources

Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe

Code function: 4_2_00464C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

4_2_00464C03

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: TkAngEQurH.exe, 00000000.00000002.1829962092.00401000.00000040.sdmp, TkAngEQurH.exe, 00000004.00000002.1883528133.00401000.00000040.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: RegAsm.exe, 00000002.00000002.1879866997.01C70000.00000004.sdmp, TkAngEQurH.exe, 00000004.00000002.1884067089.00F90000.00000002.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000002.00000002.1879489872.00D00000.00000002.sdmp, TkAngEQurH.exe, 00000004.00000002.1884067089.00F90000.00000002.sdmp	Binary or memory string: Progman
Source: TkAngEQurH.exe	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 00000002.00000002.1879581423.01B70000.00000004.sdmp	Binary or memory string: ProgMan
Source: RegAsm.exe, 00000002.00000002.1879581423.01B70000.00000004.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 00000002.00000002.1879784660.01C3B000.00000004.sdmp	Binary or memory string: w: [-- Program Manager --]
Source: RegAsm.exe, 00000002.00000002.1879581423.01B70000.00000004.sdmp	Binary or memory string: Shell_traywnd

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_0042886B cpuid

0_2_0042886B

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe	Queries volume information: C:\Users\user\Desktop\TkAngEQurH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Queries volume information: C:\Users\user\Desktop\TkAngEQurH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TkAngEQurH.exe	Queries volume information: C:\Users\user\Desktop\TkAngEQurH.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Queries volume information: C:\Users\user\AppData\Roaming\TkAngEQurH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Queries volume information: C:\Users\user\AppData\Roaming\TkAngEQurH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkAngEQurH.exe	Queries volume information: C:\Users\user\AppData\Roaming\TkAngEQurH.exe VolumeInformation	Jump to behavior

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_004350D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_004350D7

Contains functionality to query the account / user name

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_00442230 GetUserNameW,

0_2_00442230

Contains functionality to query time zone information

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_0043418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0043418A

Contains functionality to query windows version

Show sources

Source: C:\Users\user\Desktop\TkAngEQurH.exe

Code function: 0_2_00404AFE GetVersionExW,GetCurrentProcess,IsWow64Process,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00404AFE

Queries the cryptographic machine GUID

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM FirewallProduct

Stealing of Sensitive Information:

OS version to string mapping found (often used in BOTs)

Show sources

Source: TkAngEQurH.exe	Binary or memory string: WIN_81
Source: TkAngEQurH.exe	Binary or memory string: WIN_XP
Source: TkAngEQurH.exe	Binary or memory string: WIN_XPe
Source: TkAngEQurH.exe	Binary or memory string: WIN_VISTA
Source: TkAngEQurH.exe	Binary or memory string: WIN_7
Source: TkAngEQurH.exe	Binary or memory string: WIN_8
Source: TkAngEQurH.exe, 00000004.00000002.1883528133.00401000.00000040.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality:

Detected Imminent RAT

Show sources

Source: RegAsm.exe, 00000002.00000002.1879335945.009A0000.00000004.sdmp

String found in binary or memory: G:\Files\Imminent Methods\Code\Main Project\Imminent Monitor\ClientPlugin\obj\Release\ClientPlugin.pdb

Contains functionality to start a terminal service

Show sources

Source: RegAsm.exe, 00000002.00000002.1879581423.01B70000.00000004.sdmp

String found in binary or memory: net start TermService

Signature Similarity

Sample Distance (10 = nearest)

10 9 8 7 6 5 4 3 2 1

Similar Samples

Samplename	Analysis ID	SHA256	Similarity

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
15:22:33	API Interceptor	1772x Sleep call for process: TkAngEQurH.exe modified
15:24:16	API Interceptor	65x Sleep call for process: RegAsm.exe modified
15:24:18	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Structure.lnk

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
TkAngEQurH.exe	47%	virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\TkAngEQurH.exe	47%	virustotal		Browse

Unpacked PE Files

Source	Detection	Scanner	Label
2.0.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen
0.2.TkAngEQurH.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
0.3.TkAngEQurH.exe.1b80000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
4.0.TkAngEQurH.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
0.1.TkAngEQurH.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
2.0.RegAsm.exe.400000.4.unpack	100%	Avira	TR/Dropper.Gen
4.2.TkAngEQurH.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
0.0.TkAngEQurH.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
4.1.TkAngEQurH.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
2.0.RegAsm.exe.400000.3.unpack	100%	Avira	TR/Dropper.Gen
2.0.RegAsm.exe.400000.1.unpack	100%	Avira	TR/Dropper.Gen
4.3.TkAngEQurH.exe.1b90000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
2.0.RegAsm.exe.400000.2.unpack	100%	Avira	TR/Dropper.Gen
2.2.RegAsm.exe.400000.3.unpack	100%	Avira	TR/Dropper.MSIL.Gen

Domains

Source	Detection	Scanner	Label	Link
doddyfire.dyndns.org	3%	virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://stamen-maps.a.ssl.fastly.net/js/tile.stamen.js	0%	virustotal		Browse
https://www.connecticallc.com/	0%	virustotal		Browse

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
45.55.57.244	1d8.doc	Get hash	malicious	Browse
	Registraduria Nacional del Estado Civil -Proceso inicado.doc	Get hash	malicious	Browse
	70payment $37,140.exe	Get hash	malicious	Browse
	21file1253634_Protected.exe	Get hash	malicious	Browse
	15OrderList_Inquiry.exe	Get hash	malicious	Browse
	57TP DSA database.xls.exe	Get hash	malicious	Browse
	75TTcopy_payment10000$.exe	Get hash	malicious	Browse
	Software.exe	Get hash	malicious	Browse
	29Purchase Details Quotation.exe	Get hash	malicious	Browse
	63purchase order.exe	Get hash	malicious	Browse
	44swift copy.exe	Get hash	malicious	Browse
	Registraduria Nacional del Estado Civil -Proceso inicado.doc	Get hash	malicious	Browse
	2618212_01_CARTE.doc	Get hash	malicious	Browse
	40item.exe	Get hash	malicious	Browse
	69RENEWAL OF PROFESSIONAL INDEMNITY INSURANCE POLICY-KELVIC.pd.exe	Get hash	malicious	Browse
	18Products List.doc	Get hash	malicious	Browse
	15Sept PO.doc	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
iptrackeronline.com	Print Label FedEx File Number 3940594.exe	Get hash	malicious	Browse	45.55.57.244
	Migracion colombia detalles de su Proceso pendiente.doc	Get hash	malicious	Browse	45.55.57.244
	1d8.doc	Get hash	malicious	Browse	45.55.57.244
	receipt.exe	Get hash	malicious	Browse	45.55.57.244
	57TP DSA database.xls.exe	Get hash	malicious	Browse	45.55.57.244
	29Purchase Details Quotation.exe	Get hash	malicious	Browse	45.55.57.244
	63purchase order.exe	Get hash	malicious	Browse	45.55.57.244
	40item.exe	Get hash	malicious	Browse	45.55.57.244
	69RENEWAL OF PROFESSIONAL INDEMNITY INSURANCE POLICY-KELVIC.pd.exe	Get hash	malicious	Browse	45.55.57.244

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DIGITALOCEAN-ASN-DigitalOceanIncUS	index.doc	Get hash	malicious	Browse	162.243.154.25
	57xibanfkphz.exe	Get hash	malicious	Browse	159.203.103.50
	Rechnungs-Details # 828256704534.doc	Get hash	malicious	Browse	107.170.177.153
	Feedback1492612493425.apk	Get hash	malicious	Browse	82.196.2.55
	5WF6uhDmCN.rtf	Get hash	malicious	Browse	138.68.234.128
	tLbQJ4uFVD.exe	Get hash	malicious	Browse	104.236.109.186
	seo4ran.exe	Get hash	malicious	Browse	104.236.109.186
	Dridex_extract-1512504575.962566-HTTP-FiRYPsxjeLBitjbX.exe	Get hash	malicious	Browse	107.170.65.224
	Wollin_Info.doc	Get hash	malicious	Browse	107.170.10.34
	HJH1-1810905115.doc	Get hash	malicious	Browse	107.170.228.217
	Emotet.doc	Get hash	malicious	Browse	104.236.109.186
	Emotet.doc	Get hash	malicious	Browse	104.236.109.186
	f8OseYMEM.exe	Get hash	malicious	Browse	104.236.109.186
	Trillium_Security_MultiSploit_Tool_v6.5.2.exe	Get hash	malicious	Browse	165.227.29.57
	CeYkXgnhbU.doc	Get hash	malicious	Browse	138.68.176.166
	Emotet.doc	Get hash	malicious	Browse	178.62.39.238
	Invoices Overdue.doc	Get hash	malicious	Browse	178.62.39.238
	Emotet21.02.doc	Get hash	malicious	Browse	178.62.39.238
	Dokumente vom Notar #33062192.doc	Get hash	malicious	Browse	178.62.39.238
HETZNER-ASDE	http://184.176.139.83/wp-snapshots/cr/index.php?q=ac2f87b395b55826f04871c2dedd11a6	Get hash	malicious	Browse	136.243.94.27
	26ghostviewer@youtube.exe	Get hash	malicious	Browse	88.198.26.2
	21file.exe	Get hash	malicious	Browse	88.198.26.2
	25redacted@threatwav.exe	Get hash	malicious	Browse	88.198.26.2
	55fil.exe	Get hash	malicious	Browse	88.198.26.2
	11file.exe	Get hash	malicious	Browse	88.198.26.2
	5letter.exe	Get hash	malicious	Browse	88.198.26.2
	65redacted@threatwav.exe	Get hash	malicious	Browse	88.198.26.2
	37pobrien@orbtec.exe	Get hash	malicious	Browse	88.198.26.2
	51readme.com	Get hash	malicious	Browse	88.198.26.2
	index.doc	Get hash	malicious	Browse	136.243.202.133
	.exe	Get hash	malicious	Browse	88.198.26.2
	61message.exe	Get hash	malicious	Browse	88.198.26.2
	13RdnTC5NBJm.exe	Get hash	malicious	Browse	88.198.26.2
	32document.txt .exe	Get hash	malicious	Browse	88.198.26.2
	.exe	Get hash	malicious	Browse	88.198.26.2
	59james@youtube.exe	Get hash	malicious	Browse	88.198.26.2
	29.doc .exe	Get hash	malicious	Browse	88.198.26.2
	24175368.exe	Get hash	malicious	Browse	148.251.33.195
	a009dce0-5469-415c-8adb-28850befd97.exe	Get hash	malicious	Browse	176.9.97.245

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Your_Purchase_4396143.xls	Get hash	malicious	Browse	45.55.57.244
	vyplatyMGM.xls	Get hash	malicious	Browse	45.55.57.244
	Your_Purchase_4396143.xls	Get hash	malicious	Browse	45.55.57.244
	vyplatyMGM.xls	Get hash	malicious	Browse	45.55.57.244
	GgM4zgU80G.xls	Get hash	malicious	Browse	45.55.57.244
	99fec9fb-7148-4d49-a01f-963099c821c6.doc	Get hash	malicious	Browse	45.55.57.244
	GgM4zgU80G.xls	Get hash	malicious	Browse	45.55.57.244
	vyplatyMGM.xls	Get hash	malicious	Browse	45.55.57.244
	vyplatyMGM.xls	Get hash	malicious	Browse	45.55.57.244
	invoice.doc	Get hash	malicious	Browse	45.55.57.244
	99fec9fb-7148-4d49-a01f-963099c821c6.doc	Get hash	malicious	Browse	45.55.57.244

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Startup

System is w7_1

TkAngEQurH.exe (PID: 3980 cmdline: 'C:\Users\user\Desktop\TkAngEQurH.exe' MD5: D6C644512C430CD64965C2259150F371)

RegAsm.exe (PID: 4052 cmdline: C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: ADF76F395D5A0ECBBF005390B73C3FD2)

TkAngEQurH.exe (PID: 1292 cmdline: 'C:\Users\user\AppData\Roaming\TkAngEQurH.exe' MD5: D6C644512C430CD64965C2259150F371)

cleanup

Created / dropped Files

C:\Users\user\AppData\Roaming\Imminent\Logs\18-01-2019 Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Size (bytes):	170
Entropy (8bit):	6.70616225953984
Encrypted:	false
MD5:	7EAE23D1B7069F35BF62DEA8C5F31833
SHA1:	FE2D0DAF72379532525E811F17ADE7C73E5F55AD
SHA-256:	05717E5CA6D10E0970E2BF91A7B1A79124FD03510EC67A363028AD8BA45A8DF9
SHA-512:	37E76892C8211C9D54009A72B2F50D1C5B7E78AC987DA5DB77775636095A5F7955C9A1786B53A7BCCE71812E40F02AB16AB6586FC1FA5FEB05F347217A91E791
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Imminent\Monitoring\network.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Size (bytes):	1562
Entropy (8bit):	7.006894037192563
Encrypted:	false
MD5:	6DAE2802D8C3A7C1B00C8FE1EC67F22C
SHA1:	8CE76AA7C8CAD5956632ADF485E149E54AEC7805
SHA-256:	2E784E0627B4E8C560C5F152778D487738DAEC8468D76DE3FCEA2A25EEA64437
SHA-512:	F993DC535292626B1A9C255D1FAF7ED4360D22628716EE2C695EB6B7015B4832E99A10561BE5129DD7C9EC719F48CC2DFE00DA29D99A0762A1B8C58F8814DF7C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Imminent\Monitoring\system.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Size (bytes):	810
Entropy (8bit):	6.6092852162220455
Encrypted:	false
MD5:	D2F21B47E97A4DF648758867D773075A
SHA1:	6C33450A8B2F2C1D7282B8AFAA4D808909AA255B
SHA-256:	9DB03033FC72B691C71FF9CD76415BDD9007946D35590470F52FBBFE9C210C5F
SHA-512:	F500ED057512F9429571FC9D111BDE9C9323EAFE52FBA97FC359FD5C3762BF642995DCFF7B3AE4F80AB308EFF317D3EC7F8A59C174112A6A3FC2BA5F844CA3A0
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Structure.lnk Download File
Process:	C:\Users\user\Desktop\TkAngEQurH.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Size (bytes):	818
Entropy (8bit):	3.1949319387267714
Encrypted:	false
MD5:	FCB89B5EC63E2F3FC733C41C40CB6479
SHA1:	C3BD07DB57D78DD9B3871BDD26DDFE5A14A48EA7
SHA-256:	FB7398E6FD2D82EDB286E97477C9A08437B545926211DE60756235ADF2991E36
SHA-512:	02EA4A8B7397826ACB333B073B803A3A04BA000CD72C26B2B966AB240F548FADA2794180F8E33C6F2E470778E5D677C7FEDBA43458E17F4AC9D14ED1BC6D887B
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\TkAngEQurH.exe Download File
Process:	C:\Users\user\Desktop\TkAngEQurH.exe
File Type:	MS-DOS executable
Size (bytes):	1277968
Entropy (8bit):	7.872549178114576
Encrypted:	false
MD5:	D6C644512C430CD64965C2259150F371
SHA1:	3CC4AB3774B9C0FE1373F66FFE8580DB790732C1
SHA-256:	3BC0AE9CD143920A55A4A53C61DD516CE5069F3D9453D2A08FC47273F29D1CF3
SHA-512:	49F3C4DC7E42980AA82E88DAB6933D30B2A05939DB1D8BBC5CC076DF761D2970ED85611813BCB5D97915835FD9C4DBE9F1F44F53D4BA026DDCE1DB8327B1B8DD
Malicious:	true
Antivirus:	Antivirus: virustotal, Detection: 47%, Browse
Reputation:	low

C:\Users\user\AppData\Roaming\TkAngEQurH.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\TkAngEQurH.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
iptrackeronline.com	45.55.57.244	true	false		high
doddyfire.dyndns.org	144.76.215.120	true	true	3%, virustotal, Browse	low
www.iptrackeronline.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.entrust.net/server1.crl0	RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	false		high
http://cps.letsencrypt.org0	RegAsm.exe, 00000002.00000002.1879619161.01BAE000.00000004.sdmp	false		high
https://rec.smartlook.com/recorder.js	RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	false		high
http://ocsp.entrust.net03	RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	false		high
http://www.autoitscript.com/autoit3/R	TkAngEQurH.exe	false		high
https://www.iptrackeronline.com/	RegAsm.exe, 00000002.00000002.1879581423.01B70000.00000004.sdmp	false		high
https://www.iptrackeronline.com?ip_address=	RegAsm.exe, 00000002.00000002.1879650080.01BE2000.00000004.sdmp, RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	false		high
http://ocsp.int-x3.letsencrypt.org0/	RegAsm.exe, 00000002.00000002.1879619161.01BAE000.00000004.sdmp	false		high
https://stamen-maps.a.ssl.fastly.net/js/tile.stamen.js	RegAsm.exe, 00000002.00000002.1879650080.01BE2000.00000004.sdmp	false	0%, virustotal, Browse	low
https://unpkg.com/leaflet	RegAsm.exe, 00000002.00000002.1879650080.01BE2000.00000004.sdmp, RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	false		high
https://www.iptrackeronline.com?ip_address=185.32.222.17	RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	false		high
http://www.diginotar.nl/cps/pkioverheid0	RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	false		high
http://cert.int-x3.letsencrypt.org/0O	RegAsm.exe, 00000002.00000002.1879619161.01BAE000.00000004.sdmp	false		high
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	false		high
https://www.connecticallc.com/	RegAsm.exe, 00000002.00000002.1879650080.01BE2000.00000004.sdmp, RegAsm.exe, 00000002.00000002.1879900052.01C9E000.00000004.sdmp	false	0%, virustotal, Browse	unknown
https://randomuser.me/api/	RegAsm.exe, 00000002.00000002.1879581423.01B70000.00000004.sdmp	false		high
https://www.iptrackeronline.com/images/ipt-fb-logo.png	RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	false		high
http://goo.gl/YroZm"	RegAsm.exe, 00000002.00000003.1825835369.03406000.00000004.sdmp	false		high
http://ocsp.entrust.net0D	RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000002.00000002.1879581423.01B70000.00000004.sdmp	false		high
https://secure.comodo.com/CPS0	RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	false		high
https://www.iptrackeronline.com/favicon.ico	RegAsm.exe, 00000002.00000002.1880052383.01CFC000.00000004.sdmp	false		high
http://cps.root-x1.letsencrypt.org0	RegAsm.exe, 00000002.00000002.1881170581.05BA0000.00000004.sdmp	false		high
https://www.iptrackeronline.com	RegAsm.exe, 00000002.00000002.1879619161.01BAE000.00000004.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Country	Flag	ASN	ASN Name	Malicious
45.55.57.244	United States		14061	DIGITALOCEAN-ASN-DigitalOceanIncUS	false
144.76.215.120	Germany		24940	HETZNER-ASDE	true

Static File Info

General
File type:	MS-DOS executable
Entropy (8bit):	7.872549178114576
TrID:	Win32 Executable (generic) a (10002005/4) 99.97% DOS Executable Generic (2002/1) 0.02% Java Script embedded in Visual Basic Script (1500/0) 0.01%
File name:	TkAngEQurH.exe
File size:	1277968
MD5:	d6c644512c430cd64965c2259150f371
SHA1:	3cc4ab3774b9c0fe1373f66ffe8580db790732c1
SHA256:	3bc0ae9cd143920a55a4a53c61dd516ce5069f3d9453d2a08fc47273f29d1cf3
SHA512:	49f3c4dc7e42980aa82e88dab6933d30b2a05939db1d8bbc5cc076df761d2970ed85611813bcb5d97915835fd9c4dbe9f1f44f53d4ba026ddce1db8327b1b8dd
SSDEEP:	24576:5T791Po0nH/tGM8Vuh4EmNfSu6+S2xtxZYCJSRHjvyUfVboVrKVq:B9ZnH/tZQJfS7+SqxZYNJyImtGq
File Content Preview:	MZ*\.bo....\|.o.Y2.Z.;..e...Syy.<_07p....,......p....C.~...t%.....Q.............................................................................................................................................................................................

File Icon


Icon Hash:	b271f8e4ec603142

Static PE Info

General
Entrypoint:	0x5ff000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE
Time Stamp:	0x5BD0F21F [Wed Oct 24 22:28:47 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	984c4c57e82d8e821a29c7a241b6100b

Entrypoint Preview

Instruction
jmp 00007FC528F46D56h
test eax, 50E0169Fh
jmp 00007FC528F46D53h
xor eax, 000015E8h
add bl, ch
add cl, byte ptr [edi]
mov bl, EBh
add dword ptr [ecx], ebp
xor eax, eax
jmp 00007FC528F46D57h
mov ss, word ptr [esi+71A2B34Eh]
pop edi
jmp 00007FC528F46D53h
imul bl
add dword ptr [ecx-15B7C748h], esi
imul bl
add al, 3Bh
mov ebx, 02EB1CFBh
add dl, byte ptr [ebx+05h]
enter 15B7h, 09h
jmp 00007FC528F46D53h
cmp dh, byte ptr [ebp+40h]
jmp 00007FC528F46D54h
cmp eax, 30FF647Fh
jmp 00007FC528F46D55h
mov edx, 896419ACh
and bl, ch
add al, 1Dh
imul eax, esp, 55h
jmp 00007FC528F46D57h
fisub word ptr [esi-749486E6h]
adc bl, ch
add al, 18h
popfd
pop ebx
int 64h
pop dword ptr [eax]
jmp 00007FC528F46D53h
mov dword ptr [ebx+03EB04C4h], eax
or eax, EB586254h
add eax, dword ptr [edx-143C67E5h]
add eax, C29925F1h
lodsd
jmp 00007FC528F46D57h
imul dword ptr [edi-74167F83h]
push esp
and al, 0Ch
jmp 00007FC528F46D56h
ficomp word ptr [ebx+05EBE70Ah]
mov byte ptr [ebp-4671FB25h], ch
cld

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x164000	0x158
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x165000	0x99468	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x163000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x164000	0x1000	0x200	False	0.375	data	2.71681508808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x165000	0x99468	0x97e0f	False	0.872212443437	data	7.64749388637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x1ff000	0x18000	0x178f0	False	0.999357486321	DOS executable (COM)	7.99656260563	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x165090	0x128	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_ICON	0x1651e0	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0	English	Great Britain
RT_ICON	0x175a30	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294967295	English	Great Britain
RT_STRING	0x1fded4	0x594	empty	English	Great Britain
RT_STRING	0x1fd848	0x68a	empty	English	Great Britain
RT_STRING	0x1fd3b8	0x490	empty	English	Great Britain
RT_STRING	0x1fcdbc	0x5fc	data	English	Great Britain
RT_STRING	0x1fc760	0x65c	data	English	Great Britain
RT_STRING	0x1fc2f8	0x466	data	English	Great Britain
RT_STRING	0x1fc1a0	0x158	data	English	Great Britain
RT_RCDATA	0x179e10	0x81a1c	data
RT_RCDATA	0x1fb854	0x13f	data
RT_GROUP_ICON	0x1fb9dc	0x22	data	English	Great Britain
RT_GROUP_ICON	0x1fba28	0x14	data	English	Great Britain
RT_VERSION	0x1fba7c	0x2f4	data	English	Great Britain
RT_MANIFEST	0x1fbdb0	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
user32.dll	ShowWindow
advapi32.dll	RegOpenKeyExW
comctl32.dll	ImageList_Remove

Version Infos

Description	Data
LegalCopyright	Sector Bin Resources @ 2014
FileVersion	2.84.36.0
CompanyName	Sector Bin Resources
Comments	http://www.autoitscript.com/autoit3/
ProductName	Sector Bin Resources
ProductVersion	04.13.73
FileDescription	Sector Bin Resources
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 18, 2019 15:25:13.347815037 CET	51176	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:13.380264997 CET	53	51176	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:13.388881922 CET	49223	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:13.410773993 CET	9003	49223	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:13.410862923 CET	49223	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:13.433890104 CET	9003	49223	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:13.646061897 CET	49223	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:13.668275118 CET	9003	49223	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:13.668580055 CET	9003	49223	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:13.668689966 CET	49223	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:14.547825098 CET	49810	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:14.715215921 CET	53	49810	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:14.751549959 CET	49224	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:14.773816109 CET	9003	49224	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:14.773940086 CET	49224	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:14.796585083 CET	9003	49224	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:15.077342987 CET	49224	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:15.099008083 CET	9003	49224	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:15.099164963 CET	49224	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:15.297827005 CET	55151	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:15.303133965 CET	53216	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:15.335510015 CET	53	55151	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:15.341490030 CET	53	53216	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:15.512525082 CET	49792	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:15.516726017 CET	50672	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:15.539720058 CET	53	49792	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:15.555186033 CET	53	50672	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:15.596584082 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:15.597083092 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:15.692912102 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:15.693032026 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:15.693255901 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:15.693381071 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:16.044563055 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:16.045317888 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:16.140913963 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:16.141149044 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:16.143090963 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:16.143132925 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:16.143155098 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:16.143234968 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:16.143774033 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:16.143944025 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:16.143970966 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:16.143996000 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:16.245321035 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:16.245495081 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:16.342365980 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:16.342569113 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:16.454133034 CET	54414	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.455672979 CET	61734	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.466495991 CET	53	54414	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.467209101 CET	53	61734	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.468589067 CET	55067	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.470194101 CET	64117	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.482518911 CET	53	64117	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.495161057 CET	53	55067	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.577227116 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:16.577323914 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:16.869142056 CET	62987	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.875061989 CET	55067	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.896189928 CET	53	62987	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.898175955 CET	63357	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.901897907 CET	53	55067	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.903693914 CET	51216	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.915956974 CET	53	51216	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.939346075 CET	53	63357	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:17.012172937 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.021322966 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.148574114 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.157392979 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.255556107 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.255585909 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.255676985 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.255695105 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.255923033 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.255938053 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.255958080 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.255973101 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.255989075 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.256005049 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.256012917 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.256341934 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.264533043 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.264699936 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.264730930 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.264759064 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.264786959 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.264831066 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.264853001 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.264858961 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.264905930 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.264935017 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.264961958 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.264972925 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.265980005 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.273585081 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.352205992 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.352292061 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.352338076 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.352355957 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.352387905 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.352468014 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.352484941 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.352530956 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.352560043 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.352587938 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.360946894 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.360997915 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.361036062 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.361067057 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.361093998 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.361119986 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.361140966 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:17.361191034 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.361547947 CET	49225	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:17.368777990 CET	49224	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:17.392438889 CET	9003	49224	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:17.392551899 CET	49224	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:17.392632961 CET	49224	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:17.414625883 CET	9003	49224	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:18.267760992 CET	52355	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:18.299943924 CET	53	52355	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:18.300663948 CET	49231	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:18.322956085 CET	9003	49231	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:18.323024035 CET	49231	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:18.345494986 CET	9003	49231	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:18.346359968 CET	49231	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:18.419441938 CET	9003	49231	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:18.419529915 CET	49231	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:18.473973989 CET	9003	49231	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:18.474386930 CET	49231	9003	192.168.1.16	144.76.215.120
Jan 18, 2019 15:25:18.540304899 CET	9003	49231	144.76.215.120	192.168.1.16
Jan 18, 2019 15:25:22.269650936 CET	443	49226	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:22.269762993 CET	49226	443	192.168.1.16	45.55.57.244
Jan 18, 2019 15:25:22.274197102 CET	443	49225	45.55.57.244	192.168.1.16
Jan 18, 2019 15:25:22.274311066 CET	49225	443	192.168.1.16	45.55.57.244

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 18, 2019 15:25:13.347815037 CET	51176	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:13.380264997 CET	53	51176	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:14.547825098 CET	49810	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:14.715215921 CET	53	49810	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:15.297827005 CET	55151	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:15.303133965 CET	53216	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:15.335510015 CET	53	55151	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:15.341490030 CET	53	53216	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:15.512525082 CET	49792	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:15.516726017 CET	50672	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:15.539720058 CET	53	49792	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:15.555186033 CET	53	50672	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.454133034 CET	54414	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.455672979 CET	61734	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.466495991 CET	53	54414	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.467209101 CET	53	61734	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.468589067 CET	55067	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.470194101 CET	64117	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.482518911 CET	53	64117	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.495161057 CET	53	55067	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.869142056 CET	62987	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.875061989 CET	55067	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.896189928 CET	53	62987	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.898175955 CET	63357	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.901897907 CET	53	55067	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.903693914 CET	51216	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:16.915956974 CET	53	51216	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:16.939346075 CET	53	63357	8.8.8.8	192.168.1.16
Jan 18, 2019 15:25:18.267760992 CET	52355	53	192.168.1.16	8.8.8.8
Jan 18, 2019 15:25:18.299943924 CET	53	52355	8.8.8.8	192.168.1.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 18, 2019 15:25:13.347815037 CET	192.168.1.16	8.8.8.8	0xb8e7	Standard query (0)	doddyfire.dyndns.org	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:14.547825098 CET	192.168.1.16	8.8.8.8	0x544d	Standard query (0)	doddyfire.dyndns.org	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:15.297827005 CET	192.168.1.16	8.8.8.8	0x75d9	Standard query (0)	www.iptrackeronline.com	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:15.303133965 CET	192.168.1.16	8.8.8.8	0x3f2a	Standard query (0)	www.iptrackeronline.com	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:15.512525082 CET	192.168.1.16	8.8.8.8	0xacf6	Standard query (0)	www.iptrackeronline.com	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:15.516726017 CET	192.168.1.16	8.8.8.8	0xdde3	Standard query (0)	www.iptrackeronline.com	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:18.267760992 CET	192.168.1.16	8.8.8.8	0xb0a7	Standard query (0)	doddyfire.dyndns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 18, 2019 15:25:13.380264997 CET	8.8.8.8	192.168.1.16	0xb8e7	No error (0)	doddyfire.dyndns.org		144.76.215.120	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:14.715215921 CET	8.8.8.8	192.168.1.16	0x544d	No error (0)	doddyfire.dyndns.org		144.76.215.120	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:15.335510015 CET	8.8.8.8	192.168.1.16	0x75d9	No error (0)	www.iptrackeronline.com	iptrackeronline.com		CNAME (Canonical name)	IN (0x0001)
Jan 18, 2019 15:25:15.335510015 CET	8.8.8.8	192.168.1.16	0x75d9	No error (0)	iptrackeronline.com		45.55.57.244	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:15.341490030 CET	8.8.8.8	192.168.1.16	0x3f2a	No error (0)	www.iptrackeronline.com	iptrackeronline.com		CNAME (Canonical name)	IN (0x0001)
Jan 18, 2019 15:25:15.341490030 CET	8.8.8.8	192.168.1.16	0x3f2a	No error (0)	iptrackeronline.com		45.55.57.244	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:15.539720058 CET	8.8.8.8	192.168.1.16	0xacf6	No error (0)	www.iptrackeronline.com	iptrackeronline.com		CNAME (Canonical name)	IN (0x0001)
Jan 18, 2019 15:25:15.539720058 CET	8.8.8.8	192.168.1.16	0xacf6	No error (0)	iptrackeronline.com		45.55.57.244	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:15.555186033 CET	8.8.8.8	192.168.1.16	0xdde3	No error (0)	www.iptrackeronline.com	iptrackeronline.com		CNAME (Canonical name)	IN (0x0001)
Jan 18, 2019 15:25:15.555186033 CET	8.8.8.8	192.168.1.16	0xdde3	No error (0)	iptrackeronline.com		45.55.57.244	A (IP address)	IN (0x0001)
Jan 18, 2019 15:25:18.299943924 CET	8.8.8.8	192.168.1.16	0xb0a7	No error (0)	doddyfire.dyndns.org		144.76.215.120	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 18, 2019 15:25:16.143155098 CET	45.55.57.244	443	192.168.1.16	49226	CN=iptrackeronline.com CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Mon Dec 10 17:41:36 CET 2018 Thu Mar 17 17:40:46 CET 2016	Sun Mar 10 17:41:36 CET 2019 Wed Mar 17 17:40:46 CET 2021	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
Jan 18, 2019 15:25:16.143155098 CET	45.55.57.244	443	192.168.1.16	49226	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021		05af1f5ca1b87cc9cc9b25185115607d
Jan 18, 2019 15:25:16.143970966 CET	45.55.57.244	443	192.168.1.16	49225	CN=iptrackeronline.com CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Mon Dec 10 17:41:36 CET 2018 Thu Mar 17 17:40:46 CET 2016	Sun Mar 10 17:41:36 CET 2019 Wed Mar 17 17:40:46 CET 2021	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
Jan 18, 2019 15:25:16.143970966 CET	45.55.57.244	443	192.168.1.16	49225	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021		05af1f5ca1b87cc9cc9b25185115607d

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: TkAngEQurH.exe PID: 3980 Parent PID: 336

General

Start time:	15:22:33
Start date:	18/01/2019
Path:	C:\Users\user\Desktop\TkAngEQurH.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\TkAngEQurH.exe'
Imagebase:	0x400000
File size:	1277968 bytes
MD5 hash:	D6C644512C430CD64965C2259150F371
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 4052 Parent PID: 3980

General

Start time:	15:24:16
Start date:	18/01/2019
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Imagebase:	0x80000
File size:	64672 bytes
MD5 hash:	ADF76F395D5A0ECBBF005390B73C3FD2
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: TkAngEQurH.exe PID: 1292 Parent PID: 3768

General

Start time:	15:24:22
Start date:	18/01/2019
Path:	C:\Users\user\AppData\Roaming\TkAngEQurH.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Roaming\TkAngEQurH.exe'
Imagebase:	0x400000
File size:	1277968 bytes
MD5 hash:	D6C644512C430CD64965C2259150F371
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 47%, virustotal, Browse
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: TkAngEQurH.exe PID: 3980 Parent PID: 336TkAngEQurH.exeUNIQUE

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.9%
Total number of Nodes:	1207
Total number of Limit Nodes:	42

Executed Functions

Function 00403B4C, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowUNIQUE

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00403B7A

Part of subcall function 00403778: _free.LIBCMT ref: 0043D3D5

IsDebuggerPresent.KERNEL32 ref: 00403B8C
SetCurrentDirectoryW.KERNEL32(?), ref: 00403C81

Part of subcall function 004073E5: _memset.LIBCMT ref: 0043EE62
Part of subcall function 004073E5: GetOpenFileNameW.COMDLG32(?), ref: 0043EEAC

GetFullPathNameW.KERNEL32(00007FFF,?,?,004C62F8,004C62E0,?,?), ref: 00403BFD

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Part of subcall function 00410A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00403C26,004C62F8,?,?,?), ref: 00410ACE
Part of subcall function 00410A8D: _wcscat.LIBCMT ref: 004450E1

Part of subcall function 00403A58: GetSysColorBrush.USER32(0000000F), ref: 00403A62
Part of subcall function 00403A58: LoadCursorW.USER32(00000000,00007F00), ref: 00403A71
Part of subcall function 00403A58: LoadIconW.USER32(00000063), ref: 00403A88
Part of subcall function 00403A58: LoadIconW.USER32(000000A4), ref: 00403A9A
Part of subcall function 00403A58: LoadIconW.USER32(000000A2), ref: 00403AAC
Part of subcall function 00403A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00403AD2
Part of subcall function 00403A58: RegisterClassExW.USER32(?), ref: 00403B28

Part of subcall function 004039E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000), ref: 00403A15
Part of subcall function 004039E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00403A36
Part of subcall function 004039E7: ShowWindow.USER32(00000000), ref: 00403A4A
Part of subcall function 004039E7: ShowWindow.USER32(00000000), ref: 00403A53

Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410BBB
Part of subcall function 00410B30: timeGetTime.WINMM ref: 00410E76
Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410FB3
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 00410FC7
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00410FD5
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A), ref: 00410FDF
Part of subcall function 00410B30: LockWindowUpdate.USER32(00000000), ref: 0041105A
Part of subcall function 00410B30: DestroyWindow.USER32 ref: 00411066
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00411080
Part of subcall function 00410B30: timeGetTime.WINMM ref: 004110B2
Part of subcall function 00410B30: TranslateAcceleratorW.USER32(?,?,?), ref: 00445189
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,?,?), ref: 004452AD
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,?,?), ref: 004454A2
Part of subcall function 00410B30: #9.OLEAUT32(00000000,00000000,?,00000000,?,00000001,?,?,?,00000001,00000000,?,?,?,?), ref: 00445844
Part of subcall function 00410B30: #9.OLEAUT32(00000000), ref: 00445A00
Part of subcall function 00410B30: #9.OLEAUT32(?,00000000,00000001,00000000,00000000,?,-00000001,00000000,00000001,@COM_EVENTOBJ,00000000,?,?,?,?), ref: 00445A96
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,0000000A), ref: 00445C51
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445C71
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445C7D
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A), ref: 00445F24
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445FBF
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,00000000), ref: 00445FD7
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445FEB
Part of subcall function 00410B30: Sleep.KERNEL32(?,CCCCCCCC,00000000), ref: 00446058
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 0044608A
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00446098
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004460AC

Part of subcall function 004044CB: _memset.LIBCMT ref: 004044F7
Part of subcall function 004044CB: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00404527

Part of subcall function 004043DB: _memset.LIBCMT ref: 00404401
Part of subcall function 004043DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 004044A6
Part of subcall function 004043DB: Shell_NotifyIconW.SHELL32(00000001,?), ref: 004044C3

Part of subcall function 00404864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,004072BA,?,?,?,?,0040108C,-004C5E84), ref: 00404882

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,004B93F0,00000010), ref: 0043D4BC
SetCurrentDirectoryW.KERNEL32(?,004C62F8,?,?,?), ref: 0043D4F4

Part of subcall function 00464C03: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00464C2C
Part of subcall function 00464C03: CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00464C43
Part of subcall function 00464C03: FreeSid.ADVAPI32(?), ref: 00464C53

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

GetForegroundWindow.USER32 ref: 0043D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 0043D581

Strings

%I, xrefs: 00403C56
runas, xrefs: 0043D575
This is a third-party compiled AutoIt script., xrefs: 0043D4B4

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Window$Icon$LoadSleep$Name$CurrentDirectoryNotifyShell_Translate_memmove_memset$CloseCodeCreateDispatchExitFileFullHandleObjectPathPeekProcessShowSingleTimeWaittime$AcceleratorAllocateBrushCheckClassColorCursorDebuggerDestroyExecuteForegroundFreeImageInitializeLockMembershipModuleOpenPresentRegisterShellTokenUpdate_free_wcscat
String ID: This is a third-party compiled AutoIt script.$runas$%I
API String ID: 2176838863-2806069697
Opcode ID: 91b92454bf91a44166975481b8e2b8271c529dcaa901a66378d9e8ae173649a1
Instruction ID: 0f2c37a458a75ddd4165d4490fb1e043a1c32b8e6bc4467291d23e22a2595f58
Opcode Fuzzy Hash: 91b92454bf91a44166975481b8e2b8271c529dcaa901a66378d9e8ae173649a1
Instruction Fuzzy Hash: F351B575D08248AADB11AFB5DC05EEE7B78AB45304B1081BFF811B21E1DA7C5645CB2E

Uniqueness

Uniqueness Score: 100.00%

Function 00404FE9, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
UNIQUE

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00404FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00404EEE,?,?,00000000,00000000), ref: 00405010
LoadResource.KERNEL32(?,00000000,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F), ref: 0043DD60
SizeofResource.KERNEL32(?,00000000,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F), ref: 0043DD75
LockResource.KERNEL32(N@,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F,00000000), ref: 0043DD88

Strings

N@, xrefs: 0043DD85
SCRIPT, xrefs: 00405006

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT$N@
API String ID: 3051347437-2499734412
Opcode ID: 5ec92892c76f8d1a0b25561ef3fd13e1900f32b078569a65020aaf11a3c9a4ea
Instruction ID: 67856c902de3f53bc3f8eb18af461e19ea0094fb9f07ee8290f0089f1c16aac3
Opcode Fuzzy Hash: 5ec92892c76f8d1a0b25561ef3fd13e1900f32b078569a65020aaf11a3c9a4ea
Instruction Fuzzy Hash: 33115A75200700AFD7218B65EC58F6B7BB9EBC9B11F20457DF406D62A0DB72E8048A69

Uniqueness

Uniqueness Score: 100.00%

Function 00404AFE, Relevance: 9.2, APIs: 6, Instructions: 223
COMMON

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?,?,00000000), ref: 00404B2B

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Part of subcall function 00407E8C: _memmove.LIBCMT ref: 00407ED5

GetCurrentProcess.KERNEL32(?,0048FAEC,00000000,00000000,?,?,00000000), ref: 00404BF8
IsWow64Process.KERNEL32(00000000,?,00000000), ref: 00404BFF
GetSystemInfo.KERNEL32(00000000,?,00000000), ref: 00404C8D

Part of subcall function 00404C95: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00404CA3
Part of subcall function 00404C95: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo,?,00000000), ref: 00404CB5

FreeLibrary.KERNEL32(00000000,?,00000000), ref: 00404C50
GetSystemInfo.KERNEL32(00000000,?,00000000), ref: 00404C81

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: InfoLibraryProcessSystem_memmove$AddressCurrentFreeLoadProcVersionWow64
String ID:
API String ID: 4273104156-0
Opcode ID: 3ed813c13ab6b729a72130ac9ebb5d7e38d938aafd0c7b4dc5ce7f0b8531fff9
Instruction ID: a2a37668ba8dc9db7c0339275d8cd71390b5c234514a477f546c7b3e3bed8d02
Opcode Fuzzy Hash: 3ed813c13ab6b729a72130ac9ebb5d7e38d938aafd0c7b4dc5ce7f0b8531fff9
Instruction Fuzzy Hash: D591C17194A7C0DAC731CB6894511ABBFE4AF6A300F44496FD1CAA3B41D238F908D72E

Uniqueness

Uniqueness Score: 0.39%

Function 0040FE40, Relevance: 8.0, APIs: 3, Strings: 1, Instructions: 1040UNIQUE

APIs

Part of subcall function 004082E0: CharUpperBuffW.USER32(?,?), ref: 004082FD

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 0041047A
_memmove.LIBCMT ref: 004107DF
_memmove.LIBCMT ref: 0041080E

Part of subcall function 0046A0B5: LoadStringW.USER32(00000066,?,00000FFF,0048FB78), ref: 0046A0FC
Part of subcall function 0046A0B5: LoadStringW.USER32(?,?,00000FFF,?), ref: 0046A11E
Part of subcall function 0046A0B5: __swprintf.LIBCMT ref: 0046A177
Part of subcall function 0046A0B5: __swprintf.LIBCMT ref: 0046A190
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A246
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A264
Part of subcall function 0046A0B5: MessageBoxW.USER32(?,?,00011010,?), ref: 0046A27F

Part of subcall function 00409E9C: #9.OLEAUT32(?,?,?,?,?,00469D81,?,00000001,-004C5E88,?,00455CCE,?,?,?,0040FAE1,00000000), ref: 0043FE11

Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410BBB
Part of subcall function 00410B30: timeGetTime.WINMM ref: 00410E76
Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410FB3
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 00410FC7
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00410FD5
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A), ref: 00410FDF
Part of subcall function 00410B30: LockWindowUpdate.USER32(00000000), ref: 0041105A
Part of subcall function 00410B30: DestroyWindow.USER32 ref: 00411066
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00411080
Part of subcall function 00410B30: timeGetTime.WINMM ref: 004110B2
Part of subcall function 00410B30: TranslateAcceleratorW.USER32(?,?,?), ref: 00445189
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,?,?), ref: 004452AD
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,?,?), ref: 004454A2
Part of subcall function 00410B30: #9.OLEAUT32(00000000,00000000,?,00000000,?,00000001,?,?,?,00000001,00000000,?,?,?,?), ref: 00445844
Part of subcall function 00410B30: #9.OLEAUT32(00000000), ref: 00445A00
Part of subcall function 00410B30: #9.OLEAUT32(?,00000000,00000001,00000000,00000000,?,-00000001,00000000,00000001,@COM_EVENTOBJ,00000000,?,?,?,?), ref: 00445A96
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,0000000A), ref: 00445C51
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445C71
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445C7D
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A), ref: 00445F24
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445FBF
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,00000000), ref: 00445FD7
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445FEB
Part of subcall function 00410B30: Sleep.KERNEL32(?,CCCCCCCC,00000000), ref: 00446058
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 0044608A
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00446098
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004460AC

Part of subcall function 0047A5EE: CharUpperBuffW.USER32(?,00000016), ref: 0047A67E

Part of subcall function 00456C62: _memmove.LIBCMT ref: 00456CAC

Part of subcall function 00456665: _memmove.LIBCMT ref: 004566AF

Strings

%I, xrefs: 0040FE53

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Sleep_memmove$Translate$BuffCharCloseCodeDispatchExitHandleLoadObjectPeekProcessSingleStringTimeUpperWaitWindow__swprintf_wprintftime$AcceleratorDestroyException@8LockThrowUpdatestd::exception::exception
String ID: %I
API String ID: 2015352795-63094095
Opcode ID: 41636cd87b8ba94a046f8664d026baf789fabddac616076681d4b52a6bc51e89
Instruction ID: a3b9221dc64c310c941b5016b295edb8af427260a8d4055f717b05a0858251c0
Opcode Fuzzy Hash: 41636cd87b8ba94a046f8664d026baf789fabddac616076681d4b52a6bc51e89
Instruction Fuzzy Hash: B7926C706083419FD720DF15C580B6BB7E1BF84304F14896EE8969B392D7B9EC85CB9A

Uniqueness

Uniqueness Score: 100.00%

Function 00464696, Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

APIs

GetFileAttributesW.KERNEL32(?,0043E7C1), ref: 004646A6
FindFirstFileW.KERNEL32(?,?), ref: 004646B7
FindClose.KERNEL32(00000000), ref: 004646C7

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 4840215ffa09c9e98f8c71f503fabca7b99ef5557041bbbf62c8821922d9d811
Instruction ID: d948841d4539c93f635718a430456d5b2beea82774a4ad5489b04229db4e1113
Opcode Fuzzy Hash: 4840215ffa09c9e98f8c71f503fabca7b99ef5557041bbbf62c8821922d9d811
Instruction Fuzzy Hash: 81E0D8318104005B46106738EC4D4EF7B5C9E86335F100B6BFC35C15E0F7B85964869F

Uniqueness

Uniqueness Score: 0.13%

Function 0040E800, Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Strings

Variable must be of type 'Object'., xrefs: 0044428C

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$ErrorLastMessage_memmove
String ID: Variable must be of type 'Object'.
API String ID: 1087585129-109567571
Opcode ID: c0c83da57fe9adcf50571b204bb922bbfc317d87f1c580f86c1fca810dd725e9
Instruction ID: 646285330f24ea673303868bc9691634490c9c151704f09186753778590e683b
Opcode Fuzzy Hash: c0c83da57fe9adcf50571b204bb922bbfc317d87f1c580f86c1fca810dd725e9
Instruction Fuzzy Hash: 88A28C74A04205CFDB24CF59C480AAAB7B1FF48304F24847AE916BB391D739EC56CB99

Uniqueness

Uniqueness Score: 0.85%

Function 0042A364, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0042A36A

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: de316c34264f802ad97e41e2d96b97a4976e2443a0324b54249a0beeda03384a
Instruction ID: 5f0b767449e3d37fa0a9cb76ca1a1966b2bcebad2f74a673b8e7725f9ca30b43
Opcode Fuzzy Hash: de316c34264f802ad97e41e2d96b97a4976e2443a0324b54249a0beeda03384a
Instruction Fuzzy Hash: E2A0113000020CAB8A022B82EC08888BFACEA022A0B008030F80C808228B32A8208A88

Uniqueness

Uniqueness Score: 0.01%

Function 00410B30, Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1304windowsleepsynchronizationCOMMON

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410BBB
Sleep.KERNEL32(?,CCCCCCCC,00000000), ref: 00446058

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

timeGetTime.WINMM ref: 00410E76

Part of subcall function 0040FE40: _memmove.LIBCMT ref: 0041047A
Part of subcall function 0040FE40: _memmove.LIBCMT ref: 004107DF
Part of subcall function 0040FE40: _memmove.LIBCMT ref: 0041080E

Part of subcall function 004031CE: IsDialogMessageW.USER32(?,?), ref: 00403208
Part of subcall function 004031CE: GetClassLongW.USER32(?,000000E0), ref: 0043D186

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410FB3
TranslateMessage.USER32(?), ref: 00410FC7
DispatchMessageW.USER32(?), ref: 00410FD5
Sleep.KERNEL32(0000000A), ref: 00410FDF
LockWindowUpdate.USER32(00000000), ref: 0041105A
DestroyWindow.USER32 ref: 00411066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00411080
timeGetTime.WINMM ref: 004110B2

Part of subcall function 0046A0B5: LoadStringW.USER32(00000066,?,00000FFF,0048FB78), ref: 0046A0FC
Part of subcall function 0046A0B5: LoadStringW.USER32(?,?,00000FFF,?), ref: 0046A11E
Part of subcall function 0046A0B5: __swprintf.LIBCMT ref: 0046A177
Part of subcall function 0046A0B5: __swprintf.LIBCMT ref: 0046A190
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A246
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A264
Part of subcall function 0046A0B5: MessageBoxW.USER32(?,?,00011010,?), ref: 0046A27F

TranslateAcceleratorW.USER32(?,?,?), ref: 00445189
Sleep.KERNEL32(0000000A,?,?), ref: 004452AD
Sleep.KERNEL32(0000000A,?,?), ref: 004454A2
TranslateMessage.USER32(?), ref: 0044608A

Part of subcall function 00409997: __itow.LIBCMT ref: 004099C2
Part of subcall function 00409997: __swprintf.LIBCMT ref: 00409A0C
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9B1
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9DD
Part of subcall function 00409997: __swprintf.LIBCMT ref: 0043F9F7
Part of subcall function 00409997: __i64tow.LIBCMT ref: 0043FA0F

Part of subcall function 00456665: _memmove.LIBCMT ref: 004566AF

#9.OLEAUT32(00000000,00000000,?,00000000,?,00000001,?,?,?,00000001,00000000,?,?,?,?), ref: 00445844
#9.OLEAUT32(00000000), ref: 00445A00
#9.OLEAUT32(?,00000000,00000001,00000000,00000000,?,-00000001,00000000,00000001,@COM_EVENTOBJ,00000000,?,?,?,?), ref: 00445A96
DispatchMessageW.USER32(?), ref: 00446098

Part of subcall function 004628F7: Sleep.KERNEL32(0000000A,?,?,00445B57,?), ref: 00462965

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00445C51
GetExitCodeProcess.KERNEL32(?,?), ref: 00445C71
CloseHandle.KERNEL32(?), ref: 00445C7D

Part of subcall function 004861AC: GetForegroundWindow.USER32 ref: 004861D7

Part of subcall function 0040B93D: IsWindow.USER32(00000000), ref: 00441054

Part of subcall function 004654E6: QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00465502
Part of subcall function 004654E6: QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00465510
Part of subcall function 004654E6: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00465518
Part of subcall function 004654E6: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00465522
Part of subcall function 004654E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0046555E

Sleep.KERNEL32(0000000A), ref: 00445F24
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004460AC

Part of subcall function 00463E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00463EB6
Part of subcall function 00463E91: Process32FirstW.KERNEL32(00000000,?), ref: 00463EC4
Part of subcall function 00463E91: Process32NextW.KERNEL32(00000000,?), ref: 00463EE4
Part of subcall function 00463E91: CloseHandle.KERNEL32(00000000), ref: 00463F8E

Part of subcall function 00420719: timeGetTime.WINMM ref: 0042071D

GetExitCodeProcess.KERNEL32(?,?), ref: 00445FBF
WaitForSingleObject.KERNEL32(?,00000000), ref: 00445FD7
CloseHandle.KERNEL32(?), ref: 00445FEB

Strings

@GUI_WINHANDLE, xrefs: 004453B9
@GUI_CTRLHANDLE, xrefs: 0044540E
@GUI_CTRLID, xrefs: 00445364
@COM_EVENTOBJ, xrefs: 0044591A
@TRAY_ID, xrefs: 00445BB9

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Sleep$_memmove$Window__swprintf$CloseHandlePerformanceQueryTimeTranslatetime$CodeCounterDispatchExitLoadObjectPeekProcessProcess32SingleStringWait_wcscpy_wprintf$AcceleratorClassCreateDestroyDialogException@8FirstForegroundFrequencyLockLongNextSnapshotThrowToolhelp32Update__i64tow__itowstd::exception::exception
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 948137667-3242690629
Opcode ID: 441288072c25d4d31a744c6d311dd2bb703106e1bc0a8afa2d69edcac75fa916
Instruction ID: abb91fbfb1f178075637fae0d8e48f5fa84006329822cc06d63061e15e90d741
Opcode Fuzzy Hash: 441288072c25d4d31a744c6d311dd2bb703106e1bc0a8afa2d69edcac75fa916
Instruction Fuzzy Hash: ABB2A570608741DFEB24DF25C844BAAB7E5BF84308F14492FE44997392DB79E885CB4A

Uniqueness

Uniqueness Score: 5.06%

Function 00403015, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 75
windowregistryUNIQUE

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00403074
RegisterClassExW.USER32(00000030), ref: 0040309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004030AF
InitCommonControlsEx.COMCTL32(?), ref: 004030CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004030DC
LoadIconW.USER32(000000A9), ref: 004030F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00403101

Strings

F;@, xrefs: 0040307D
AutoIt v3 GUI, xrefs: 00403090
TaskbarCreated, xrefs: 004030A4
0, xrefs: 00403056
+, xrefs: 0040305D

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$F;@$TaskbarCreated
API String ID: 2914291525-2219658845
Opcode ID: b32fe6db03ccba481f670429e5c7b523f4edffb20c87d4c464e52b45bc5e04fc
Instruction ID: 979edb967f183c55e8c669bfc31fc45122444ef7f147c2a4b30f384e98b85c10
Opcode Fuzzy Hash: b32fe6db03ccba481f670429e5c7b523f4edffb20c87d4c464e52b45bc5e04fc
Instruction Fuzzy Hash: 043149B1941304EFEB40DFA4D884ADDBBF4FB09310F14856EE941EA2A1D3B54545CFA9

Uniqueness

Uniqueness Score: 100.00%

Function 00403041, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 54
windowregistryUNIQUE

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00403074
RegisterClassExW.USER32(00000030), ref: 0040309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004030AF
InitCommonControlsEx.COMCTL32(?), ref: 004030CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004030DC
LoadIconW.USER32(000000A9), ref: 004030F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00403101

Strings

F;@, xrefs: 0040307D
AutoIt v3 GUI, xrefs: 00403090
TaskbarCreated, xrefs: 004030A4
0, xrefs: 00403056
+, xrefs: 0040305D

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$F;@$TaskbarCreated
API String ID: 2914291525-2219658845
Opcode ID: f316edc5448d5b1c0adbc22ddb0f2bed62490a930fea9617621b6011003a6786
Instruction ID: 0e09ac2d9919322b342d86481b19008a338d121ad3b6117744e7067feae746c8
Opcode Fuzzy Hash: f316edc5448d5b1c0adbc22ddb0f2bed62490a930fea9617621b6011003a6786
Instruction Fuzzy Hash: 4021C9B1911218AFEB40EF94EC49B9DBBF4FB08710F10853AF511A62A0D7B545448FA9

Uniqueness

Uniqueness Score: 100.00%

Function 004071EB, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 202
registryCOMMON

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,004072BA,?,?,?,?,0040108C,-004C5E84), ref: 00404882

Part of subcall function 0042074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,004072C5,?,?,?,?,0040108C,-004C5E84), ref: 00420771

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

Part of subcall function 00403F84: _memmove.LIBCMT ref: 0040400E

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\,?,?,?,?,0040108C,-004C5E84), ref: 00407308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?,?,?,?,?,0040108C,-004C5E84), ref: 0043ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000,?,?,?,?,0040108C,-004C5E84), ref: 0043ED32

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

RegCloseKey.ADVAPI32(?,?,?,?,?,0040108C,-004C5E84), ref: 0043ED70
_wcscat.LIBCMT ref: 0043EDC9
_wcscat.LIBCMT ref: 0043EDFE

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Strings

\Include\, xrefs: 004072C5
Software\AutoIt v3\AutoIt, xrefs: 004072FE
Include, xrefs: 0043ECE8, 0043ED29
\, xrefs: 0043EDEC

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$NameQueryValue_wcscat$CloseException@8FileFullModuleOpenPathThrowstd::exception::exception
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2320919795-2727554177
Opcode ID: 9c39690667f90d85bbd298fc2fddaba166705738d63cb1fa57642d5dfdc0dc14
Instruction ID: 261d5c66dfbaa65f37115b6835693a56036b98bc8c14fb280ac0ce69df8225bb
Opcode Fuzzy Hash: 9c39690667f90d85bbd298fc2fddaba166705738d63cb1fa57642d5dfdc0dc14
Instruction Fuzzy Hash: 2D7159715093019BC354EF26E88195BBBE8FF98354F80487FF445932A1EB749948CF5A

Uniqueness

Uniqueness Score: 0.47%

Function 00403633, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryUNIQUE

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 004036D2
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0040371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0040372A
CreatePopupMenu.USER32 ref: 0040373E

Part of subcall function 004045DF: _memset.LIBCMT ref: 004045F9
Part of subcall function 004045DF: GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 0043D750
Part of subcall function 004045DF: GetMenuItemCount.USER32(004C6890), ref: 0043D7CD
Part of subcall function 004045DF: DeleteMenu.USER32(004C6890,00000005,00000000), ref: 0043D85D
Part of subcall function 004045DF: DeleteMenu.USER32(004C6890,00000004,00000000), ref: 0043D865
Part of subcall function 004045DF: DeleteMenu.USER32(004C6890,00000006,00000000), ref: 0043D86D
Part of subcall function 004045DF: DeleteMenu.USER32(004C6890,00000003,00000000), ref: 0043D875
Part of subcall function 004045DF: GetMenuItemCount.USER32(004C6890), ref: 0043D87D
Part of subcall function 004045DF: SetMenuItemInfoW.USER32(004C6890,00000004,00000000,00000030), ref: 0043D8B7
Part of subcall function 004045DF: GetCursorPos.USER32(?), ref: 0043D8C1
Part of subcall function 004045DF: SetForegroundWindow.USER32(00000000), ref: 0043D8CA
Part of subcall function 004045DF: TrackPopupMenuEx.USER32(004C6890,00000000,?,00000000,00000000,00000000), ref: 0043D8DD
Part of subcall function 004045DF: PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0043D8E9

PostQuitMessage.USER32(00000000), ref: 0040375F

Part of subcall function 00404531: _memset.LIBCMT ref: 00404560
Part of subcall function 00404531: KillTimer.USER32(?,00000001), ref: 004045B5
Part of subcall function 00404531: SetTimer.USER32(?,00000001,000002EE,00000000), ref: 004045C4
Part of subcall function 00404531: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0043D6CE

SetFocus.USER32 ref: 0043D2ED
MoveWindow.USER32(00000000,00000000,?,?,00000001), ref: 0043D311
KillTimer.USER32(?,00000001), ref: 004036FC

Part of subcall function 004044CB: _memset.LIBCMT ref: 004044F7
Part of subcall function 004044CB: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00404527

Part of subcall function 00403114: DeleteObject.GDI32(?), ref: 0040314D
Part of subcall function 00403114: DestroyWindow.USER32(?), ref: 004031A6

Part of subcall function 004043DB: _memset.LIBCMT ref: 00404401
Part of subcall function 004043DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 004044A6
Part of subcall function 004043DB: Shell_NotifyIconW.SHELL32(00000001,?), ref: 004044C3

Part of subcall function 00462A16: _memset.LIBCMT ref: 00462A31
Part of subcall function 00462A16: GetMenuItemInfoW.USER32(004C6890,000000FF,00000000,00000030), ref: 00462A92
Part of subcall function 00462A16: SetMenuItemInfoW.USER32(004C6890,00000004,00000000,00000030), ref: 00462AC8
Part of subcall function 00462A16: Sleep.KERNEL32(000001F4), ref: 00462ADA
Part of subcall function 00462A16: GetMenuItemCount.USER32(?), ref: 00462B1E
Part of subcall function 00462A16: GetMenuItemID.USER32(?,00000000), ref: 00462B3A
Part of subcall function 00462A16: GetMenuItemID.USER32(?,-00000001), ref: 00462B64
Part of subcall function 00462A16: GetMenuItemID.USER32(?,?), ref: 00462BA9
Part of subcall function 00462A16: CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00462BEF
Part of subcall function 00462A16: GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00462C03
Part of subcall function 00462A16: SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00462C24

Strings

%I, xrefs: 0043D2D1, 0043D31F
TaskbarCreated, xrefs: 00403725

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Menu$Item$Info$DeleteWindow_memset$IconNotifyShell_Timer$CountMessage$KillPopupPost$CheckCreateCursorDestroyFocusForegroundMoveObjectProcQuitRadioRegisterSleepTrack
String ID: TaskbarCreated$%I
API String ID: 2219433024-1195164674
Opcode ID: 4df9dbd9ea3853832d1d5ee4e4086456b2fc19e8db48de3a239b7734e64a6d00
Instruction ID: 10ee0b11622f1361c7ec63440bed57d6dff5d427fb300c744ab7812cb175661f
Opcode Fuzzy Hash: 4df9dbd9ea3853832d1d5ee4e4086456b2fc19e8db48de3a239b7734e64a6d00
Instruction Fuzzy Hash: 6A4117B11101057BDB646F68EC09F7A3A58E744302F10853FFA02A23E1CA7D9D45976E

Uniqueness

Uniqueness Score: 100.00%

Function 00403A58, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 72
windowregistryCOMMON

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00403A62
LoadCursorW.USER32(00000000,00007F00), ref: 00403A71
LoadIconW.USER32(00000063), ref: 00403A88
LoadIconW.USER32(000000A4), ref: 00403A9A
LoadIconW.USER32(000000A2), ref: 00403AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00403AD2
RegisterClassExW.USER32(?), ref: 00403B28

Part of subcall function 00403041: GetSysColorBrush.USER32(0000000F), ref: 00403074
Part of subcall function 00403041: RegisterClassExW.USER32(00000030), ref: 0040309E
Part of subcall function 00403041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004030AF
Part of subcall function 00403041: InitCommonControlsEx.COMCTL32(?), ref: 004030CC
Part of subcall function 00403041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004030DC
Part of subcall function 00403041: LoadIconW.USER32(000000A9), ref: 004030F2
Part of subcall function 00403041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00403101

Part of subcall function 004048FE: LoadImageW.USER32(00400000,00000063,00000001,00000010,00000010,00000000), ref: 00404922
Part of subcall function 004048FE: EnumResourceNamesW.KERNEL32(00000000,0000000E,00464189,00000063), ref: 0043DA68

Strings

AutoIt v3, xrefs: 00403B17
#, xrefs: 00403B0D
0, xrefs: 00403B06

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Load$Icon$Image$Register$BrushClassColorList_$CommonControlsCreateCursorEnumInitMessageNamesReplaceResourceWindow
String ID: #$0$AutoIt v3
API String ID: 2567192541-4155596026
Opcode ID: 42269966c74440c862dba0538370040d40d20385bd46122014e27266a7ce1093
Instruction ID: 8e7cc5216a3b211786643bcbc5a53bf5eabc0ef71c34cfd7d652ed0fcc69659d
Opcode Fuzzy Hash: 42269966c74440c862dba0538370040d40d20385bd46122014e27266a7ce1093
Instruction Fuzzy Hash: 7F214B74E00304BFEB50AFA4EC09F9D7FB4EB08711F11857AF504A62A0D3BA56548F98

Uniqueness

Uniqueness Score: 0.20%

Function 00403778, Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,004072BA,?,?,?,?,0040108C,-004C5E84), ref: 00404882

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

Part of subcall function 00404F3D: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404F6F

Part of subcall function 004697E5: _free.LIBCMT ref: 0046992C
Part of subcall function 004697E5: _free.LIBCMT ref: 00469933
Part of subcall function 004697E5: _free.LIBCMT ref: 0046999E
Part of subcall function 004697E5: _free.LIBCMT ref: 004699A6

_free.LIBCMT ref: 0043D3D5

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

Part of subcall function 00404FAA: FreeLibrary.KERNEL32(?,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404FDE

Part of subcall function 0042313D: __wcsicmp_l.LIBCMT ref: 004231C6

Strings

/AutoIt3ExecuteLine, xrefs: 004038B9
/AutoIt3ExecuteScript, xrefs: 004038CE
/ErrorStdOut, xrefs: 0040388F
CMDLINE, xrefs: 00403834
CMDLINERAW, xrefs: 0040380D
/AutoIt3OutputDebug, xrefs: 004038A4
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 004037C0

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _free$FreeLibrary$ErrorFileHeapLastLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 2910224213-3513169116
Opcode ID: 1832962895e309bab0d1ebf9e801e983e9b911081e6931282dd45cbcf15e7b99
Instruction ID: 19e95f69b08b63b79e3d7ab90ba78c5cdf699b16ea651e38bdcbe293d35e51ee
Opcode Fuzzy Hash: 1832962895e309bab0d1ebf9e801e983e9b911081e6931282dd45cbcf15e7b99
Instruction Fuzzy Hash: BFA129729102299ACB04EFA1DC91AEEBB78BF14305F50453FE412B61D1DB786A09CB69

Uniqueness

Uniqueness Score: 6.12%

Function 00423469, Relevance: 12.1, APIs: 8, Instructions: 91
UNIQUELIBRARYCODE

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00423477

Part of subcall function 00429E4B: __mtinitlocknum.LIBCMT ref: 00429E5D
Part of subcall function 00429E4B: EnterCriticalSection.KERNEL32(?,?,0042345E,00000008,00422E99,004BBB50,0000000C,00422F8B,?,?,00401014,0043B7A9), ref: 00429E76

RtlDecodePointer.NTDLL(004BBB70), ref: 004234B6
RtlDecodePointer.NTDLL ref: 004234C7
RtlEncodePointer.NTDLL(00000000,?,00423310,000000FF,?,00429E6E,00000011,?,?,0042345E,00000008,00422E99,004BBB50,0000000C,00422F8B,?), ref: 004234E0
RtlDecodePointer.NTDLL(-00000004), ref: 004234F0
RtlEncodePointer.NTDLL(00000000,?,00423310,000000FF,?,00429E6E,00000011,?,?,0042345E,00000008,00422E99,004BBB50,0000000C,00422F8B,?), ref: 004234F6
RtlDecodePointer.NTDLL ref: 0042350C
RtlDecodePointer.NTDLL ref: 00423517

Part of subcall function 00429FB5: LeaveCriticalSection.KERNEL32(?,00429D1B,0000000D,00429CD6), ref: 00429FC2

Part of subcall function 004232DF: ___crtCorExitProcess.LIBCMT ref: 004232E5
Part of subcall function 004232DF: ExitProcess.KERNEL32 ref: 004232EE

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pointer$Decode$CriticalEncodeExitProcessSection$EnterLeave___crt__lock__mtinitlocknum
String ID:
API String ID: 3532926286-0
Opcode ID: 3eb54479496a14f96af1a539c1c71f4a2dd7fdd1fba2ad2f8c082ffa494553fc
Instruction ID: 8c72c2951835608107e4db8e866895b11fbebaeedbe16d100f1f63f8c378f011
Opcode Fuzzy Hash: 3eb54479496a14f96af1a539c1c71f4a2dd7fdd1fba2ad2f8c082ffa494553fc
Instruction Fuzzy Hash: 20317231A04329AEDF50AF65E84579D7AB1BB48315F94447FE408A6291DFBD0A84CB1C

Uniqueness

Uniqueness Score: 100.00%

Function 00422EC8, Relevance: 10.6, APIs: 7, Instructions: 75
UNIQUELIBRARYCODE

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 00422EDB
RtlDecodePointer.NTDLL ref: 00422EE6

Part of subcall function 004289E4: HeapSize.KERNEL32(00000000,00000000,?,00422F07,00000000,?,?,?,?,?,00422EA5,?,004BBB50,0000000C,00422F8B,?), ref: 00428A0D

__realloc_crt.LIBCMT ref: 00422F27
__realloc_crt.LIBCMT ref: 00422F3B
EncodePointer.KERNEL32(00000000,?,?,?,?,?,00422EA5,?,004BBB50,0000000C,00422F8B,?,?,00401014,0043B7A9), ref: 00422F4D
RtlEncodePointer.NTDLL(?,?,?,?,?,?,00422EA5,?,004BBB50,0000000C,00422F8B,?,?,00401014,0043B7A9), ref: 00422F5B
RtlEncodePointer.NTDLL(00000000,?,?,?,?,?,00422EA5,?,004BBB50,0000000C,00422F8B,?,?,00401014,0043B7A9), ref: 00422F67

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$HeapSize
String ID:
API String ID: 177749828-0
Opcode ID: 84a00aaf028b4249c7e1c5d66ab9dc667d834f1d9d23803f899ef7f94023533b
Instruction ID: ea3efdf8e2bad2a4f7d05d94394ea50cef9674f9c70b6f81548ced0ca2bbb24c
Opcode Fuzzy Hash: 84a00aaf028b4249c7e1c5d66ab9dc667d834f1d9d23803f899ef7f94023533b
Instruction Fuzzy Hash: BF118172714225BF9B149B34EF848AABBF9EB05390791457BF805D3210EB75EC009B98

Uniqueness

Uniqueness Score: 100.00%

Function 004073E5, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 65
UNIQUE

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0043EE62
GetOpenFileNameW.COMDLG32(?), ref: 0043EEAC

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Part of subcall function 004048AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004048A1,?,?,?,004072BA,?,?,?,?,0040108C), ref: 004048CE

Part of subcall function 004209D5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 004209F4

Part of subcall function 004069CA: _free.LIBCMT ref: 0043E68C
Part of subcall function 004069CA: _free.LIBCMT ref: 0043E6D3

Strings

AutoIt script files (*.au3, *.a3x), xrefs: 0043EE90
Run Script:, xrefs: 0043EE81
au3, xrefs: 0043EEA5
X, xrefs: 0043EE7A

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Name$Path_free$FileFullLongOpen_memmove_memset
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$X$au3
API String ID: 1116811270-1954568251
Opcode ID: b4d37d12c6d2a76a87de7929d6b0db4a55e5567a859db527ed9755684b5293fe
Instruction ID: 5559bcc2e5b0ce129e075af18a443fb14fc0140c0908acbd47f5bc3bdc75694c
Opcode Fuzzy Hash: b4d37d12c6d2a76a87de7929d6b0db4a55e5567a859db527ed9755684b5293fe
Instruction Fuzzy Hash: CF21F671A142589BCB01DF95C845BEE7BF89F49314F00802BE508F7281DBBC598A8FA9

Uniqueness

Uniqueness Score: 100.00%

Function 004039E7, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
COMMON

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000), ref: 00403A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00403A36
ShowWindow.USER32(00000000), ref: 00403A4A
ShowWindow.USER32(00000000), ref: 00403A53

Strings

AutoIt v3, xrefs: 00403A0D, 00403A12, 00403A13
edit, xrefs: 00403A30

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 0bc3cb8581d30033406bf709693028d192d2a29ffe70b3422ed3ac2c8c0a6a91
Instruction ID: cb3e65218c39cbcb5fba8b0d7b0502fae8825f6b165f745e847789765139e861
Opcode Fuzzy Hash: 0bc3cb8581d30033406bf709693028d192d2a29ffe70b3422ed3ac2c8c0a6a91
Instruction Fuzzy Hash: 54F05E706412907EEA7027236C09F372E7DD7C3F50F21817EB900A2171C6A90800CAB8

Uniqueness

Uniqueness Score: 0.13%

Function 004069CA, Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260
COMMON

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F3D: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404F6F

Part of subcall function 004697E5: _free.LIBCMT ref: 0046992C
Part of subcall function 004697E5: _free.LIBCMT ref: 00469933
Part of subcall function 004697E5: _free.LIBCMT ref: 0046999E
Part of subcall function 004697E5: _free.LIBCMT ref: 004699A6

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_free.LIBCMT ref: 0043E6D3

Part of subcall function 0045FC4D: _memmove.LIBCMT ref: 0045FC88

Part of subcall function 0045FB6E: __wcsnicmp.LIBCMT ref: 0045FB81
Part of subcall function 0045FB6E: __wcsnicmp.LIBCMT ref: 0045FBA2
Part of subcall function 0045FB6E: __wcsnicmp.LIBCMT ref: 0045FBBC

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

Part of subcall function 00406999: _wcscmp.LIBCMT ref: 004069AC

Part of subcall function 0040766F: _memmove.LIBCMT ref: 0040774A

_free.LIBCMT ref: 0043E68C

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

Part of subcall function 00404FAA: FreeLibrary.KERNEL32(?,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404FDE

Part of subcall function 0045FCB1: GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0043E6C9,00000010,?,Bad directive syntax error,0048F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0045FCD2
Part of subcall function 0045FCB1: LoadStringW.USER32(00000000,?,0043E6C9,00000010), ref: 0045FCD9
Part of subcall function 0045FCB1: _wprintf.LIBCMT ref: 0045FD0C
Part of subcall function 0045FCB1: __swprintf.LIBCMT ref: 0045FD2E
Part of subcall function 0045FCB1: __swprintf.LIBCMT ref: 0045FD49
Part of subcall function 0045FCB1: MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0045FD9D

Part of subcall function 00464534: GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0046454E
Part of subcall function 00464534: LoadStringW.USER32(00000000), ref: 00464555
Part of subcall function 00464534: GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0046456B
Part of subcall function 00464534: LoadStringW.USER32(00000000), ref: 00464572
Part of subcall function 00464534: _wprintf.LIBCMT ref: 00464598
Part of subcall function 00464534: MessageBoxW.USER32(00000000,?,?,00011010), ref: 004645B6

Part of subcall function 00406BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00406D0D
Part of subcall function 00406BEC: SetCurrentDirectoryW.KERNEL32(?), ref: 00406E5A
Part of subcall function 00406BEC: _free.LIBCMT ref: 0043EB9C
Part of subcall function 00406BEC: _free.LIBCMT ref: 0043EBE2

Strings

Bad directive syntax error, xrefs: 0043E6BB
>>>AUTOIT SCRIPT<<<, xrefs: 0043E462

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _free$Load$HandleModuleString__wcsnicmp_memmove$CurrentDirectoryFreeLibraryMessage__swprintf_wprintf$ErrorException@8HeapLastThrow_wcscmpstd::exception::exception
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 3067711777-1757145024
Opcode ID: 48af337fa32d7ac79d44a3b26ecc76939e36bdbc999b5eac5f2b589d327e3590
Instruction ID: 2258a68d981662f44974eb8b497df540c6efdf5e7203b7320ea2560545df3755
Opcode Fuzzy Hash: 48af337fa32d7ac79d44a3b26ecc76939e36bdbc999b5eac5f2b589d327e3590
Instruction Fuzzy Hash: 92915E71910219AFCF04EFA6C8819EEB7B4BF18318F54446FE815AB2D1DB38A905CB59

Uniqueness

Uniqueness Score: 2.28%

Function 0040F8CF, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 168
comUNIQUE

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004203A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 004203D3
Part of subcall function 004203A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 004203DB
Part of subcall function 004203A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 004203E6
Part of subcall function 004203A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 004203F1
Part of subcall function 004203A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 004203F9
Part of subcall function 004203A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00420401

Part of subcall function 00416259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0040FA90), ref: 004162B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0040FB2D
OleInitialize.OLE32(00000000), ref: 0040FBAA

Part of subcall function 004674A9: CreateThread.KERNEL32(00000000,00000000,0046748F,00000000,00000000,?), ref: 004674C4

CloseHandle.KERNEL32(00000000), ref: 004449F2

Strings

%I, xrefs: 0040F8F6, 0040F908, 0040FACE, 0040FBB1

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Virtual$Handle$CloseCreateInitializeMessageRegisterThreadWindow
String ID: %I
API String ID: 2562920190-63094095
Opcode ID: 02239ccd336f757ca34483d5bbfe3c2a34f3ebbc87da09f49494e0eb5c8a791c
Instruction ID: 1cfffd179986f18d43a6ac5aa0dacd7918427e6922d3cb84a31c4b765cbc4a66
Opcode Fuzzy Hash: 02239ccd336f757ca34483d5bbfe3c2a34f3ebbc87da09f49494e0eb5c8a791c
Instruction Fuzzy Hash: 5B8198B49012909EC7C8EF2AE954E557BE5EB88308312C93FD819C7272EB399409CF5D

Uniqueness

Uniqueness Score: 100.00%

Function 004035B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,004035A1,SwapMouseButtons,00000004,?), ref: 004035D4
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,004035A1,SwapMouseButtons,00000004,?,?,?,?,00402754), ref: 004035F5
RegCloseKey.ADVAPI32(00000000,?,?,004035A1,SwapMouseButtons,00000004,?,?,?,?,00402754), ref: 00403617

Strings

Control Panel\Mouse, xrefs: 004035D2

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: fddb709fe4a1b7e3bb6eda9662e0779279b58f522ad42de317fca39f37a0c6b5
Instruction ID: b1ff216ba3ee978410a1c1c06e663b0c2c98cd46aaa17f39490786bf8a1b1252
Opcode Fuzzy Hash: fddb709fe4a1b7e3bb6eda9662e0779279b58f522ad42de317fca39f37a0c6b5
Instruction Fuzzy Hash: 84114871510208BFDB20CF64DC409AFBBBCEF45741F10486AE805E7250D6729E449768

Uniqueness

Uniqueness Score: 0.19%

Function 004697E5, Relevance: 6.2, APIs: 4, Instructions: 155COMMON

APIs

Part of subcall function 00405045: _fseek.LIBCMT ref: 0040505D

Part of subcall function 004699BE: _wcscmp.LIBCMT ref: 00469AAE
Part of subcall function 004699BE: _wcscmp.LIBCMT ref: 00469AC1

Part of subcall function 0040506B: __fread_nolock.LIBCMT ref: 00405089

Part of subcall function 0042594C: __FF_MSGBANNER.LIBCMT ref: 00425963
Part of subcall function 0042594C: __NMSG_WRITE.LIBCMT ref: 0042596A
Part of subcall function 0042594C: RtlAllocateHeap.NTDLL(00A30000,00000000,00000001,00000000,00000000,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28), ref: 0042598F

_free.LIBCMT ref: 0046992C
_free.LIBCMT ref: 00469933
_free.LIBCMT ref: 0046999E
_free.LIBCMT ref: 004699A6

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _free$Heap_wcscmp$AllocateErrorFreeLast__fread_nolock_fseek
String ID:
API String ID: 1875458934-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: aea911c9e8d6c7baa485eb259c959778deb43e5282718a6a3eaa8d141b9c537f
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: 2B512DB1A04218AFDF249F65DC41A9EBB79EF48314F1004AEB609A7281DB755E80CF5D

Uniqueness

Uniqueness Score: 0.50%

Function 00404DD0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141UNIQUE

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 00404E1A

Part of subcall function 0040506B: __fread_nolock.LIBCMT ref: 00405089

Part of subcall function 00405045: _fseek.LIBCMT ref: 0040505D

Part of subcall function 00404FE9: CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00404FF9
Part of subcall function 00404FE9: FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00404EEE,?,?,00000000,00000000), ref: 00405010
Part of subcall function 00404FE9: LoadResource.KERNEL32(?,00000000,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F), ref: 0043DD60
Part of subcall function 00404FE9: SizeofResource.KERNEL32(?,00000000,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F), ref: 0043DD75
Part of subcall function 00404FE9: LockResource.KERNEL32(N@,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F,00000000), ref: 0043DD88

Strings

AU3!P/I, xrefs: 00404E14
EA06, xrefs: 0043DCF5

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Resource$CreateException@8FindGlobalLoadLockSizeofStreamThrow__fread_nolock_fseek_memmovestd::exception::exception
String ID: AU3!P/I$EA06
API String ID: 2347112480-1914660620
Opcode ID: 8c6765611c1c92073ea3f7557a5ebebc0379cfc8ee5411a9a0fbe9599ab3c038
Instruction ID: e4f2d0695f8a23f075e311890a29d80e38cea7919c4102c3fad58ec67193dbe6
Opcode Fuzzy Hash: 8c6765611c1c92073ea3f7557a5ebebc0379cfc8ee5411a9a0fbe9599ab3c038
Instruction Fuzzy Hash: 11417BB1A041546BCF214B64C8517BF7FA6EB85304F28407BEE42BA2C2C57C8D41C7EA

Uniqueness

Uniqueness Score: 100.00%

Function 00420FF6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44UNIQUE

APIs

Part of subcall function 0042594C: __FF_MSGBANNER.LIBCMT ref: 00425963
Part of subcall function 0042594C: __NMSG_WRITE.LIBCMT ref: 0042596A
Part of subcall function 0042594C: RtlAllocateHeap.NTDLL(00A30000,00000000,00000001,00000000,00000000,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28), ref: 0042598F

Part of subcall function 004235E1: DecodePointer.KERNEL32(?,004259CD,?,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62), ref: 004235EA

std::exception::exception.LIBCMT ref: 0042102C
__CxxThrowException@8.LIBCMT ref: 00421041

Part of subcall function 004287DB: RaiseException.KERNEL32(?,?,?,004BBAF8,?,?,?,?,?,00421046,?,004BBAF8,?,00000001), ref: 00428830

Strings

bad allocation, xrefs: 00421021

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: AllocateDecodeExceptionException@8HeapPointerRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 2525242304-2104205924
Opcode ID: 5ea83d7ebaadb3ed3b241e21904507e4a97e31a177577d9182c5025c173bb06c
Instruction ID: 7ef10c6c1173b09cd5bea89a6eb30a235393a82e45e25364796afe6b045364de
Opcode Fuzzy Hash: 5ea83d7ebaadb3ed3b241e21904507e4a97e31a177577d9182c5025c173bb06c
Instruction Fuzzy Hash: BAF0F93470127DB6CB20AA55FD059DF7BA89F00354F90402FF804A2691EFF88A8082EC

Uniqueness

Uniqueness Score: 100.00%

Function 0042594C, Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

APIs

__FF_MSGBANNER.LIBCMT ref: 00425963

Part of subcall function 0042A3AB: __NMSG_WRITE.LIBCMT ref: 0042A3D2
Part of subcall function 0042A3AB: __NMSG_WRITE.LIBCMT ref: 0042A3DC

__NMSG_WRITE.LIBCMT ref: 0042596A

Part of subcall function 0042A408: GetModuleFileNameW.KERNEL32(00000000,004C43BA,00000104,00000000,00000000,?), ref: 0042A49A
Part of subcall function 0042A408: GetStdHandle.KERNEL32(000000F4,00000000,00000000,?), ref: 0042A554
Part of subcall function 0042A408: _strlen.LIBCMT ref: 0042A594
Part of subcall function 0042A408: WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0042A5A3
Part of subcall function 0042A408: __invoke_watson.LIBCMT ref: 0042A5BF

Part of subcall function 004232DF: ___crtCorExitProcess.LIBCMT ref: 004232E5
Part of subcall function 004232DF: ExitProcess.KERNEL32 ref: 004232EE

RtlAllocateHeap.NTDLL(00A30000,00000000,00000001,00000000,00000000,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28), ref: 0042598F

Part of subcall function 004235E1: DecodePointer.KERNEL32(?,004259CD,?,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62), ref: 004235EA

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ExitFileProcess$AllocateDecodeHandleHeapModuleNamePointerWrite___crt__getptd_noexit__invoke_watson_strlen
String ID:
API String ID: 15092741-0
Opcode ID: c00ab26dc2cd3f1d57d41560e0b46e4202be8d45b80d44de397e9cae70c6823a
Instruction ID: 51681375befe7b4efc193715c803360cbf5942a41623950cdb13c0d60d2addc5
Opcode Fuzzy Hash: c00ab26dc2cd3f1d57d41560e0b46e4202be8d45b80d44de397e9cae70c6823a
Instruction Fuzzy Hash: 0D01D2B1341B35EEE6157B26F852B6E72588F81775FD0003FF8049A2C1DA7C9D828A6D

Uniqueness

Uniqueness Score: 2.20%

Function 004235AC, Relevance: 4.5, APIs: 3, Instructions: 19COMMON

APIs

__lock.LIBCMT ref: 004235B2

Part of subcall function 00429E4B: __mtinitlocknum.LIBCMT ref: 00429E5D
Part of subcall function 00429E4B: EnterCriticalSection.KERNEL32(?,?,0042345E,00000008,00422E99,004BBB50,0000000C,00422F8B,?,?,00401014,0043B7A9), ref: 00429E76

RtlDecodePointer.NTDLL(00000001,?,004049A7,004581BC), ref: 004235BE
RtlEncodePointer.NTDLL(?,?,004049A7,004581BC), ref: 004235C9

Part of subcall function 00429FB5: LeaveCriticalSection.KERNEL32(?,00429D1B,0000000D,00429CD6), ref: 00429FC2

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CriticalPointerSection$DecodeEncodeEnterLeave__lock__mtinitlocknum
String ID:
API String ID: 2625109469-0
Opcode ID: f0f687c99d72e35ff3597eea0d1eb39ddd87317301f877e45278460e588003d2
Instruction ID: 43b77fceb529d27b8fed4b1eaa527640059df970b8b7b5fac95191ab6a691f5a
Opcode Fuzzy Hash: f0f687c99d72e35ff3597eea0d1eb39ddd87317301f877e45278460e588003d2
Instruction Fuzzy Hash: 69D05B726003146BCA017BF6FD0EA497F54D7447A1F04043EFF08C61A0DE754850878C

Uniqueness

Uniqueness Score: 4.01%

Function 0040AB23, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

APIs

Part of subcall function 00409E9C: #9.OLEAUT32(?,?,?,?,?,00469D81,?,00000001,-004C5E88,?,00455CCE,?,?,?,0040FAE1,00000000), ref: 0043FE11

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Part of subcall function 0047C4A7: GetEnvironmentVariableW.KERNEL32(0048F910,?,00000FFF,0048F910,?,00000016,?,00000000,?,004427F7,00000000,?,?,?,?), ref: 0047C555

Part of subcall function 0047C5F4: CharUpperBuffW.USER32(?,?), ref: 0047C6C3
Part of subcall function 0047C5F4: CharUpperBuffW.USER32(?,?), ref: 0047C783

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

Part of subcall function 0047BF80: CharUpperBuffW.USER32(?,?), ref: 0047C155

_memmove.LIBCMT ref: 00440098

Part of subcall function 0046A0B5: LoadStringW.USER32(00000066,?,00000FFF,0048FB78), ref: 0046A0FC
Part of subcall function 0046A0B5: LoadStringW.USER32(?,?,00000FFF,?), ref: 0046A11E
Part of subcall function 0046A0B5: __swprintf.LIBCMT ref: 0046A177
Part of subcall function 0046A0B5: __swprintf.LIBCMT ref: 0046A190
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A246
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A264
Part of subcall function 0046A0B5: MessageBoxW.USER32(?,?,00011010,?), ref: 0046A27F

Strings

CALL, xrefs: 0044002B

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: BuffCharUpper$LoadString__swprintf_memmove_wprintf$EnvironmentException@8MessageThrowVariablestd::exception::exception
String ID: CALL
API String ID: 1666878114-4196123274
Opcode ID: d33a1c3a313184cb2a326f1474268913fa13dbbd75ec40b2be7a1fa9dc9df4f4
Instruction ID: fba746951a7a9659ed0fe9afb12c0d71ea54e1dd252402ff516c8313d7e4acc0
Opcode Fuzzy Hash: d33a1c3a313184cb2a326f1474268913fa13dbbd75ec40b2be7a1fa9dc9df4f4
Instruction Fuzzy Hash: 01223770608341CFD724DF14C494A6AB7E1FF44304F15896EE986AB3A2D739EC95CB8A

Uniqueness

Uniqueness Score: 7.75%

Function 004664FF, Relevance: 3.2, APIs: 2, Instructions: 216COMMON

APIs

_memmove.LIBCMT ref: 004665F1

Part of subcall function 0046675A: _memmove.LIBCMT ref: 004667E8
Part of subcall function 0046675A: _memmove.LIBCMT ref: 0046685B
Part of subcall function 0046675A: _memmove.LIBCMT ref: 004668AD
Part of subcall function 0046675A: _memmove.LIBCMT ref: 00466942
Part of subcall function 0046675A: _memmove.LIBCMT ref: 0046695B
Part of subcall function 0046675A: _memmove.LIBCMT ref: 00466977

_memmove.LIBCMT ref: 004665D3

Part of subcall function 0046794E: _memset.LIBCMT ref: 00467983

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$_memset
String ID:
API String ID: 1357608183-0
Opcode ID: cf3fb0e40b1d011c78764e110bbb2e1bc444e29685298106b4dc6793493084e7
Instruction ID: 22bf93401d6e6b5374a973d4e381dc42914bbd876f3749e824b38a5223a58d4c
Opcode Fuzzy Hash: cf3fb0e40b1d011c78764e110bbb2e1bc444e29685298106b4dc6793493084e7
Instruction Fuzzy Hash: 1E71D3702002049FCB249F19E555BBB77A5EF84318F26851FEC965B392EB3DAC01CB5A

Uniqueness

Uniqueness Score: 0.36%

Function 00467A3D, Relevance: 3.1, APIs: 2, Instructions: 133COMMON

APIs

Part of subcall function 00405B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00467B20,?,?,00000000), ref: 00405B8C
Part of subcall function 00405B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00467B20,?,?,00000000,?,?), ref: 00405BB0

_memmove.LIBCMT ref: 00467B25

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 00467B65

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ByteCharMultiWide_memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 2283534703-0
Opcode ID: 659788df5ee825d314f128c454ac6842413733a606c133a68d911781ac0965d4
Instruction ID: 6e9a610943f2cecc4461ac01b6952c89a43ac209689eaaf6a07620313d43154f
Opcode Fuzzy Hash: 659788df5ee825d314f128c454ac6842413733a606c133a68d911781ac0965d4
Instruction Fuzzy Hash: 8E41DA716082099BCB20DFA99981D6FB7E4EF0870CB24455FE54597382FE79AC018B5A

Uniqueness

Uniqueness Score: 0.36%

Function 00407BB1, Relevance: 3.1, APIs: 2, Instructions: 97COMMON

APIs

Part of subcall function 00407CB3: _memmove.LIBCMT ref: 00407D13

_memmove.LIBCMT ref: 00407C0B

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 00407C76

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 084ba1ea0d58f984c6c398e1cf81d34d042e1bc15ce4a8371bb48d5930dc2317
Instruction ID: dca2659d15994c90c6c09ac9109f1b02cf59a28755a4f5d1953427ae19ac93cb
Opcode Fuzzy Hash: 084ba1ea0d58f984c6c398e1cf81d34d042e1bc15ce4a8371bb48d5930dc2317
Instruction Fuzzy Hash: 2F31D3B1A08506AFD714CF28D881E6AB3A8FF48314715823EE915CB391EB74F851CB95

Uniqueness

Uniqueness Score: 0.36%

Function 0040492E, Relevance: 3.1, APIs: 2, Instructions: 59COMMON

APIs

IsThemeActive.UXTHEME ref: 00404992

Part of subcall function 004235AC: __lock.LIBCMT ref: 004235B2
Part of subcall function 004235AC: RtlDecodePointer.NTDLL(00000001,?,004049A7,004581BC), ref: 004235BE
Part of subcall function 004235AC: RtlEncodePointer.NTDLL(?,?,004049A7,004581BC), ref: 004235C9

Part of subcall function 00404A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00404A73
Part of subcall function 00404A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00404A88

Part of subcall function 00403B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00403B7A
Part of subcall function 00403B4C: IsDebuggerPresent.KERNEL32 ref: 00403B8C
Part of subcall function 00403B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,004C62F8,004C62E0,?,?), ref: 00403BFD
Part of subcall function 00403B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00403C81
Part of subcall function 00403B4C: MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,004B93F0,00000010), ref: 0043D4BC
Part of subcall function 00403B4C: SetCurrentDirectoryW.KERNEL32(?,004C62F8,?,?,?), ref: 0043D4F4
Part of subcall function 00403B4C: GetForegroundWindow.USER32 ref: 0043D57A
Part of subcall function 00403B4C: ShellExecuteW.SHELL32(00000000,?,?), ref: 0043D581

SystemParametersInfoW.USER32(00002001,00000000,004C0044,00000002), ref: 004049D2

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CurrentDirectoryInfoParametersSystem$Pointer$ActiveDebuggerDecodeEncodeExecuteForegroundFullMessageNamePathPresentShellThemeWindow__lock
String ID:
API String ID: 266129024-0
Opcode ID: 5410f46a1a81539200a2eeef6a8c5e81a175194c6352785b6e035db14a7f21cc
Instruction ID: 4f3c985aaa7260ea6862a91c50e24ca429db6960d63ed6b712eae347e098ba5b
Opcode Fuzzy Hash: 5410f46a1a81539200a2eeef6a8c5e81a175194c6352785b6e035db14a7f21cc
Instruction Fuzzy Hash: FA116D716043119BC300EF29E80591AFBF8EB94714F00853FF545932A2DB749945CB9E

Uniqueness

Uniqueness Score: 0.25%

Function 00412E02, Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

APIs

timeGetTime.WINMM ref: 00412E1A

Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410BBB
Part of subcall function 00410B30: timeGetTime.WINMM ref: 00410E76
Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410FB3
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 00410FC7
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00410FD5
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A), ref: 00410FDF
Part of subcall function 00410B30: LockWindowUpdate.USER32(00000000), ref: 0041105A
Part of subcall function 00410B30: DestroyWindow.USER32 ref: 00411066
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00411080
Part of subcall function 00410B30: timeGetTime.WINMM ref: 004110B2
Part of subcall function 00410B30: TranslateAcceleratorW.USER32(?,?,?), ref: 00445189
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,?,?), ref: 004452AD
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,?,?), ref: 004454A2
Part of subcall function 00410B30: #9.OLEAUT32(00000000,00000000,?,00000000,?,00000001,?,?,?,00000001,00000000,?,?,?,?), ref: 00445844
Part of subcall function 00410B30: #9.OLEAUT32(00000000), ref: 00445A00
Part of subcall function 00410B30: #9.OLEAUT32(?,00000000,00000001,00000000,00000000,?,-00000001,00000000,00000001,@COM_EVENTOBJ,00000000,?,?,?,?), ref: 00445A96
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,0000000A), ref: 00445C51
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445C71
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445C7D
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A), ref: 00445F24
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445FBF
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,00000000), ref: 00445FD7
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445FEB
Part of subcall function 00410B30: Sleep.KERNEL32(?,CCCCCCCC,00000000), ref: 00446058
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 0044608A
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00446098
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004460AC

Sleep.KERNEL32(00000000), ref: 00412E53

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Sleep$TimeTranslatetime$CloseCodeDispatchExitHandleObjectPeekProcessSingleWaitWindow$AcceleratorDestroyLockUpdate
String ID:
API String ID: 2075848024-0
Opcode ID: 83a2f4d3d9c0b871a168cd341809343d7d87ce9343cc09a6a1a57f3729182f89
Instruction ID: d1c300ea91655eb9307443d86ffdf73ab59f85eace83877eb630077676957e6f
Opcode Fuzzy Hash: 83a2f4d3d9c0b871a168cd341809343d7d87ce9343cc09a6a1a57f3729182f89
Instruction Fuzzy Hash: 54F05E312446019BD350AF69D559BA6B7E4AF45350F00003EE86DD7352CB70AC44C795

Uniqueness

Uniqueness Score: 0.31%

Function 00422E55, Relevance: 3.0, APIs: 2, Instructions: 21COMMON

APIs

__calloc_crt.LIBCMT ref: 00422E5A

Part of subcall function 00428A15: __calloc_impl.LIBCMT ref: 00428A24

RtlEncodePointer.NTDLL(00000000), ref: 00422E64

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: EncodePointer__calloc_crt__calloc_impl
String ID:
API String ID: 1313826993-0
Opcode ID: c8676dd660c7eefd106528180395904a2849ec008534d2bae86df56401002fe1
Instruction ID: da289241f13c79bf68db0239506904f1207daf2422722450c71c90c663fb0b43
Opcode Fuzzy Hash: c8676dd660c7eefd106528180395904a2849ec008534d2bae86df56401002fe1
Instruction Fuzzy Hash: FDD05B33A497305EE3B16B257C05B9A37D0D744730F12446FF900D61C0DF644841478C

Uniqueness

Uniqueness Score: 1.23%

Function 0040F3F0, Relevance: 1.7, APIs: 1, Instructions: 185COMMON

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Part of subcall function 0047A5EE: CharUpperBuffW.USER32(?,00000016), ref: 0047A67E

Part of subcall function 0046A0B5: LoadStringW.USER32(00000066,?,00000FFF,0048FB78), ref: 0046A0FC
Part of subcall function 0046A0B5: LoadStringW.USER32(?,?,00000FFF,?), ref: 0046A11E
Part of subcall function 0046A0B5: __swprintf.LIBCMT ref: 0046A177
Part of subcall function 0046A0B5: __swprintf.LIBCMT ref: 0046A190
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A246
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A264
Part of subcall function 0046A0B5: MessageBoxW.USER32(?,?,00011010,?), ref: 0046A27F

_memmove.LIBCMT ref: 0044480B

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$BuffCharException@8MessageThrowUpper_memmovestd::exception::exception
String ID:
API String ID: 4241744515-0
Opcode ID: 8f3866c0187e9be9b0b6918ee5366a116c36442ee776b1c69902b4b63c7cd53f
Instruction ID: 5b17a682669dec69849c2be44c7345d10b719873665e3f46a0f7cbcbf9803b25
Opcode Fuzzy Hash: 8f3866c0187e9be9b0b6918ee5366a116c36442ee776b1c69902b4b63c7cd53f
Instruction Fuzzy Hash: A261BF70600206AFDB20DF54C981B6BB7F4EF44304F14843EE906A7682E779ED56CB59

Uniqueness

Uniqueness Score: 0.36%

Function 0040766F, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 0040774A

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Exception@8Throw_memmovestd::exception::exception
String ID:
API String ID: 1602317333-0
Opcode ID: a26c1e7aebf50c19b21ebef1910ce97343ddf2bfcb55e2ec6901b73463e418f5
Instruction ID: 148bf7845b9bfd5bb1bd6289e710206c27fb0d1581dedbb952c856e9d84f120b
Opcode Fuzzy Hash: a26c1e7aebf50c19b21ebef1910ce97343ddf2bfcb55e2ec6901b73463e418f5
Instruction Fuzzy Hash: 5131D475A08A12DFC7249F19D190922F7A0FF08360714C53FE84A9B7A1E774F881CB8A

Uniqueness

Uniqueness Score: 0.36%

Function 00420E48, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

APIs

CallWindowProcW.USER32 ref: 00420EF7

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 03574d3886af59dfc71a17caf98661ac75ab857829cb0cdf1d100c25a781418f
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 3331F270B001159BC728DE48E48496AF7E6FF59300BA58AA6E409CB752DB74EDC1CB89

Uniqueness

Uniqueness Score: 0.26%

Function 004400D6, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

APIs

#9.OLEAUT32 ref: 004400E1

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84850e68c493b6c19b86a264d09a4b44461aea8d8fb280f1e3391a6e4d68de54
Instruction ID: 87dafe0ecff1fea17fbb48996c13aa971f41060bf7b0868cc00f40b9988b33df
Opcode Fuzzy Hash: 84850e68c493b6c19b86a264d09a4b44461aea8d8fb280f1e3391a6e4d68de54
Instruction Fuzzy Hash: 85413B74504351CFDB24DF14C484B1ABBE1BF45318F0988AEE9895B7A2C33AEC55CB5A

Uniqueness

Uniqueness Score: 0.60%

Function 00407CB3, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

APIs

_memmove.LIBCMT ref: 00407D13

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 691215b5fde71f84ba4157909e6c6bd8e9f2b14ba3ae5d5d846b05b691d97e04
Instruction ID: 4f35de3bd7cb32edc3c82026cddc1214cbdb1bf771d77ce34197b3f11daa4a73
Opcode Fuzzy Hash: 691215b5fde71f84ba4157909e6c6bd8e9f2b14ba3ae5d5d846b05b691d97e04
Instruction Fuzzy Hash: 3E21FE71A08609EBEB144F25FC4277A7BB4FF18350F21857FE486D5191EB3894A4874E

Uniqueness

Uniqueness Score: 0.36%

Function 00404F3D, Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

APIs

Part of subcall function 00404D13: FreeLibrary.KERNEL32(00000000,?), ref: 00404D4D

Part of subcall function 0042548B: __wfsopen.LIBCMT ref: 00425496

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404F6F

Part of subcall function 00404DD0: _memmove.LIBCMT ref: 00404E1A

Part of subcall function 00404FAA: FreeLibrary.KERNEL32(?,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404FDE

Part of subcall function 00404CC8: FreeLibrary.KERNEL32(00000000), ref: 00404D02

Part of subcall function 0040506B: __fread_nolock.LIBCMT ref: 00405089

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Library$Free$Load__fread_nolock__wfsopen_memmove
String ID:
API String ID: 1609775715-0
Opcode ID: fbbe6342810aae6eb3a13c8902bab970ddb5b1228b8784956d1a4a8ed967591a
Instruction ID: 5856fbc04598f8720763e5afc42e8c3a4794c7060b7466c2264c1c7e33684289
Opcode Fuzzy Hash: fbbe6342810aae6eb3a13c8902bab970ddb5b1228b8784956d1a4a8ed967591a
Instruction Fuzzy Hash: 8211E771600606AADB10BF71DC02B6E77A89F84714F10843FFA41B72C1DA7D9A159B59

Uniqueness

Uniqueness Score: 0.09%

Function 004401AF, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

APIs

#9.OLEAUT32(?), ref: 004401BB

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ffa793b017d14a4b842d36eacf11a14188f93c48812aa2600b93bfe6488fba
Instruction ID: db6107d04a31b45d08df73f25b53866167db689c77b3171f384f4cae3bd8a944
Opcode Fuzzy Hash: 15ffa793b017d14a4b842d36eacf11a14188f93c48812aa2600b93bfe6488fba
Instruction Fuzzy Hash: 44210474508351CFDB14DF14C444A1BBBE0BF88304F04896EE989677A1D739E859CB9B

Uniqueness

Uniqueness Score: 0.60%

Function 0045FC4D, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 0045FC88

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Exception@8Throw_memmovestd::exception::exception
String ID:
API String ID: 1602317333-0
Opcode ID: 0bb2cb7006cc2b14eb98a38aa9793863864dc499257ab514178d5728a0167e41
Instruction ID: 2728c7377d2fb3091888e666e74eab3efefd279969e8fcd463a9dd8d880a9b88
Opcode Fuzzy Hash: 0bb2cb7006cc2b14eb98a38aa9793863864dc499257ab514178d5728a0167e41
Instruction Fuzzy Hash: B401D6322002256BCB24DF2DD88196BB7A9EFC5358714443EFC0ACB246E631E905C791

Uniqueness

Uniqueness Score: 0.36%

Function 00407F41, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

APIs

_memmove.LIBCMT ref: 00407F82

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Exception@8Throw_memmovestd::exception::exception
String ID:
API String ID: 1602317333-0
Opcode ID: 8c74e11fdaf048ddb84aacee375f4bb83789225aa0332bb2a9f065a8d2c5ba99
Instruction ID: a481b228ba030df6875f9a6dd2da52b06f57c7a09d876ea22ea353c417f4835c
Opcode Fuzzy Hash: 8c74e11fdaf048ddb84aacee375f4bb83789225aa0332bb2a9f065a8d2c5ba99
Instruction Fuzzy Hash: EB0126B26043027ED3205B39DC02F63BB94AB44760F10863FF51ACB2D1EA79E4008758

Uniqueness

Uniqueness Score: 0.36%

Function 0046794E, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memset.LIBCMT ref: 00467983

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: 890dab0563331d8cbcd444ed53136a13334e344e9fac417596b84d6acd97f5a7
Instruction ID: 10ff6be5ea8d3f30a203d17d41b502bc39334fe05faf781cb8e6dd50d084f980
Opcode Fuzzy Hash: 890dab0563331d8cbcd444ed53136a13334e344e9fac417596b84d6acd97f5a7
Instruction Fuzzy Hash: 3201E4742442109FD324EF5DD541B06BBE1AF59314F25845EF5888B392DABAA8008F99

Uniqueness

Uniqueness Score: 1.44%

Function 00404FAA, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

APIs

FreeLibrary.KERNEL32(?,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404FDE

Part of subcall function 004255D6: __lock_file.LIBCMT ref: 0042561B
Part of subcall function 004255D6: __fclose_nolock.LIBCMT ref: 00425626

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: FreeLibrary__fclose_nolock__lock_file
String ID:
API String ID: 1424536762-0
Opcode ID: 33e20a952f2e8d0d1fe5c77e63e757c0056158892867987900cbbd52313694f7
Instruction ID: 9f4c00c3caf65de6ea716a0b429dd2d7583c2b82718a0f3f6db7eedc70ddef11
Opcode Fuzzy Hash: 33e20a952f2e8d0d1fe5c77e63e757c0056158892867987900cbbd52313694f7
Instruction Fuzzy Hash: B3F039B1105712DFCB349F64E494816BBE2BF443293208A3FE2D692A50C739A884DF49

Uniqueness

Uniqueness Score: 0.03%

Function 004209D5, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 004209F4

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 782b4155a6be5666b9d6f7013c8adbab57ca25bad31f58bf0dd3291e7fbeca14
Instruction ID: 7974ecc8d6474924d437b965a90c8222220e8c30f7c7811ba04b272f454b6667
Opcode Fuzzy Hash: 782b4155a6be5666b9d6f7013c8adbab57ca25bad31f58bf0dd3291e7fbeca14
Instruction Fuzzy Hash: 23E0263290022857C720E2589C05FFAB3ACDF88290F0001BAFC0CD3204D964AC818694

Uniqueness

Uniqueness Score: 0.21%

Function 004649FF, Relevance: 1.5, APIs: 1, Instructions: 21COMMON

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00464A18

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: 443c34642b66725297b26bbf2a860fa00fcfd1b38a8c131b00deb3de20626ca9
Instruction ID: ad6fb64e700ddca96e5e99026dc6e0ea93483b30ed98fcf50192cb5c14734740
Opcode Fuzzy Hash: 443c34642b66725297b26bbf2a860fa00fcfd1b38a8c131b00deb3de20626ca9
Instruction Fuzzy Hash: 0DD05EB291032C2BEB60E6B99C0DDBB7BACDB44224F0006B67C5CD3152E934AD4586F1

Uniqueness

Uniqueness Score: 0.01%

Function 0042548B, Relevance: 1.5, APIs: 1, Instructions: 9COMMON

APIs

__wfsopen.LIBCMT ref: 00425496

Part of subcall function 004254A0: __getstream.LIBCMT ref: 004254F0
Part of subcall function 004254A0: @_EH4_CallFilterFunc@8.LIBCMT ref: 0042552B
Part of subcall function 004254A0: __wopenfile.LIBCMT ref: 0042553B

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CallFilterFunc@8__getstream__wfsopen__wopenfile
String ID:
API String ID: 4064380324-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 46a80e34e794c1a8cabf707ff87d233abccaec3d4d3113a971d4033361891bdf
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: CBB0927694020C77DE012E82FC02B697B199B44678F808021FB0C18162A677A6A09689

Uniqueness

Uniqueness Score: 2.04%

Function 0042A764, Relevance: 1.5, APIs: 1, Instructions: 4COMMONLIBRARYCODE

APIs

RtlEncodePointer.NTDLL(0042A730,004233F0,00000000,00000000,00000000,00000000,00000000), ref: 0042A769

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: b099f3d81180c5901ffbe3b9a6e79c65983757674502b88ca7a2d2bad456539b
Instruction ID: eebce8f2417fcbd939ec70b27f3c6012329136301deee71cbb14e520e27e25f6
Opcode Fuzzy Hash: b099f3d81180c5901ffbe3b9a6e79c65983757674502b88ca7a2d2bad456539b
Instruction Fuzzy Hash: 69A002F4E563608B87505F70FE1990A7AF0B7C5702B51057EEC5181264DB784025AB1E

Uniqueness

Uniqueness Score: 0.05%

Non-executed Functions

Function 0048804A, Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 575windowCOMMON

APIs

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 004880E0
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 004880FF
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00488123
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00488134
SendMessageW.USER32(?,00000149,00000000,00000000), ref: 00488153
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00488186
SendMessageW.USER32(?,0000133C,00000000,?), ref: 004881AC
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004881E7
SendMessageW.USER32(?,0000113E,00000000,00000004), ref: 0048822E
SendMessageW.USER32(?,0000113E,00000000,00000004), ref: 00488256
IsMenu.USER32(?), ref: 0048826F
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004882CA
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004882F8
GetWindowLongW.USER32(?,000000F0), ref: 0048836C
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 004883BB
SendMessageW.USER32(?,00001001,00000000,?), ref: 00488456
wsprintfW.USER32 ref: 0048847E
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 004884A0
GetWindowTextW.USER32(?,00000000,00000001), ref: 004884C8
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 004884EA
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0048850A
GetWindowTextW.USER32(?,00000000,00000001), ref: 00488531

Part of subcall function 00409997: __itow.LIBCMT ref: 004099C2
Part of subcall function 00409997: __swprintf.LIBCMT ref: 00409A0C
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9B1
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9DD
Part of subcall function 00409997: __swprintf.LIBCMT ref: 0043F9F7
Part of subcall function 00409997: __i64tow.LIBCMT ref: 0043FA0F

Part of subcall function 0040463E: _wcsncpy.LIBCMT ref: 00404652

GetWindowLongW.USER32(?,000000EC), ref: 004885AB
_memset.LIBCMT ref: 004885BD
SendMessageW.USER32(?,00001053,000000FF,?), ref: 004885EC
SendMessageW.USER32(?,0000104B,00000000,?), ref: 00488625

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 00488676
CharNextW.USER32(00000000), ref: 004886B1
SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 004886E1
SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 004886FC
_memset.LIBCMT ref: 00488709
SendMessageW.USER32(?,0000104B,00000000,?), ref: 0048872A
SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0048873F

Strings

%d/%02d/%02d, xrefs: 00488478

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend$Window$Menu$InfoItemLongText__swprintf_memset_wcscpy$CharException@8NextThrow__i64tow__itow_wcsncpystd::exception::exceptionwsprintf
String ID: %d/%02d/%02d
API String ID: 3265376569-328681919
Opcode ID: cc5b804fd33376c731cbd160f8e0d164f9a7cb4823b0334d976b04350f666d51
Instruction ID: 1694620be85d9f4a29f3fb548ce2e2fcd9673ad025b7a1e90bc8429aa5b278b6
Opcode Fuzzy Hash: cc5b804fd33376c731cbd160f8e0d164f9a7cb4823b0334d976b04350f666d51
Instruction Fuzzy Hash: DA12F471500214ABEB24AF24CC49FAF7BB4EF45710F60492EF915EA2E1EF788941CB18

Uniqueness

Uniqueness Score: 2.59%

Function 0041710E, Relevance: 52.3, APIs: 19, Strings: 8, Instructions: 5093UNIQUE

APIs

_memmove.LIBCMT ref: 004175C2
_memset.LIBCMT ref: 004176B1

Part of subcall function 00416DB8: _memmove.LIBCMT ref: 00451BBD

_memmove.LIBCMT ref: 00417C4B
_memmove.LIBCMT ref: 00417E4F
_memmove.LIBCMT ref: 0045205F
_memmove.LIBCMT ref: 0045286D
_memmove.LIBCMT ref: 00452A2E
_memmove.LIBCMT ref: 00452B08
_memmove.LIBCMT ref: 00452BDB
_memmove.LIBCMT ref: 00452D3D

Part of subcall function 0048E0E7: _memmove.LIBCMT ref: 0048E129

_memmove.LIBCMT ref: 00452F07
_memmove.LIBCMT ref: 00453045
_memmove.LIBCMT ref: 00453149
_memmove.LIBCMT ref: 004531AD
_memmove.LIBCMT ref: 0045321E
_memmove.LIBCMT ref: 0045335C
_memmove.LIBCMT ref: 00453E8E
_memmove.LIBCMT ref: 004544F9
_memmove.LIBCMT ref: 00454528

Strings

\b(?<=\w), xrefs: 00453C41
[:<:]], xrefs: 004175F1
[:>:]], xrefs: 0041760A
DEFINE, xrefs: 004525AF
Q\E, xrefs: 004181C1
athan, xrefs: 004527FC, 0045360B
OaA, xrefs: 0045287E
\b(?=\w), xrefs: 00453C34

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$OaA$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$athan
API String ID: 1357608183-1312225879
Opcode ID: 7d82e88c8c583c3cf55e43ee8ba79f162b63989cccceeed3ce797de6903fdd66
Instruction ID: 0f2016292ce7af36af0f0c3c89fa088be26185f2ba7aa12bc90a9d7b287e4a4c
Opcode Fuzzy Hash: 7d82e88c8c583c3cf55e43ee8ba79f162b63989cccceeed3ce797de6903fdd66
Instruction Fuzzy Hash: 2C93A371A002199BDB24CF58C8817EEB7B1FF48715F24816BED45AB381E7789D86CB48

Uniqueness

Uniqueness Score: 100.00%

Function 00416843, Relevance: 19.6, Strings: 15, Instructions: 883UNIQUE

Strings

UTF16), xrefs: 00451508
UTF), xrefs: 00451533
BSR_UNICODE), xrefs: 00451771
UCP), xrefs: 00451546
LIMIT_RECURSION=, xrefs: 00451635
NO_START_OPT), xrefs: 00451588
BSR_ANYCRLF), xrefs: 00451757
CR), xrefs: 004516C0
ANY), xrefs: 00451717
NO_AUTO_POSSESS), xrefs: 00451567
CRLF), xrefs: 004516FA
LIMIT_MATCH=, xrefs: 004515A9
ANYCRLF), xrefs: 00451734
LF), xrefs: 004516DD
OaA, xrefs: 00451888, 0045192F, 004519DD

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$__isdigit_l_memcmp
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$OaA$UCP)$UTF)$UTF16)
API String ID: 354189410-3302439341
Opcode ID: b575eb5cd43adaea0de128a74aa3f58823f576806eefacb0f2dd0bce3e4b62d6
Instruction ID: 3784516a1003e1c275ce3f2ff5430e7d36dc90e0b9f0d34c2957a4bb797dab3e
Opcode Fuzzy Hash: b575eb5cd43adaea0de128a74aa3f58823f576806eefacb0f2dd0bce3e4b62d6
Instruction Fuzzy Hash: 8B72AE71E002199BDB24CF59C8807EEB7B5EF48310F15806BE849EB391E7789D85CB99

Uniqueness

Uniqueness Score: 100.00%

Function 00413190, Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587UNIQUE

APIs

Part of subcall function 00409997: __itow.LIBCMT ref: 004099C2
Part of subcall function 00409997: __swprintf.LIBCMT ref: 00409A0C
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9B1
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9DD
Part of subcall function 00409997: __swprintf.LIBCMT ref: 0043F9F7
Part of subcall function 00409997: __i64tow.LIBCMT ref: 0043FA0F

Part of subcall function 0042594C: __FF_MSGBANNER.LIBCMT ref: 00425963
Part of subcall function 0042594C: __NMSG_WRITE.LIBCMT ref: 0042596A
Part of subcall function 0042594C: RtlAllocateHeap.NTDLL(00A30000,00000000,00000001,00000000,00000000,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28), ref: 0042598F

_memmove.LIBCMT ref: 004133D7

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 00413470
_free.LIBCMT ref: 00413496

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

_memmove.LIBCMT ref: 00413549

Part of subcall function 00407E8C: _memmove.LIBCMT ref: 00407ED5

Part of subcall function 00456665: _memmove.LIBCMT ref: 004566AF

Strings

OaA, xrefs: 00413482

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$Heap__swprintf_wcscpy$AllocateErrorException@8FreeLastThrow__i64tow__itow_freestd::exception::exception
String ID: OaA
API String ID: 3659533023-4189730831
Opcode ID: 607a8180dcbab94c6c0f37ba5f91fef4877d254ea19b33e77c5803b3d50347d5
Instruction ID: 2ffd56a64c60677c5789fbd16bfbcfb13b798939f1cd0f2cf633511a31807f6c
Opcode Fuzzy Hash: 607a8180dcbab94c6c0f37ba5f91fef4877d254ea19b33e77c5803b3d50347d5
Instruction Fuzzy Hash: 70229D716083019FD724DF14C881BABB7E5AF84704F10492EF89697392DB78EE45CB9A

Uniqueness

Uniqueness Score: 100.00%

Function 00401287, Relevance: 7.9, APIs: 5, Instructions: 379COMMON

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

DefDlgProcW.USER32(?,?,?,?), ref: 004019FA
GetSysColor.USER32(0000000F), ref: 00401A4E
SetBkColor.GDI32(?,00000000), ref: 00401A61

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

Part of subcall function 0040189B: DefDlgProcW.USER32(?,00000006,00000000,?), ref: 004018E2

Part of subcall function 0048CC88: GetWindowRect.USER32(?,?), ref: 0048CCAD
Part of subcall function 0048CC88: GetWindowRect.USER32(?,?), ref: 0048CD0C
Part of subcall function 0048CC88: MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0048CD46

Part of subcall function 004016B5: DefDlgProcW.USER32(?,00000002,00000000,00000000), ref: 004016D4

Part of subcall function 0040167D: DefDlgProcW.USER32(?,00000007,?,00000000), ref: 004016AB

Part of subcall function 0048D74C: GetSystemMetrics.USER32(0000000F), ref: 0048D78A
Part of subcall function 0048D74C: GetSystemMetrics.USER32(0000000F), ref: 0048D7AA
Part of subcall function 0048D74C: MoveWindow.USER32(00000003,?,?,?,?,00000000), ref: 0048D9E5
Part of subcall function 0048D74C: SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0048DA03
Part of subcall function 0048D74C: SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0048DA24
Part of subcall function 0048D74C: ShowWindow.USER32(00000003,00000000), ref: 0048DA43
Part of subcall function 0048D74C: InvalidateRect.USER32(?,00000000,00000001), ref: 0048DA68
Part of subcall function 0048D74C: DefDlgProcW.USER32(?,00000005,?,?), ref: 0048DA8B

Part of subcall function 0048C86D: SendMessageW.USER32(?,00000401,00000000,00000000), ref: 0048C8C7
Part of subcall function 0048C86D: DefDlgProcW.USER32(?,0000002B,?,?), ref: 0048C8E1

Part of subcall function 0048C27C: ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0048C2E4
Part of subcall function 0048C27C: ImageList_EndDrag.COMCTL32 ref: 0048C2EA
Part of subcall function 0048C27C: ReleaseCapture.USER32 ref: 0048C2F0
Part of subcall function 0048C27C: SetWindowTextW.USER32(?,00000000), ref: 0048C39A
Part of subcall function 0048C27C: SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0048C3AD
Part of subcall function 0048C27C: DefDlgProcW.USER32(?,00000202,?), ref: 0048C48F

Part of subcall function 0048C220: DefDlgProcW.USER32(?,00000204,?), ref: 0048C272

Part of subcall function 0048D6C6: DefDlgProcW.USER32(?,00000115,?,?), ref: 0048D740

Part of subcall function 0048DA9A: DefDlgProcW.USER32(?,00000112,?,00000000), ref: 0048DB46

Part of subcall function 0048C49C: PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0048C4EC
Part of subcall function 0048C49C: GetFocus.USER32 ref: 0048C4FC
Part of subcall function 0048C49C: GetDlgCtrlID.USER32(00000000), ref: 0048C507
Part of subcall function 0048C49C: _memset.LIBCMT ref: 0048C632
Part of subcall function 0048C49C: GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0048C65D
Part of subcall function 0048C49C: GetMenuItemCount.USER32(?), ref: 0048C67D
Part of subcall function 0048C49C: GetMenuItemID.USER32(?,00000000), ref: 0048C690
Part of subcall function 0048C49C: GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0048C6C4
Part of subcall function 0048C49C: GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0048C70C
Part of subcall function 0048C49C: CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0048C744
Part of subcall function 0048C49C: DefDlgProcW.USER32(?,00000111,?,?), ref: 0048C779

Part of subcall function 0048CD6C: GetWindowLongW.USER32(?,000000EC), ref: 0048CD74
Part of subcall function 0048CD6C: DefDlgProcW.USER32(?,00000084,00000000), ref: 0048CDA2

Part of subcall function 0048C788: GetCursorPos.USER32(?), ref: 0048C7C2
Part of subcall function 0048C788: TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0048C7D7
Part of subcall function 0048C788: GetCursorPos.USER32(?), ref: 0048C824
Part of subcall function 0048C788: DefDlgProcW.USER32(?,0000007B,?), ref: 0048C85E

Part of subcall function 0048CBF9: DefDlgProcW.USER32(?,00000053,?,?), ref: 0048CC24

Part of subcall function 0048CDAC: DefDlgProcW.USER32(?,0000004E,?,?), ref: 0048CE50
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0048CE91
Part of subcall function 0048CDAC: GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0048CED6
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0048CF00
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048CF29
Part of subcall function 0048CDAC: _wcsncpy.LIBCMT ref: 0048CFA1
Part of subcall function 0048CDAC: GetKeyState.USER32(00000011), ref: 0048CFC2
Part of subcall function 0048CDAC: GetKeyState.USER32(00000009), ref: 0048CFCF
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0048CFE5
Part of subcall function 0048CDAC: GetKeyState.USER32(00000010), ref: 0048CFEF
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0048D018
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048D03F
Part of subcall function 0048CDAC: SendMessageW.USER32(?,00001030,?,0048B602), ref: 0048D145
Part of subcall function 0048CDAC: ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0048D15B
Part of subcall function 0048CDAC: ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0048D16E
Part of subcall function 0048CDAC: SetCapture.USER32(?), ref: 0048D177
Part of subcall function 0048CDAC: ClientToScreen.USER32(?,?), ref: 0048D1DC
Part of subcall function 0048CDAC: ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0048D1E9
Part of subcall function 0048CDAC: InvalidateRect.USER32(?,00000000,00000001), ref: 0048D203
Part of subcall function 0048CDAC: ReleaseCapture.USER32 ref: 0048D20E
Part of subcall function 0048CDAC: GetCursorPos.USER32(?), ref: 0048D248
Part of subcall function 0048CDAC: ScreenToClient.USER32(?,?), ref: 0048D255
Part of subcall function 0048CDAC: SendMessageW.USER32(?,00001012,00000000,?), ref: 0048D2B1
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048D2DF
Part of subcall function 0048CDAC: SendMessageW.USER32(?,00001111,00000000,?), ref: 0048D31C
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048D34B
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0048D36C
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000110B,00000009,?), ref: 0048D37B
Part of subcall function 0048CDAC: GetCursorPos.USER32(?), ref: 0048D39B
Part of subcall function 0048CDAC: ScreenToClient.USER32(?,?), ref: 0048D3A8
Part of subcall function 0048CDAC: GetParent.USER32(?), ref: 0048D3C8
Part of subcall function 0048CDAC: SendMessageW.USER32(?,00001012,00000000,?), ref: 0048D431
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048D462
Part of subcall function 0048CDAC: ClientToScreen.USER32(?,?), ref: 0048D4C0
Part of subcall function 0048CDAC: TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0048D4F0
Part of subcall function 0048CDAC: SendMessageW.USER32(?,00001111,00000000,?), ref: 0048D51A
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048D53D
Part of subcall function 0048CDAC: ClientToScreen.USER32(?,?), ref: 0048D58F
Part of subcall function 0048CDAC: TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0048D5C3
Part of subcall function 0048CDAC: GetWindowLongW.USER32(?,000000F0), ref: 0048D65F

Part of subcall function 00456BAE: GetSysColor.USER32(0000000F), ref: 00456BCD
Part of subcall function 00456BAE: SetBkColor.GDI32(?,00000000), ref: 00456BE2

Part of subcall function 00401765: BeginPaint.USER32(?,?), ref: 0040179A
Part of subcall function 00401765: GetWindowRect.USER32(?,?), ref: 004017FE
Part of subcall function 00401765: ScreenToClient.USER32(?,?), ref: 0040181B
Part of subcall function 00401765: SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0040182C
Part of subcall function 00401765: EndPaint.USER32(?,?), ref: 00401876
Part of subcall function 00401765: Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0043BACB

Part of subcall function 0048CC2E: ClientToScreen.USER32(?,?), ref: 0048CC51
Part of subcall function 0048CC2E: ImageList_DragMove.COMCTL32(?,?,?,0043BC66,?,?,?,?,?), ref: 0048CC5D
Part of subcall function 0048CC2E: DefDlgProcW.USER32(?,00000200,?,?), ref: 0048CC7A

IsThemeActive.UXTHEME(?), ref: 0043BC84
DefDlgProcW.USER32(?,0000031A,?,?), ref: 0043BC97

Part of subcall function 0048C8EE: DragQueryPoint.SHELL32(?,?), ref: 0048C917
Part of subcall function 0048C8EE: SendMessageW.USER32(?,000000B0,?,?), ref: 0048C980
Part of subcall function 0048C8EE: DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0048C98B
Part of subcall function 0048C8EE: DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0048C9AE
Part of subcall function 0048C8EE: _wcscat.LIBCMT ref: 0048C9DE
Part of subcall function 0048C8EE: SendMessageW.USER32(?,000000C2,00000001,?), ref: 0048C9F5
Part of subcall function 0048C8EE: SendMessageW.USER32(?,000000B0,?,?), ref: 0048CA0E
Part of subcall function 0048C8EE: SendMessageW.USER32(?,000000B1,?,?), ref: 0048CA25
Part of subcall function 0048C8EE: SendMessageW.USER32(?,000000B1,?,?), ref: 0048CA47
Part of subcall function 0048C8EE: DragFinish.SHELL32(?), ref: 0048CA4E
Part of subcall function 0048C8EE: DefDlgProcW.USER32(?,00000233,?,00000000), ref: 0048CB41

Part of subcall function 0048CBAE: DefDlgProcW.USER32(?,00000232,?,?), ref: 0048CBEE

Part of subcall function 0048CB7F: DefDlgProcW.USER32 ref: 0048CBA4

Part of subcall function 0048CB50: DefDlgProcW.USER32 ref: 0048CB75

Part of subcall function 004016DE: GetParent.USER32(?), ref: 0043BA0A
Part of subcall function 004016DE: DefDlgProcW.USER32(?,00000133,?,?), ref: 0043BA84

Part of subcall function 00401290: DefDlgProcW.USER32(?,00000020,?), ref: 004012D8
Part of subcall function 00401290: GetClientRect.USER32(?,?), ref: 0043B84B
Part of subcall function 00401290: GetCursorPos.USER32(?), ref: 0043B855
Part of subcall function 00401290: ScreenToClient.USER32(?,?), ref: 0043B860

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Send$Proc$Window$Drag$ClientMenu$Screen$Image$CursorItemList_Rect$ColorLong$CaptureInfoMovePopupQueryStateTrack$BeginFileInvalidateMetricsPaintParentReleaseSystem$ActiveBrushCheckCountCreateCtrlEnterFinishFocusLeavePointPostRadioRectangleShowSolidTextThemeViewport_memset_wcscat_wcsncpy
String ID:
API String ID: 961471779-0
Opcode ID: 2a656a987a8ecee9a80962453214f84cc4032866b7d759c9bddff322316605fc
Instruction ID: 7331066d687c79144e479fa77cb5b53127ed0084e9ebbd02b0941197b1da37a7
Opcode Fuzzy Hash: 2a656a987a8ecee9a80962453214f84cc4032866b7d759c9bddff322316605fc
Instruction Fuzzy Hash: D9A13670202444BAE639AA6A4C88E7F355CDB85345F14453FF502F62F2CA3C9D0296BE

Uniqueness

Uniqueness Score: 0.46%

Function 00402344, Relevance: 7.6, APIs: 5, Instructions: 112keyboardCOMMON

APIs

GetCursorPos.USER32(?), ref: 00402357
ScreenToClient.USER32(004C67B0,?), ref: 00402374
GetAsyncKeyState.USER32(00000001), ref: 00402399
GetAsyncKeyState.USER32(00000002), ref: 004023A7
GetWindowLongW.USER32(?,000000F0), ref: 0043C23A

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: AsyncState$ClientCursorLongScreenWindow
String ID:
API String ID: 3539004672-0
Opcode ID: 669a1d0f0a37f564f98ec4bcb4af65858afb5dfd9ac0662bba3cfdd4afaff2d9
Instruction ID: 29238042452bc89b72d7561f0c30562a95ff63530a210d1cf57cdef7deabd6e5
Opcode Fuzzy Hash: 669a1d0f0a37f564f98ec4bcb4af65858afb5dfd9ac0662bba3cfdd4afaff2d9
Instruction Fuzzy Hash: 44418E31904119FBDF159F69C888AEEBB74FB09324F20436BF828A22D0C7785954DF99

Uniqueness

Uniqueness Score: 0.15%

Function 0047C304, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderUNIQUE

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 0047C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW,?,00441D88,?), ref: 0047C324

Strings

kernel32.dll, xrefs: 0047C30D
GetSystemWow64DirectoryW, xrefs: 0047C31E

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 8f6b8fbc5ae0276c8692dd60ba773bbd6744e56ae64103a06af9cbd1890bf6c2
Instruction ID: 448837d343b809a7a747f76761528a7c57238ea74050f81ad14c4a4b07cc8ac9
Opcode Fuzzy Hash: 8f6b8fbc5ae0276c8692dd60ba773bbd6744e56ae64103a06af9cbd1890bf6c2
Instruction Fuzzy Hash: FFE08C70200303CFCB205F25C848B8B76D4EB08714B90C83FE899C2310E778D880CBA8

Uniqueness

Uniqueness Score: 100.00%

Function 0040E060, Relevance: 3.5, APIs: 2, Instructions: 539COMMON

APIs

_memmove.LIBCMT ref: 0040E234

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 00443BAC

Part of subcall function 0046A0B5: LoadStringW.USER32(00000066,?,00000FFF,0048FB78), ref: 0046A0FC
Part of subcall function 0046A0B5: LoadStringW.USER32(?,?,00000FFF,?), ref: 0046A11E
Part of subcall function 0046A0B5: __swprintf.LIBCMT ref: 0046A177
Part of subcall function 0046A0B5: __swprintf.LIBCMT ref: 0046A190
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A246
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A264
Part of subcall function 0046A0B5: MessageBoxW.USER32(?,?,00011010,?), ref: 0046A27F

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: LoadString__swprintf_memmove_wprintf$Exception@8MessageThrowstd::exception::exception
String ID:
API String ID: 937456103-0
Opcode ID: 42639e607639d7894ca0c0b9b3292b90ae5e8a868e0793fe283a43a61668367b
Instruction ID: 717d1ab0d90b391ed1eaae52652e6e1fa3a898975f929f0a44a13a0e96a5ed75
Opcode Fuzzy Hash: 42639e607639d7894ca0c0b9b3292b90ae5e8a868e0793fe283a43a61668367b
Instruction Fuzzy Hash: 0822A170A00215DFDB24DF55C480AAEBBF0FF04304F14887BE956AB391D778A995CB99

Uniqueness

Uniqueness Score: 0.36%

Function 0046A2D5, Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0047977D,?,0048FB84,?), ref: 0046A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0047977D,?,0048FB84,?), ref: 0046A314

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ErrorFormatLastMessage_memmove
String ID:
API String ID: 2549646519-0
Opcode ID: fdc253593644b675b03e04101d794375ebb0b1d2eb4720d6b1b64855b0efc77e
Instruction ID: ec260152526798b71ceb7e6cab33189719a1cd8c4d24e489ae92bbfcc79f14b4
Opcode Fuzzy Hash: fdc253593644b675b03e04101d794375ebb0b1d2eb4720d6b1b64855b0efc77e
Instruction Fuzzy Hash: 1AF0E23154422DABDB109FA4CC48FEA736CBF08361F00416AFC08E6281D6309944CBA6

Uniqueness

Uniqueness Score: 0.02%

Function 0042A395, Relevance: 3.0, APIs: 2, Instructions: 8COMMON

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042A39A
UnhandledExceptionFilter.KERNEL32(?), ref: 0042A3A3

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c2bfc4d91f5eef072ecd4d4a99461c52a82975f392c39b974fa7ca05b3ef40fa
Instruction ID: 9da78fce3b57c7d2137df8720d13279edd616241823e717daaa40eb201d223bb
Opcode Fuzzy Hash: c2bfc4d91f5eef072ecd4d4a99461c52a82975f392c39b974fa7ca05b3ef40fa
Instruction Fuzzy Hash: CCB09231254308ABCA022B91EC09B8C3F68EB46AA2F404434FA0D84C60CB6254548B99

Uniqueness

Uniqueness Score: 0.02%

Function 0042F419, Relevance: 2.1, APIs: 1, Instructions: 645COMMON

APIs

___libm_error_support.LIBCMT ref: 0042FC43

Part of subcall function 00433718: DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00432653), ref: 00433734

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: DecodePointer___libm_error_support
String ID:
API String ID: 3413902329-0
Opcode ID: fe7d9b8eee1d273b37d623b7cc6cd26b30c9621dfee01b7311cae72a06f2c816
Instruction ID: bce05383f65911ef53e75d5f2b7ae8bd864113105c6f5f1cb0bb4096b20a0191
Opcode Fuzzy Hash: fe7d9b8eee1d273b37d623b7cc6cd26b30c9621dfee01b7311cae72a06f2c816
Instruction Fuzzy Hash: 9A325921E29F114DD7235634D832336A258AFB73C8F95D737F819B5EA6DB28D4834208

Uniqueness

Uniqueness Score: 1.05%

Function 00442230, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00442242

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8a249febe551d676a54362e58b36ee3cbdd6c7cccf50f5c22d62ededf723ae2e
Instruction ID: 9fab3e4f47dffe1bb4406c65b0cef95ea93db68453fc608ef19f458391309213
Opcode Fuzzy Hash: 8a249febe551d676a54362e58b36ee3cbdd6c7cccf50f5c22d62ededf723ae2e
Instruction Fuzzy Hash: 55C04CF1800109DBDB05DB90D988DEE77BCAB04304F104466A101F2110D7749B448B76

Uniqueness

Uniqueness Score: 0.06%

Function 00422405, Relevance: .3, Instructions: 345COMMON

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 3a63805bb8c2c01de1b6144fc2d7500bdbb157a027ed3d5f9b560445ff49f309
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: C2C1C6323050B309DB2D8639A63013FBAE15EA27B139A076FE4B3CB6D4EF58D564D614

Uniqueness

Uniqueness Score: 0.00%

Function 0042283A, Relevance: .3, Instructions: 341COMMON

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: aaf8636ec1f05b4987ac2accbf93641bd6487308852fa21464a5fdbc51815f71
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 18C1B7323050B309DB2D8639A63413FBBE15EA27B139A076FE4B2DB6D4EF18D524D614

Uniqueness

Uniqueness Score: 0.00%

Function 0048A849, Relevance: 49.8, APIs: 33, Instructions: 274windowCOMMON

APIs

SetTextColor.GDI32(?,00000000), ref: 0048A89F
SetTextColor.GDI32(?,000000FF), ref: 0048A8BE
GetSysColorBrush.USER32(0000000F), ref: 0048A8D0
GetSysColor.USER32(0000000F), ref: 0048A8DC
CreateSolidBrush.GDI32(000000FF), ref: 0048A8E7
SetBkColor.GDI32(?,000000FF), ref: 0048A8F6
SelectObject.GDI32(?,?), ref: 0048A905
InflateRect.USER32(?,000000FF,000000FF), ref: 0048A930
GetSysColor.USER32(00000010), ref: 0048A938
CreateSolidBrush.GDI32(00000000), ref: 0048A93F
FrameRect.USER32(?,?,00000000), ref: 0048A94E
DeleteObject.GDI32(00000000), ref: 0048A955
InflateRect.USER32(?,000000FF,000000FF), ref: 0048A96D
DrawFrameControl.USER32(?,?,00000004,00000010), ref: 0048A97D
InflateRect.USER32(?,000000FE,000000FE), ref: 0048A9A0
InflateRect.USER32(?,000000FE,000000FE), ref: 0048A9BA
FillRect.USER32(?,?,?), ref: 0048A9D2
GetWindowLongW.USER32(?,000000F0), ref: 0048A9FD
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0048AA4E

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

GetWindowTextW.USER32(?,00000000,00000001), ref: 0048AA79
DrawTextW.USER32(?,?,000000FF,?,00000104), ref: 0048AA8C
GetSysColor.USER32(00000011), ref: 0048AAAF
SetTextColor.GDI32(?,00000000), ref: 0048AAB7
DrawTextW.USER32(?,?,000000FF,?,00000000), ref: 0048AACD
CreateSolidBrush.GDI32(00000000), ref: 0048AAE8
FrameRect.USER32(?,00000000,00000000), ref: 0048AAF7
DeleteObject.GDI32(00000000), ref: 0048AAFE
InflateRect.USER32(?,000000FC,000000FC), ref: 0048AB0D
DrawFocusRect.USER32(?,00000000), ref: 0048AB19
SelectObject.GDI32(?,?), ref: 0048AB2E
DeleteObject.GDI32(?), ref: 0048AB38
SetTextColor.GDI32(?,?), ref: 0048AB43
SetBkColor.GDI32(?,?), ref: 0048AB4E

Part of subcall function 0048AB60: GetSysColor.USER32(00000012), ref: 0048AB99
Part of subcall function 0048AB60: SetTextColor.GDI32(?,?), ref: 0048AB9D
Part of subcall function 0048AB60: GetSysColorBrush.USER32(0000000F), ref: 0048ABB3
Part of subcall function 0048AB60: GetSysColor.USER32(0000000F), ref: 0048ABBE
Part of subcall function 0048AB60: CreateSolidBrush.GDI32(?), ref: 0048ABC3
Part of subcall function 0048AB60: GetSysColor.USER32(00000011), ref: 0048ABDB
Part of subcall function 0048AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0048ABE9
Part of subcall function 0048AB60: SelectObject.GDI32(?,00000000), ref: 0048ABFA
Part of subcall function 0048AB60: SetBkColor.GDI32(?,00000000), ref: 0048AC03
Part of subcall function 0048AB60: SelectObject.GDI32(?,?), ref: 0048AC10
Part of subcall function 0048AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 0048AC2F
Part of subcall function 0048AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0048AC46
Part of subcall function 0048AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 0048AC5B
Part of subcall function 0048AB60: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0048ACA7
Part of subcall function 0048AB60: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0048ACCE
Part of subcall function 0048AB60: InflateRect.USER32(?,000000FD,000000FD), ref: 0048ACEC
Part of subcall function 0048AB60: DrawFocusRect.USER32(?,?), ref: 0048ACF7
Part of subcall function 0048AB60: GetSysColor.USER32(00000011), ref: 0048AD05
Part of subcall function 0048AB60: SetTextColor.GDI32(?,00000000), ref: 0048AD0D
Part of subcall function 0048AB60: DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0048AD21
Part of subcall function 0048AB60: SelectObject.GDI32(?,0048A869), ref: 0048AD38
Part of subcall function 0048AB60: DeleteObject.GDI32(?), ref: 0048AD43
Part of subcall function 0048AB60: SelectObject.GDI32(?,?), ref: 0048AD49
Part of subcall function 0048AB60: DeleteObject.GDI32(?), ref: 0048AD4E
Part of subcall function 0048AB60: SetTextColor.GDI32(?,?), ref: 0048AD54
Part of subcall function 0048AB60: SetBkColor.GDI32(?,?), ref: 0048AD5E

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Color$Rect$Text$Object$Inflate$BrushDrawSelect$CreateDelete$SolidWindow$Frame$FocusLongMessageSend$ControlException@8FillRoundThrowstd::exception::exception
String ID:
API String ID: 2948665181-0
Opcode ID: ca26ed1d54bb8123bf66e1cf3c232692827ca5efe3465f62183b732a343c8a10
Instruction ID: 452232081cd78e43451fe9d0edc745e4d0d3487f89d4aa1c860563aee330a7d3
Opcode Fuzzy Hash: ca26ed1d54bb8123bf66e1cf3c232692827ca5efe3465f62183b732a343c8a10
Instruction Fuzzy Hash: ACA17D72408301BFD710AF64DC08A6F7BA9FB89321F104E3EF962961A1D774D859CB56

Uniqueness

Uniqueness Score: 0.25%

Function 004027D9, Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 286windowtimeUNIQUE

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004028BC
GetSystemMetrics.USER32(00000007), ref: 004028C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004028EF
GetSystemMetrics.USER32(00000008), ref: 004028F7
GetSystemMetrics.USER32(00000004), ref: 0040291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00402939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00402949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0040297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00402990
GetClientRect.USER32(00000000,000000FF), ref: 004029AE
GetStockObject.GDI32(00000011), ref: 004029CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 004029D5

Part of subcall function 00402344: GetCursorPos.USER32(?), ref: 00402357
Part of subcall function 00402344: ScreenToClient.USER32(004C67B0,?), ref: 00402374
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000001), ref: 00402399
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000002), ref: 004023A7
Part of subcall function 00402344: GetWindowLongW.USER32(?,000000F0), ref: 0043C23A

SetTimer.USER32(00000000,00000000,00000028,Function_00001256), ref: 004029FC

Part of subcall function 0048B00F: DestroyWindow.USER32(?), ref: 0048B04A

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

GetWindowRect.USER32(?,?), ref: 0043C39C
GetClientRect.USER32(?,?), ref: 0043C3A9
GetSystemMetrics.USER32(00000007), ref: 0043C3B1
GetSystemMetrics.USER32(00000008), ref: 0043C3C4
GetSystemMetrics.USER32(00000004), ref: 0043C3E9

Part of subcall function 00402A5B: ShowWindow.USER32(FFFFFFFF,?), ref: 00402ACF
Part of subcall function 00402A5B: ShowWindow.USER32(FFFFFFFF,00000000), ref: 00402B17
Part of subcall function 00402A5B: ShowWindow.USER32(FFFFFFFF,00000006), ref: 0043C46A
Part of subcall function 00402A5B: LockWindowUpdate.USER32(00000000), ref: 0043C492
Part of subcall function 00402A5B: InvalidateRect.USER32(00000000,00000000,00000001), ref: 0043C49E
Part of subcall function 00402A5B: LockWindowUpdate.USER32(FFFFFFFF), ref: 0043C4AE
Part of subcall function 00402A5B: EnableWindow.USER32(FFFFFFFF,00000001), ref: 0043C4BF
Part of subcall function 00402A5B: ShowWindow.USER32(FFFFFFFF,?), ref: 0043C4D6

Part of subcall function 004034C2: _memmove.LIBCMT ref: 0043D28C

Strings

AutoIt v3 GUI, xrefs: 00402974
0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000, xrefs: 0043C3D9
athan, xrefs: 00402855

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$System$MetricsRect$Show$ClientLong$AsyncInfoLockParametersStateUpdate$AdjustCreateCursorDestroyEnableException@8InvalidateMessageObjectScreenSendStockThrowTimer_memmovestd::exception::exception
String ID: 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000$AutoIt v3 GUI$athan
API String ID: 3027708390-1992051106
Opcode ID: 518d5aec92cc7ef936ed3da500e60c79228adc8694f127a3c6f5b8083d95c1aa
Instruction ID: 34a51bb5a318ae1a344add4034b802b2dd09297663e35ec0c622bb09f95dc302
Opcode Fuzzy Hash: 518d5aec92cc7ef936ed3da500e60c79228adc8694f127a3c6f5b8083d95c1aa
Instruction Fuzzy Hash: 21B18275600205AFDB14DF68DD89BAE7BB4FB08314F10863AFA15A72D0DB78A851CF58

Uniqueness

Uniqueness Score: 100.00%

Function 0045B1E0, Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

APIs

__wcsnicmp.LIBCMT ref: 0045B23F

Part of subcall function 00423A0B: __wcsnicmp_l.LIBCMT ref: 00423AB4

__wcsnicmp.LIBCMT ref: 0045B25B
__wcsnicmp.LIBCMT ref: 0045B283

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

Part of subcall function 0042313D: __wcsicmp_l.LIBCMT ref: 004231C6

Strings

REGEXP=, xrefs: 0045B254
LAST, xrefs: 0045B204
[CLASS:, xrefs: 0045B28F
ALL, xrefs: 0045B2D3
[LAST, xrefs: 0045B2EC
[REGEXPTITLE:, xrefs: 0045B267
CLASSNAME=, xrefs: 0045B27C
[ACTIVE, xrefs: 0045B22C
[ALL, xrefs: 0045B2E5
[HANDLE:, xrefs: 0045B24B
HANDLE=, xrefs: 0045B238
ACTIVE, xrefs: 0045B21A

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: __wcsnicmp$_memmove$__wcsicmp_l__wcsnicmp_l
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 4253603199-1810252412
Opcode ID: 94626885eb53c281deaadfce57b48c135f2990b62eb1e481d15a8ab7da1ab867
Instruction ID: 0a4734ff45ec4583e3e81acf795fc21f567cbd392f16838e952200b8ee8254f0
Opcode Fuzzy Hash: 94626885eb53c281deaadfce57b48c135f2990b62eb1e481d15a8ab7da1ab867
Instruction Fuzzy Hash: B5318B30A04205A6DB14EA62CD43BEE77A4DF24756F60006FB941720D2EF6D6E09C9AE

Uniqueness

Uniqueness Score: 2.28%

Function 0048C8EE, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileUNIQUE

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

DragQueryPoint.SHELL32(?,?), ref: 0048C917

Part of subcall function 0048ADF1: ClientToScreen.USER32(?,?), ref: 0048AE1A
Part of subcall function 0048ADF1: GetWindowRect.USER32(?,?), ref: 0048AE90
Part of subcall function 0048ADF1: PtInRect.USER32(?,?,0048C304), ref: 0048AEA0
Part of subcall function 0048ADF1: MessageBeep.USER32(00000000), ref: 0048AF11

SendMessageW.USER32(?,000000B0,?,?), ref: 0048C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0048C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0048C9AE
_wcscat.LIBCMT ref: 0048C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0048C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 0048CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 0048CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 0048CA47
DragFinish.SHELL32(?), ref: 0048CA4E

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

DefDlgProcW.USER32(?,00000233,?,00000000), ref: 0048CB41

Strings

@GUI_DRAGID, xrefs: 0048CAB9
@GUI_DROPID, xrefs: 0048CA6E
@GUI_DRAGFILE, xrefs: 0048CAF0

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Send$Drag$Query$FileRectWindow$BeepClientFinishLongPointProcScreen_memmove_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2215142556-3440237614
Opcode ID: b0ecac695bacdf03f9556780f83c2e5c7a6877697b6481f50bb03aae47d9f563
Instruction ID: 9d54b60ae23129ec17e3264f3c4c669362dbaaf1ee08fbcc713ae4d442fb7e93
Opcode Fuzzy Hash: b0ecac695bacdf03f9556780f83c2e5c7a6877697b6481f50bb03aae47d9f563
Instruction Fuzzy Hash: B6617F71108301AFC701EF65DC85D9FBBF8EF88714F500A2EF591A21A1DB749A49CB6A

Uniqueness

Uniqueness Score: 100.00%

Function 0046A0B5, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 157windowUNIQUE

APIs

LoadStringW.USER32(00000066,?,00000FFF,0048FB78), ref: 0046A0FC

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 0046A11E
__swprintf.LIBCMT ref: 0046A177
__swprintf.LIBCMT ref: 0046A190

Part of subcall function 004238D8: __woutput_l.LIBCMT ref: 00423931
Part of subcall function 004238D8: __flsbuf.LIBCMT ref: 00423953
Part of subcall function 004238D8: __flsbuf.LIBCMT ref: 0042396B

MessageBoxW.USER32(?,?,00011010,?), ref: 0046A27F

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Part of subcall function 00407E8C: _memmove.LIBCMT ref: 00407ED5

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

_wprintf.LIBCMT ref: 0046A246
_wprintf.LIBCMT ref: 0046A264

Part of subcall function 00423ECA: __stbuf.LIBCMT ref: 00423F1A
Part of subcall function 00423ECA: __woutput_l.LIBCMT ref: 00423F33
Part of subcall function 00423ECA: __ftbuf.LIBCMT ref: 00423F47

Strings

%I, xrefs: 0046A0C9
"%s" (%d) : ==> %s:, xrefs: 0046A25F
^ ERROR, xrefs: 0046A1E8
Error: , xrefs: 0046A20E
"%s" (%d) : ==> %s:%s%s, xrefs: 0046A241
Line %d (File "%s"):, xrefs: 0046A171, 0046A18A

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$LoadString__flsbuf__swprintf__woutput_l_wprintf$Message__ftbuf__stbuf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR$%I
API String ID: 1709840473-1791166345
Opcode ID: 661f649b8b59d081535385d181687ac83481af4682fac3b186d71f510afb67f7
Instruction ID: 5eca713841166c9be329d5f9fa950bc6c7814f67f077d1cebb18d641bd9ae8df
Opcode Fuzzy Hash: 661f649b8b59d081535385d181687ac83481af4682fac3b186d71f510afb67f7
Instruction Fuzzy Hash: 70516171940509AACF15EBA1CD42EEEB779AF04304F1041AAF50572191EB396F58CFAA

Uniqueness

Uniqueness Score: 100.00%

Function 0048C49C, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0048C4EC
GetFocus.USER32 ref: 0048C4FC
GetDlgCtrlID.USER32(00000000), ref: 0048C507

Part of subcall function 00487F4C: GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00487FBA

Part of subcall function 004025DB: GetWindowLongW.USER32(?,000000EB), ref: 004025EC

_memset.LIBCMT ref: 0048C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0048C65D
GetMenuItemCount.USER32(?), ref: 0048C67D
GetMenuItemID.USER32(?,00000000), ref: 0048C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0048C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0048C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0048C744

Part of subcall function 0048B60B: IsWindow.USER32(00A74CB8), ref: 0048B6A5
Part of subcall function 0048B60B: IsWindowEnabled.USER32(00A74CB8), ref: 0048B6B1
Part of subcall function 0048B60B: SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0048B795
Part of subcall function 0048B60B: SendMessageW.USER32(00A74CB8,000000B0,?,?), ref: 0048B7CC
Part of subcall function 0048B60B: IsDlgButtonChecked.USER32(?,?), ref: 0048B809
Part of subcall function 0048B60B: GetWindowLongW.USER32(00A74CB8,000000EC), ref: 0048B82B
Part of subcall function 0048B60B: SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0048B843

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

DefDlgProcW.USER32(?,00000111,?,?), ref: 0048C779

Strings

0, xrefs: 0048C62A

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ItemMenu$Window$InfoMessage$LongSend$ButtonCheckCheckedCountCtrlEnabledException@8FocusPostProcRadioThrow_memsetstd::exception::exception
String ID: 0
API String ID: 1009432489-4108050209
Opcode ID: f1c2b2b362b8fb24544f0532e031d5921b607a9cef57e9f66c8c291609998193
Instruction ID: 044de7e4dd35a86088de80346c1f5ac2e8e2e031d82544e17b68ab28cbecaa44
Opcode Fuzzy Hash: f1c2b2b362b8fb24544f0532e031d5921b607a9cef57e9f66c8c291609998193
Instruction Fuzzy Hash: A1818E70608311AFDB10EF15C984A6FBBE8FB88314F104D2EF995A3291D774D905CBAA

Uniqueness

Uniqueness Score: 2.28%

Function 004045DF, Relevance: 19.7, APIs: 13, Instructions: 217windowCOMMON

APIs

_memset.LIBCMT ref: 004045F9
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 0043D750
GetMenuItemCount.USER32(004C6890), ref: 0043D7CD

Part of subcall function 004626F9: _memset.LIBCMT ref: 00462747
Part of subcall function 004626F9: GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00462792
Part of subcall function 004626F9: IsMenu.USER32(00000000), ref: 004627B2
Part of subcall function 004626F9: CreatePopupMenu.USER32 ref: 004627E6
Part of subcall function 004626F9: GetMenuItemCount.USER32(000000FF), ref: 00462844
Part of subcall function 004626F9: InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00462875

DeleteMenu.USER32(004C6890,00000005,00000000), ref: 0043D85D
DeleteMenu.USER32(004C6890,00000004,00000000), ref: 0043D865
DeleteMenu.USER32(004C6890,00000006,00000000), ref: 0043D86D
DeleteMenu.USER32(004C6890,00000003,00000000), ref: 0043D875
GetMenuItemCount.USER32(004C6890), ref: 0043D87D
SetMenuItemInfoW.USER32(004C6890,00000004,00000000,00000030), ref: 0043D8B7
GetCursorPos.USER32(?), ref: 0043D8C1
SetForegroundWindow.USER32(00000000), ref: 0043D8CA
TrackPopupMenuEx.USER32(004C6890,00000000,?,00000000,00000000,00000000), ref: 0043D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0043D8E9

Part of subcall function 0040410D: _memset.LIBCMT ref: 0040418D
Part of subcall function 0040410D: _wcscpy.LIBCMT ref: 004041E1
Part of subcall function 0040410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 004041F1
Part of subcall function 0040410D: LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0043D5EC

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Menu$Item$Delete$CountInfo_memset$Popup$CreateCursorForegroundIconInsertLoadMessageNotifyPostShell_StringTrackWindow_wcscpy
String ID:
API String ID: 3665929494-0
Opcode ID: e597ca9b44f071e22430df5e07161a6b1da801a0e098349f580a2e7d56667eca
Instruction ID: 2639a210842817a24e8eb206f5a4e9758f878a2c8cdeb628821b1e41afb81110
Opcode Fuzzy Hash: e597ca9b44f071e22430df5e07161a6b1da801a0e098349f580a2e7d56667eca
Instruction Fuzzy Hash: 14713970A40205BEEB209F15EC45FABBF65FF49368F200227F625662D1C7B96C10DB99

Uniqueness

Uniqueness Score: 2.48%

Function 0045E558, Relevance: 19.7, APIs: 10, Strings: 1, Instructions: 404COMMON

APIs

#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?), ref: 0045E9D0

Part of subcall function 0045F2CC: #10.OLEAUT32(?,?,?,?,?,0045E5CC,?,?,?,?,?,?,?,?,?,?), ref: 0045F2D9
Part of subcall function 0045F2CC: #12.OLEAUT32(?,?,00000000,?,?,?,0045E5CC,?,?,?,?,?,?,?,?), ref: 0045F322

#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E643

Part of subcall function 0045F583: #9.OLEAUT32(?,?,?,?,?,?,0045E5F6,?,?,?,?,?,?,?,?,?), ref: 0045F595

Part of subcall function 0045F279: #7.OLEAUT32(?,?,?,?,?,0045E61E,?,?,?,?,?,?,?,?,?), ref: 0045F286
Part of subcall function 0045F279: lstrcpyW.KERNEL32(00000000,?), ref: 0045F2B7

#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E621

Part of subcall function 0045F3DD: #8.OLEAUT32(?,?,?), ref: 0045F3F7
Part of subcall function 0045F3DD: #9.OLEAUT32(00000013,?,?), ref: 0045F469
Part of subcall function 0045F3DD: #9.OLEAUT32(00000000,?,?), ref: 0045F4C4
Part of subcall function 0045F3DD: _memmove.LIBCMT ref: 0045F4EE
Part of subcall function 0045F3DD: #9.OLEAUT32(?,?,?), ref: 0045F53B
Part of subcall function 0045F3DD: #12.OLEAUT32(?,?,00000000,00000013,?,?), ref: 0045F569

Part of subcall function 0045E187: #9.OLEAUT32(?,?,?,?,?,0045E6A4,?,?,?,?,?,?,?,?), ref: 0045E198

Part of subcall function 0045F0F4: CLSIDFromString.OLE32(?,00000000), ref: 0045F116
Part of subcall function 0045F0F4: #8.OLEAUT32(00000008,00000000,?,?), ref: 0045F127
Part of subcall function 0045F0F4: #9.OLEAUT32(00000008), ref: 0045F176

Part of subcall function 0045F20E: _memmove.LIBCMT ref: 0045F233

Part of subcall function 0045F1C7: #7.OLEAUT32(?,00000000,?,?,?,0045E71C,?,?,?,?,?,?,?,?,?,?), ref: 0045F1D4
Part of subcall function 0045F1C7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001,00000000,00000000,?,0045E71C,?,?,?,?,?,?), ref: 0045F1FF

Part of subcall function 0045F244: #8.OLEAUT32(00000000,00000000,?,?,0045E72B,?,?,?,?,?,?,?,?,?,?), ref: 0045F254
Part of subcall function 0045F244: #10.OLEAUT32(00000000,?,?,0045E72B,?,?,?,?,?,?,?,?,?,?), ref: 0045F25F

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?), ref: 0045E75F
#8.OLEAUT32(?,?,?,?,?,?,?,?,?,?), ref: 0045E7C2
#146.OLEAUT32(00000008,?,?,00000015,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E828
#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?), ref: 0045E83A
#10.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?), ref: 0045E8A6

Part of subcall function 0045F34A: #11.OLEAUT32(?,?,00000000,?,00000000,?,0045E915,?,?,?,?,?,?,?,?), ref: 0045F374
Part of subcall function 0045F34A: #9.OLEAUT32(?,?,0045E915,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045F38B
Part of subcall function 0045F34A: #9.OLEAUT32(?,00000000,?,00000000,?,0045E915,?,?,?,?,?,?,?,?,?,?), ref: 0045F3C1

#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E931
#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?), ref: 0045E94A

Part of subcall function 0045DFDC: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,?,00000000), ref: 0045E01F
Part of subcall function 0045DFDC: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0045E045
Part of subcall function 0045DFDC: #2.OLEAUT32(00000000), ref: 0045E048
Part of subcall function 0045DFDC: #2.OLEAUT32(?,00000000,?,00000000), ref: 0045E066
Part of subcall function 0045DFDC: #6.OLEAUT32(?), ref: 0045E06F
Part of subcall function 0045DFDC: StringFromGUID2.OLE32(?,?,00000028), ref: 0045E094
Part of subcall function 0045DFDC: #2.OLEAUT32(?), ref: 0045E0A2

Strings

$@, xrefs: 0045E5A3

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ByteCharMultiWide$FromString_memmove$#146Exception@8Throwlstrcpystd::exception::exception
String ID: $@
API String ID: 1954046481-3337466569
Opcode ID: fdc21c2c2310439b97150ff59be9d507ef7602ed35f6f1ccccfbbbda465b40aa
Instruction ID: 2367215a764623180a7b7ccf3c946de02fa337b23223ba35a6fad57feaa93611
Opcode Fuzzy Hash: fdc21c2c2310439b97150ff59be9d507ef7602ed35f6f1ccccfbbbda465b40aa
Instruction Fuzzy Hash: E5E1EFB5504311ABD724DF1AC884A2BBBE4FF88755F40482EF985D7362C238E949CB5A

Uniqueness

Uniqueness Score: 7.75%

Function 0048772A, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

Part of subcall function 0048BCED: CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0048BD10
Part of subcall function 0048BCED: GetFileSize.KERNEL32(00000000,00000000), ref: 0048BD27
Part of subcall function 0048BCED: GlobalAlloc.KERNEL32(00000002,00000000), ref: 0048BD32
Part of subcall function 0048BCED: CloseHandle.KERNEL32(00000000), ref: 0048BD3F
Part of subcall function 0048BCED: GlobalLock.KERNEL32(00000000), ref: 0048BD48
Part of subcall function 0048BCED: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0048BD57
Part of subcall function 0048BCED: GlobalUnlock.KERNEL32(00000000), ref: 0048BD60
Part of subcall function 0048BCED: CloseHandle.KERNEL32(00000000), ref: 0048BD67
Part of subcall function 0048BCED: CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0048BD78
Part of subcall function 0048BCED: #418.OLEAUT32(?,00000000,00000000,00492CAC,?), ref: 0048BD91
Part of subcall function 0048BCED: GlobalFree.KERNEL32(00000000), ref: 0048BDA1
Part of subcall function 0048BCED: GetObjectW.GDI32(?,00000018,000000FF), ref: 0048BDC5
Part of subcall function 0048BCED: CopyImage.USER32(?,00000000,?,?,00002000), ref: 0048BDF0
Part of subcall function 0048BCED: DeleteObject.GDI32(00000000), ref: 0048BE18
Part of subcall function 0048BCED: SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0048BE2E

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000), ref: 004877CD
CreateCompatibleDC.GDI32(00000000), ref: 004877D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 004877E7
SelectObject.GDI32(00000000,00000000), ref: 004877EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 004877FA
DeleteDC.GDI32(00000000), ref: 00487803
GetWindowLongW.USER32(?,000000EC), ref: 0048780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00487821
DestroyWindow.USER32(?), ref: 0048782D

Strings

static, xrefs: 00487765
athan, xrefs: 00487813

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$Global$CreateObject$FileMessageSend$CloseDeleteHandle$#418AllocAttributesCompatibleCopyDestroyFreeImageLayeredLockLongMovePixelReadSelectShowSizeStockStreamUnlock
String ID: athan$static
API String ID: 406645659-3227529370
Opcode ID: 80c3bdd7a0d63ebeaa4556a6b8c79307fca78e479194d2b0b8ea9a7529ca2377
Instruction ID: 789ec3a4cb580d3187b1e0f25c444e25d791e636f2d83489152635d906d596f6
Opcode Fuzzy Hash: 80c3bdd7a0d63ebeaa4556a6b8c79307fca78e479194d2b0b8ea9a7529ca2377
Instruction Fuzzy Hash: DD316E31105115AFDF11AF64DC08FDF3B69EF49324F210A29FA15A61A0D739E815DBA8

Uniqueness

Uniqueness Score: 2.12%

Function 004648F3, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73UNIQUE

APIs

#115.WSOCK32(00000101,?), ref: 0046490E
#57.WSOCK32(?,00000100), ref: 00464928
#52.WSOCK32(?), ref: 00464935
_wcscpy.LIBCMT ref: 0046495D
_memmove.LIBCMT ref: 00464970
#11.WSOCK32(?), ref: 0046497B
_strcat.LIBCMT ref: 00464989

Part of subcall function 0046573E: _strlen.LIBCMT ref: 00465756
Part of subcall function 0046573E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,?,00000000,?,00000000,?,00466870), ref: 00465769
Part of subcall function 0046573E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,?,00466870), ref: 0046579D

_wcscpy.LIBCMT ref: 004649A0
#116.WSOCK32 ref: 004649AE
_wcscpy.LIBCMT ref: 004649BC

Strings

0.0.0.0, xrefs: 00464957

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _wcscpy$ByteCharMultiWide$#115#116_memmove_strcat_strlen
String ID: 0.0.0.0
API String ID: 860691916-3771769585
Opcode ID: b04b605564964ba513ed41840f888054d6b25d01aa9a0fd6bf6a64456257caa4
Instruction ID: a415c47feca9f18ccc9aca6889e14e15c95de93dcf3fd0710918b8717f4bba87
Opcode Fuzzy Hash: b04b605564964ba513ed41840f888054d6b25d01aa9a0fd6bf6a64456257caa4
Instruction Fuzzy Hash: FE110571A04124ABDB20AB34AD06EDF77ACDF40714F1001BBF40492191FFB89AC9976A

Uniqueness

Uniqueness Score: 100.00%

Function 0040201B, Relevance: 18.2, APIs: 12, Instructions: 170windowtimeCOMMON

APIs

Part of subcall function 00401B41: InvalidateRect.USER32(?,00000000,00000001), ref: 00401B9A

DestroyWindow.USER32(?), ref: 004020D3
KillTimer.USER32(-00000001,?), ref: 0040216E
DestroyAcceleratorTable.USER32(00000000), ref: 0043BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004016CB,00000000,?,?,00401AE2,?,?), ref: 0043BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004016CB,00000000,?,?,00401AE2,?,?), ref: 0043BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004016CB,00000000,?,?,00401AE2,?,?), ref: 0043BF5A
DeleteObject.GDI32(00000000), ref: 0043BF6C
DestroyIcon.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0043BF7E
DeleteObject.GDI32(00000000), ref: 0043BF90
DestroyWindow.USER32(00000000), ref: 0043BFA2
DestroyIcon.USER32(00000000,?,00000000,?,?,?,?,004016CB,00000000,?,?,00401AE2,?,?), ref: 0043BFB4
DestroyIcon.USER32(00000000,?,00000000,?,?,?,?,004016CB,00000000,?,?,00401AE2,?,?), ref: 0043BFC2

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Destroy$IconImageList_$DeleteObjectWindow$AcceleratorInvalidateKillRectTableTimer
String ID:
API String ID: 2960459417-0
Opcode ID: 78cac20c66e0e6767138dba4ab7aa47be9ee332057a729cfcb45c06255a83930
Instruction ID: 62d4407ef01395a22b5ebf1233624f5b0999fc02156c59d6ff76a6043205edb2
Opcode Fuzzy Hash: 78cac20c66e0e6767138dba4ab7aa47be9ee332057a729cfcb45c06255a83930
Instruction Fuzzy Hash: 55616B34101610DFD725AF14CE48B2A77F1FF44315F11993EE642A6AE0C7B9A881DF99

Uniqueness

Uniqueness Score: 0.27%

Function 004021A5, Relevance: 18.1, APIs: 12, Instructions: 132COMMON

APIs

Part of subcall function 004025DB: GetWindowLongW.USER32(?,000000EB), ref: 004025EC

GetSysColor.USER32(0000000F), ref: 004021D3
GetSysColor.USER32(00000008), ref: 00402231
SetTextColor.GDI32(?,000000FF), ref: 0040223B
SetBkMode.GDI32(?,00000001), ref: 00402250
GetStockObject.GDI32(00000005), ref: 00402258
GetWindowDC.USER32(?), ref: 0043C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0043C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0043C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0043C112
GetPixel.GDI32(00000000,?,?), ref: 0043C132
ReleaseDC.USER32(?,00000000), ref: 0043C13D
SetBkColor.GDI32(?,00000000), ref: 0043C159

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ColorPixel$Window$BrushCreateLongModeObjectReleaseSolidStockText
String ID:
API String ID: 2304791953-0
Opcode ID: 9bab39a7b058799e73335b840fbde69c808da43099dfa5b55a8570615694d643
Instruction ID: 47503e6e8c25a14c6d04473920290e3c3a9e3a2f6008e0ea463bb1cae73e411f
Opcode Fuzzy Hash: 9bab39a7b058799e73335b840fbde69c808da43099dfa5b55a8570615694d643
Instruction Fuzzy Hash: FD41D731000140AFDF215FA8DC8CBBA3765EB46331F1446BAFD65AA2E2C7758C86DB59

Uniqueness

Uniqueness Score: 0.24%

Function 004873C1, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

APIs

_memset.LIBCMT ref: 004873D9
CreateMenu.USER32 ref: 004873F4
SetMenu.USER32(?,00000000), ref: 00487403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00487490
IsMenu.USER32(?), ref: 004874A6
CreatePopupMenu.USER32 ref: 004874B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004874DD
DrawMenuBar.USER32 ref: 004874E5

Strings

0, xrefs: 004873CF
F, xrefs: 004874D1

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: c25b011170b029855e58234153c04d5ad6438b2c3f951a4d7e3730a877261e10
Instruction ID: 469fb1be4590f9541f2c80e88f17ef0f5a107e94f682755a56fb5537772b2935
Opcode Fuzzy Hash: c25b011170b029855e58234153c04d5ad6438b2c3f951a4d7e3730a877261e10
Instruction Fuzzy Hash: 08415874A01205EFDB10EF64D898E9EBBB9FF49300F24482AED55A7361D734A914CF68

Uniqueness

Uniqueness Score: 4.65%

Function 00427040, Relevance: 16.8, APIs: 11, Instructions: 258COMMON

APIs

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

_memset.LIBCMT ref: 0042707B

Part of subcall function 00433F0C: __lock.LIBCMT ref: 00433F23
Part of subcall function 00433F0C: __tzset_nolock.LIBCMT ref: 00433F36

__gmtime64_s.LIBCMT ref: 00427114
__gmtime64_s.LIBCMT ref: 0042714A
__gmtime64_s.LIBCMT ref: 00427167

Part of subcall function 00433CE1: _memset.LIBCMT ref: 00433D11
Part of subcall function 00433CE1: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433D64
Part of subcall function 00433CE1: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433E60
Part of subcall function 00433CE1: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433EB5
Part of subcall function 00433CE1: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433ECF
Part of subcall function 00433CE1: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433EF0

Part of subcall function 00433F5C: __lock.LIBCMT ref: 00433F6E
Part of subcall function 00433F5C: __isindst_nolock.LIBCMT ref: 00433F7B

__allrem.LIBCMT ref: 004271BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004271D9
__allrem.LIBCMT ref: 004271F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042720E
__allrem.LIBCMT ref: 00427225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00427243
__invoke_watson.LIBCMT ref: 004272B4

Part of subcall function 00429006: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00429008
Part of subcall function 00429006: __call_reportfault.LIBCMT ref: 00429021

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem__gmtime64_s$__lock_memset$FeaturePresentProcessor__call_reportfault__getptd_noexit__invoke_watson__isindst_nolock__tzset_nolock
String ID:
API String ID: 3881391381-0
Opcode ID: f449d8c0ffc7a299f8ac5c355c84109bbbb1ac945fd94324ebc384d93c6e9658
Instruction ID: 3a5766166ad995f9d080cadeea3a970d97efeda9365c881e9167125cd7ba6949
Opcode Fuzzy Hash: f449d8c0ffc7a299f8ac5c355c84109bbbb1ac945fd94324ebc384d93c6e9658
Instruction Fuzzy Hash: F3711972B04726EBD7149E79DC82B6BB3A4AF14324F54426FF514E6381E778E9008B98

Uniqueness

Uniqueness Score: 2.28%

Function 00487192, Relevance: 16.7, APIs: 11, Instructions: 185windowCOMMON

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00487214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00487217
GetWindowLongW.USER32(?,000000F0), ref: 0048723B
_memset.LIBCMT ref: 0048724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0048725E

Part of subcall function 0048AF23: _wcspbrk.LIBCMT ref: 0048AF30
Part of subcall function 0048AF23: _wcsncpy.LIBCMT ref: 0048AF64

SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 004872D6
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00487320
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 0048733F
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 0048735A
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 0048736E
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 0048738B

Part of subcall function 0048B57F: GetWindowRect.USER32(?,?), ref: 0048B59E
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5B6
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5DA
Part of subcall function 0048B57F: InvalidateRect.USER32(?,?,?), ref: 0048B5F5

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend$ClientRectScreenWindow$InvalidateLong_memset_wcsncpy_wcspbrk
String ID:
API String ID: 3849892166-0
Opcode ID: 1f254a2dd634fbf8d682cb823299d5faa4870696f922a999c8bea393425f8b4a
Instruction ID: 98a04bc020cc1dfb4f2f33dd24e3f33540f585986abfb0e63cd4152109fcc849
Opcode Fuzzy Hash: 1f254a2dd634fbf8d682cb823299d5faa4870696f922a999c8bea393425f8b4a
Instruction Fuzzy Hash: 57618E75900208AFDB10EFA4CC91EEE77F8AF09704F24456AFA14A73A1C774A945DB64

Uniqueness

Uniqueness Score: 2.04%

Function 0045710E, Relevance: 16.6, APIs: 11, Instructions: 123COMMON

APIs

#41.OLEAUT32(0000000C,?,?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4), ref: 00457135
#37.OLEAUT32(?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4,?,00000016), ref: 0045718E
#8.OLEAUT32(?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4,?,00000016), ref: 004571A0
#23.OLEAUT32(?,?,?,?,?,?,?,?,00456EC6), ref: 004571C0
#9.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 00457264

Part of subcall function 00409E9C: #9.OLEAUT32(?,?,?,?,?,00469D81,?,00000001,-004C5E88,?,00455CCE,?,?,?,0040FAE1,00000000), ref: 0043FE11

Part of subcall function 004570DC: #9.OLEAUT32(?,00000000,?,00000016,00479753,?,00000016,?,00000016), ref: 00457101

#10.OLEAUT32(?,?,00000002,?,?,?,?,?,?,?,00456EC6), ref: 00457213
#24.OLEAUT32(?,00000002,?,?,?,?,?,?,?,00456EC6), ref: 00457227
#9.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 0045723C
#39.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 00457249
#38.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 00457252
#38.OLEAUT32(?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4,?,00000016), ref: 0045726F

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23c1a385547e4fe92da69b3c9963987276d6a870cfb840cf5260315eec4c18b
Instruction ID: ee6ff97d49ab8f9c2dd167b55ca35aa0841007d9f21f2d6d7be11d351e1905ac
Opcode Fuzzy Hash: b23c1a385547e4fe92da69b3c9963987276d6a870cfb840cf5260315eec4c18b
Instruction Fuzzy Hash: 61416031A00119AFCB00DFA9D8449AEBBB9FF18755F00847EF955E7362CB34A949CB94

Uniqueness

Uniqueness Score: 2.04%

Function 00479428, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 263UNIQUE

APIs

_memset.LIBCMT ref: 0047947C
#8.OLEAUT32(?), ref: 0047954D
#8.OLEAUT32(?,?,?,?), ref: 0047964E
#9.OLEAUT32(?), ref: 00479658

Part of subcall function 00467804: #8.OLEAUT32(00000000,?,?,00000016,00000016,?,004799E9,?,?), ref: 00467844
Part of subcall function 00467804: #10.OLEAUT32(00000000,?,?,004799E9,?,?), ref: 0046784D
Part of subcall function 00467804: #9.OLEAUT32(00000000,?,004799E9,?,?), ref: 00467859

#9.OLEAUT32(?,?), ref: 004796B5

Part of subcall function 004796DB: GetLastError.KERNEL32(?,00000000,?,0048FB84,?,00000016,?,00000016), ref: 004798A5
Part of subcall function 004796DB: #8.OLEAUT32(?,?,?,?), ref: 00479999
Part of subcall function 004796DB: #9.OLEAUT32(?,0048FB84,00000000,?,?,?,?,?), ref: 00479A43

Strings

get__NewEnum, xrefs: 00479454
Incorrect Object type in FOR..IN loop, xrefs: 00479631
_NewEnum, xrefs: 00479436
Null Object assignment in FOR..IN loop, xrefs: 004794DD, 0047960B, 004796C3

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ErrorLast_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 533350023-1765764032
Opcode ID: c876955a294aa8d86eb8db64ea30777345f3c0a1fb8a500add95116d5b305f7c
Instruction ID: fcebb0c40d61f867c18811628665e3ff882c4d71f35d8502a0dec60dd81a9e36
Opcode Fuzzy Hash: c876955a294aa8d86eb8db64ea30777345f3c0a1fb8a500add95116d5b305f7c
Instruction Fuzzy Hash: 2791AD71A00215ABCF24DFA5C844FEFBBB8EF45714F10851AE519AB280D778AD05CFA8

Uniqueness

Uniqueness Score: 100.00%

Function 004162F2, Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 143UNIQUE

APIs

_memset.LIBCMT ref: 004163A8
_memmove.LIBCMT ref: 00416446
_memset.LIBCMT ref: 0041646A

Strings

internal error: missing capturing bracket, xrefs: 00451158
ERCP, xrefs: 00416313
failed to get memory, xrefs: 00416488
argument is not a compiled regular expression, xrefs: 00451160
internal error: opcode not recognized, xrefs: 0041647D
argument not compiled in 16 bit mode, xrefs: 00451150

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP$argument is not a compiled regular expression$argument not compiled in 16 bit mode$failed to get memory$internal error: missing capturing bracket$internal error: opcode not recognized
API String ID: 2532777613-264027815
Opcode ID: 5050f1d5a739bef3a8333c6a539d66c1edae72094ea9907375e2dc5b1e6d177f
Instruction ID: 5033df5f12e9d93d71518abbe4fce8200a660ff7c3ad8cb2f73575c85904d8e6
Opcode Fuzzy Hash: 5050f1d5a739bef3a8333c6a539d66c1edae72094ea9907375e2dc5b1e6d177f
Instruction Fuzzy Hash: 9551C0719007199BCB24CF65C881BEBBBF4EF08314F20856FE94AC6251E778D985CB58

Uniqueness

Uniqueness Score: 100.00%

Function 0048C27C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowUNIQUE

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

Part of subcall function 00402344: GetCursorPos.USER32(?), ref: 00402357
Part of subcall function 00402344: ScreenToClient.USER32(004C67B0,?), ref: 00402374
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000001), ref: 00402399
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000002), ref: 004023A7
Part of subcall function 00402344: GetWindowLongW.USER32(?,000000F0), ref: 0043C23A

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0048C2E4
ImageList_EndDrag.COMCTL32 ref: 0048C2EA
ReleaseCapture.USER32 ref: 0048C2F0

Part of subcall function 0048ADF1: ClientToScreen.USER32(?,?), ref: 0048AE1A
Part of subcall function 0048ADF1: GetWindowRect.USER32(?,?), ref: 0048AE90
Part of subcall function 0048ADF1: PtInRect.USER32(?,?,0048C304), ref: 0048AEA0
Part of subcall function 0048ADF1: MessageBeep.USER32(00000000), ref: 0048AF11

Part of subcall function 0048804A: SendMessageW.USER32(?,00000188,00000000,00000000), ref: 004880E0
Part of subcall function 0048804A: SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 004880FF
Part of subcall function 0048804A: SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00488123
Part of subcall function 0048804A: SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00488134
Part of subcall function 0048804A: SendMessageW.USER32(?,00000149,00000000,00000000), ref: 00488153
Part of subcall function 0048804A: SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00488186
Part of subcall function 0048804A: SendMessageW.USER32(?,0000133C,00000000,?), ref: 004881AC
Part of subcall function 0048804A: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004881E7
Part of subcall function 0048804A: SendMessageW.USER32(?,0000113E,00000000,00000004), ref: 0048822E
Part of subcall function 0048804A: SendMessageW.USER32(?,0000113E,00000000,00000004), ref: 00488256
Part of subcall function 0048804A: IsMenu.USER32(?), ref: 0048826F
Part of subcall function 0048804A: GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004882CA
Part of subcall function 0048804A: GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004882F8
Part of subcall function 0048804A: GetWindowLongW.USER32(?,000000F0), ref: 0048836C
Part of subcall function 0048804A: SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 004883BB
Part of subcall function 0048804A: SendMessageW.USER32(?,00001001,00000000,?), ref: 00488456
Part of subcall function 0048804A: wsprintfW.USER32 ref: 0048847E
Part of subcall function 0048804A: SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 004884A0
Part of subcall function 0048804A: GetWindowTextW.USER32(?,00000000,00000001), ref: 004884C8
Part of subcall function 0048804A: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 004884EA
Part of subcall function 0048804A: SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0048850A
Part of subcall function 0048804A: GetWindowTextW.USER32(?,00000000,00000001), ref: 00488531
Part of subcall function 0048804A: GetWindowLongW.USER32(?,000000EC), ref: 004885AB
Part of subcall function 0048804A: _memset.LIBCMT ref: 004885BD
Part of subcall function 0048804A: SendMessageW.USER32(?,00001053,000000FF,?), ref: 004885EC
Part of subcall function 0048804A: SendMessageW.USER32(?,0000104B,00000000,?), ref: 00488625
Part of subcall function 0048804A: SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 00488676
Part of subcall function 0048804A: CharNextW.USER32(00000000), ref: 004886B1
Part of subcall function 0048804A: SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 004886E1
Part of subcall function 0048804A: SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 004886FC
Part of subcall function 0048804A: _memset.LIBCMT ref: 00488709
Part of subcall function 0048804A: SendMessageW.USER32(?,0000104B,00000000,?), ref: 0048872A
Part of subcall function 0048804A: SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0048873F

SetWindowTextW.USER32(?,00000000), ref: 0048C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0048C3AD

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

DefDlgProcW.USER32(?,00000202,?), ref: 0048C48F

Strings

@GUI_DROPID, xrefs: 0048C3E1
@GUI_DRAGFILE, xrefs: 0048C424

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Send$Window$Long$MenuText$AsyncClientDragImageInfoItemList_RectScreenState_memset$BeepCaptureCharCursorLeaveNextProcRelease_memmovewsprintf
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 3004859125-2107944366
Opcode ID: b798aa5b2f107ad1458b2c75d2adbba9596b4275280ea14d7fefb00be64307d6
Instruction ID: dc367e10a39d425f30cb391b84f58576d3d09b44280b1156dac04409bcc5156d
Opcode Fuzzy Hash: b798aa5b2f107ad1458b2c75d2adbba9596b4275280ea14d7fefb00be64307d6
Instruction Fuzzy Hash: 7451A170204304AFD700EF24C895F6E77E5FB88314F00892EF555972E1DB78A948DB6A

Uniqueness

Uniqueness Score: 100.00%

Function 004888B4, Relevance: 13.7, APIs: 9, Instructions: 170windowCOMMON

APIs

Part of subcall function 0048A71E: DeleteObject.GDI32(00000000), ref: 0048A757

InvalidateRect.USER32(?,00000000,00000001), ref: 0048896E
SendMessageW.USER32(?,00002001,00000000,00000000), ref: 004889A4
ShowWindow.USER32(?,00000000), ref: 004889ED
ShowWindow.USER32(?,00000005), ref: 004889F3
SetFocus.USER32 ref: 004889F7
GetWindowLongW.USER32(?,000000F0), ref: 00488A35
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00488A42
SendMessageW.USER32(?,00001001,00000000,?), ref: 00488A86
SendMessageW.USER32(?,00001026,00000000,?), ref: 00488A93

Part of subcall function 0048B57F: GetWindowRect.USER32(?,?), ref: 0048B59E
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5B6
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5DA
Part of subcall function 0048B57F: InvalidateRect.USER32(?,?,?), ref: 0048B5F5

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$MessageRectSend$ClientInvalidateLongScreenShow$BrushCreateDeleteFocusObjectSolid
String ID:
API String ID: 3433424984-0
Opcode ID: d838244f26b6da36ad23e0fd2cd8cd60ee266be12254dd83e7b274d95d6c2824
Instruction ID: c6b024f5472ab695e497d5b95dd9337e811c75869fcd45f43dd79c229618c00e
Opcode Fuzzy Hash: d838244f26b6da36ad23e0fd2cd8cd60ee266be12254dd83e7b274d95d6c2824
Instruction Fuzzy Hash: 9651A430600208BADF34BF25CC89B6E7B65BF05314FA0492FF515E62E1DF79A9809B59

Uniqueness

Uniqueness Score: 0.14%

Function 00463226, Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

APIs

Part of subcall function 0042313D: __wcsicmp_l.LIBCMT ref: 004231C6

LoadIconW.USER32(00000000,00007F03), ref: 004632C5
ExtractIconExW.SHELL32(?,004C6A2C,00000000,004C6A30,00000001), ref: 004632DA

Strings

warning, xrefs: 004632AE
question, xrefs: 0046327E
blank, xrefs: 00463247
info, xrefs: 00463266
stop, xrefs: 00463296

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Icon$ExtractLoad__wcsicmp_l
String ID: blank$info$question$stop$warning
API String ID: 3534929142-404129466
Opcode ID: 77fe609f7d7df2f5dc9ffe3ad1bea5ae7a1829eac4f59a579a3ff1f305724edc
Instruction ID: bd39f8208ce013f69ee2957a59db9678c91d00ade58264490e67fb22ecbd3877
Opcode Fuzzy Hash: 77fe609f7d7df2f5dc9ffe3ad1bea5ae7a1829eac4f59a579a3ff1f305724edc
Instruction Fuzzy Hash: F41138313083967AA7015E55EC62DABB3ACDF19766F2000ABF40056281F67D5B1106BF

Uniqueness

Uniqueness Score: 0.23%

Function 00464534, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowUNIQUE

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0046454E
LoadStringW.USER32(00000000), ref: 00464555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0046456B
LoadStringW.USER32(00000000), ref: 00464572
_wprintf.LIBCMT ref: 00464598

Part of subcall function 00423ECA: __stbuf.LIBCMT ref: 00423F1A
Part of subcall function 00423ECA: __woutput_l.LIBCMT ref: 00423F33
Part of subcall function 00423ECA: __ftbuf.LIBCMT ref: 00423F47

MessageBoxW.USER32(00000000,?,?,00011010), ref: 004645B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00464593

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: HandleLoadModuleString$Message__ftbuf__stbuf__woutput_l_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3368596580-3128320259
Opcode ID: cf1f71f02d618412e5e4011ee75cbf7dd1c2efdd86ab7fdc5ff900bbdf96f69c
Instruction ID: 26d6b9379a34e5b6735d9e290e406bfe10dd0a5cb8e1345d55a1fd9b07754018
Opcode Fuzzy Hash: cf1f71f02d618412e5e4011ee75cbf7dd1c2efdd86ab7fdc5ff900bbdf96f69c
Instruction Fuzzy Hash: 2F0167F2500208BFE750A790DD89EEB776CEB08301F5009BABB45E2051E6789E894B79

Uniqueness

Uniqueness Score: 100.00%

Function 004203A2, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45keyboardUNIQUE

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 004203D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 004203DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 004203E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 004203F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 004203F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00420401

Strings

Lj w, xrefs: 004203A4

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Virtual
String ID: Lj w
API String ID: 4278518827-3995317842
Opcode ID: 0892b48b5c633f5601cc9ff2b3f9abbce8860175636cc0ddc78c40c876bf933f
Instruction ID: d0aff5fa41d626ddf17322be72bdae961d38541aa35c503e85926df042f77401
Opcode Fuzzy Hash: 0892b48b5c633f5601cc9ff2b3f9abbce8860175636cc0ddc78c40c876bf933f
Instruction Fuzzy Hash: 8701A7B0A42B5A7DE3009F6A8C84B53FEA8FF05394F00411BA15C47A42C7F5AC64CBE9

Uniqueness

Uniqueness Score: 100.00%

Function 0048D74C, Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

GetSystemMetrics.USER32(0000000F), ref: 0048D78A
GetSystemMetrics.USER32(0000000F), ref: 0048D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000), ref: 0048D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0048DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0048DA24
ShowWindow.USER32(00000003,00000000), ref: 0048DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 0048DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 0048DA8B

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: eb70e67288782093014809172296cca956549343a8f45a5b87efe570699ce815
Instruction ID: eb940e76658434b7ad8eeabe1703afeb33935e81992f953b53c46158808d9c3e
Opcode Fuzzy Hash: eb70e67288782093014809172296cca956549343a8f45a5b87efe570699ce815
Instruction Fuzzy Hash: C9B19B71901215EBDF18EF68C9857BE7BB1FF48700F18847AEC48AB295D738A950CB58

Uniqueness

Uniqueness Score: 0.43%

Function 00486442, Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

APIs

DeleteObject.GDI32(00000000), ref: 0048645A
GetDC.USER32(00000000), ref: 00486462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0048646D
ReleaseDC.USER32(00000000,00000000), ref: 00486479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 004864B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004864C6
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00486500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00486520

Part of subcall function 0048B57F: GetWindowRect.USER32(?,?), ref: 0048B59E
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5B6
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5DA
Part of subcall function 0048B57F: InvalidateRect.USER32(?,?,?), ref: 0048B5F5

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ClientMessageRectScreenSendWindow$CapsCreateDeleteDeviceFontInvalidateMoveObjectRelease
String ID:
API String ID: 3380433687-0
Opcode ID: 8b88619763fd6254d6488ec5cab92517c73cd71dc51d716d7c88cefd0b034ed1
Instruction ID: 5c1cc6793609d5e6e0acb9b007d1b286434c541ad31a2caf87ecf1e2a9c9b5d4
Opcode Fuzzy Hash: 8b88619763fd6254d6488ec5cab92517c73cd71dc51d716d7c88cefd0b034ed1
Instruction Fuzzy Hash: D4319F72201214BFEB109F50DC4AFEB3FA9EF09765F040069FE08AA295D6759C41CB68

Uniqueness

Uniqueness Score: 0.16%

Function 00401424, Relevance: 10.7, APIs: 7, Instructions: 219COMMON

APIs

Part of subcall function 004012F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0040134D
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040135C
Part of subcall function 004012F3: BeginPath.GDI32(?), ref: 00401373
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040139C
Part of subcall function 004012F3: DeleteObject.GDI32(00000000), ref: 0043B8B6

Part of subcall function 004013B0: EndPath.GDI32(?), ref: 004013BF
Part of subcall function 004013B0: StrokeAndFillPath.GDI32(?), ref: 004013DB
Part of subcall function 004013B0: SelectObject.GDI32(?,00000000), ref: 004013EE
Part of subcall function 004013B0: DeleteObject.GDI32 ref: 00401401
Part of subcall function 004013B0: StrokePath.GDI32(?), ref: 0040141C

MoveToEx.GDI32(?,000000FE,?,00000000), ref: 0043B8CD
AngleArc.GDI32(?,000000FE,?,?,-00000010,-00000010), ref: 0043B90E
LineTo.GDI32(?,000000FE,?), ref: 0043B919
CloseFigure.GDI32(?), ref: 0043B920
Ellipse.GDI32(?,000000FE,?,?,00000000), ref: 0043B967
Rectangle.GDI32(?,000000FE,?,?,?), ref: 0043B9C2
SetPixel.GDI32(?,000000FE,?,?), ref: 0043B9FE

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Object$Path$Select$DeleteStroke$AngleBeginCloseCreateEllipseFigureFillLineMovePixelRectangle
String ID:
API String ID: 304495578-0
Opcode ID: 09c15824ac63a65c0734988e0de1478892bca8845b386477e243a1c01ae4827c
Instruction ID: 504086b8ac0d12f7a80c9a28070c24604f60f8592932f63d6c8978218f7d0df9
Opcode Fuzzy Hash: 09c15824ac63a65c0734988e0de1478892bca8845b386477e243a1c01ae4827c
Instruction Fuzzy Hash: CF718170900109EFCB04DF94CC84EBFBB74FF85314F10816AF915AA2A1C738AA11CBA9

Uniqueness

Uniqueness Score: 0.14%

Function 0048B60B, Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

APIs

IsWindow.USER32(00A74CB8), ref: 0048B6A5
IsWindowEnabled.USER32(00A74CB8), ref: 0048B6B1

Part of subcall function 00402344: GetCursorPos.USER32(?), ref: 00402357
Part of subcall function 00402344: ScreenToClient.USER32(004C67B0,?), ref: 00402374
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000001), ref: 00402399
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000002), ref: 004023A7
Part of subcall function 00402344: GetWindowLongW.USER32(?,000000F0), ref: 0043C23A

SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0048B795
SendMessageW.USER32(00A74CB8,000000B0,?,?), ref: 0048B7CC
IsDlgButtonChecked.USER32(?,?), ref: 0048B809
GetWindowLongW.USER32(00A74CB8,000000EC), ref: 0048B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0048B843

Part of subcall function 0048B958: ShowWindow.USER32(004C67B0,00000000), ref: 0048B9CC
Part of subcall function 0048B958: EnableWindow.USER32(?,00000000), ref: 0048B9F0
Part of subcall function 0048B958: ShowWindow.USER32(004C67B0,00000000), ref: 0048BA50
Part of subcall function 0048B958: ShowWindow.USER32(?,00000004), ref: 0048BA62
Part of subcall function 0048B958: EnableWindow.USER32(?,00000001), ref: 0048BA86
Part of subcall function 0048B958: SendMessageW.USER32(?,0000130C,?,00000000), ref: 0048BAA9

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$MessageSend$Show$AsyncEnableLongState$ButtonCheckedClientCursorEnabledScreen
String ID:
API String ID: 393453039-0
Opcode ID: e0255157bc3365efc4214bf48416f85dc247b11bd12e87c94cf825cbac7e990f
Instruction ID: a7d0881697c90ebb8ac62a69b5506f8dd5c31139f9226510073890e22dad6404
Opcode Fuzzy Hash: e0255157bc3365efc4214bf48416f85dc247b11bd12e87c94cf825cbac7e990f
Instruction Fuzzy Hash: 3A719034600304AFDB20AF64C894FAE7BB9FF49300F15486EE945A7361D739A841DB9D

Uniqueness

Uniqueness Score: 0.43%

Function 0046589F, Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

APIs

GetLocalTime.KERNEL32(?,00000200,?), ref: 004658AC
_wcsncpy.LIBCMT ref: 004658E1
_wcsncpy.LIBCMT ref: 00465913
_wcsncpy.LIBCMT ref: 00465946
_wcsncpy.LIBCMT ref: 00465988
_wcsncpy.LIBCMT ref: 004659C2
_wcsncpy.LIBCMT ref: 004659F1

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 7a73a9d8b045da8df5336bb66c02e39a5d5c0cabf30c4969930a264d4c6a1f2d
Instruction ID: 239261fae8d9192360add67fc14eaad88e6f5f5f9fe45dd7678ebb12787c5eaa
Opcode Fuzzy Hash: 7a73a9d8b045da8df5336bb66c02e39a5d5c0cabf30c4969930a264d4c6a1f2d
Instruction Fuzzy Hash: 514193A5D2012476CB10EBB598869CFB3A89F45710F90885BE518E3111F638E754C7AE

Uniqueness

Uniqueness Score: 0.47%

Function 00487500, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

APIs

_memset.LIBCMT ref: 00487519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004875C0
IsMenu.USER32(?), ref: 004875D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00487620
DrawMenuBar.USER32 ref: 00487633

Strings

0, xrefs: 0048750D

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: edeaa6d0161f0f44574b9eae0ef1f6fd71eb3f1ff2b29b23cea93bbffdc13975
Instruction ID: 244ebd32b8f97b81259969125f729c00c6f494ffb7d64cbbbf547a27778ec249
Opcode Fuzzy Hash: edeaa6d0161f0f44574b9eae0ef1f6fd71eb3f1ff2b29b23cea93bbffdc13975
Instruction Fuzzy Hash: 29414775A05608EFDB10EF58D894E9EBBB8FB04320F14882AE915A7390D734ED51CFA4

Uniqueness

Uniqueness Score: 2.20%

Function 0045E0B5, Relevance: 10.6, APIs: 7, Instructions: 91COMMON

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,00000008), ref: 0045E0FA

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0045E120
#2.OLEAUT32(00000000), ref: 0045E123
#2.OLEAUT32(?,?,00000008), ref: 0045E144
#6.OLEAUT32(?), ref: 0045E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 0045E167
#2.OLEAUT32(?), ref: 0045E175

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ByteCharMultiWide$Exception@8FromStringThrowstd::exception::exception
String ID:
API String ID: 3545288400-0
Opcode ID: 884b170073c76548cf15acec0e6820abadce36ef18cef92617a6400b6a04b6e1
Instruction ID: 67c9d3dc381654df01c0c22ef12326e1a14a94d41d6a64db7bb41e680024eb02
Opcode Fuzzy Hash: 884b170073c76548cf15acec0e6820abadce36ef18cef92617a6400b6a04b6e1
Instruction Fuzzy Hash: E721D671200518BF9B14AFA9DC88CAB73ECEB09761B10813AFD54CB2A1DB74DD458B68

Uniqueness

Uniqueness Score: 0.93%

Function 0048783C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 004878A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 004878AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 004878B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 004878C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 004878D4

Strings

Msctls_Progress32, xrefs: 00487872

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectShowStock
String ID: Msctls_Progress32
API String ID: 269107984-3636473452
Opcode ID: f7bc9240e14bc4aef0fe5bbffa24766386ea0ca3a5f7e24fad0349575530a0aa
Instruction ID: 92253c4dff29aad24290472b4db2c2572747c1f81b0a32cfc704e08449bf8f20
Opcode Fuzzy Hash: f7bc9240e14bc4aef0fe5bbffa24766386ea0ca3a5f7e24fad0349575530a0aa
Instruction Fuzzy Hash: 281104B2540219BFEF15AF60CC85EEB7F6DEF08798F114115FA04A2090CB769C21DBA4

Uniqueness

Uniqueness Score: 0.15%

Function 004241CA, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderUNIQUE

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize), ref: 004241E3
GetProcAddress.KERNEL32(00000000), ref: 004241EA
EncodePointer.KERNEL32(00000000), ref: 004241F6
DecodePointer.KERNEL32(00000001), ref: 00424213

Strings

combase.dll, xrefs: 004241DE
RoInitialize, xrefs: 004241D2

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 5bccab6494b523de4f89304bf15fd68300b1f9e2fdfa0f03ecf7e752e13a8ef8
Instruction ID: 554aba7e706935eef98d5f48fecafe8f14f9d0301701379c1545929dc36dfa4f
Opcode Fuzzy Hash: 5bccab6494b523de4f89304bf15fd68300b1f9e2fdfa0f03ecf7e752e13a8ef8
Instruction Fuzzy Hash: 8EE09AB0690300AEEF911F70ED4DF083A95ABA0B02F644839B851D10A0DBF940A89B0C

Uniqueness

Uniqueness Score: 100.00%

Function 0042429E, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderUNIQUELIBRARYCODE

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,004241B8), ref: 004242B8
GetProcAddress.KERNEL32(00000000), ref: 004242BF
EncodePointer.KERNEL32(00000000), ref: 004242CA
DecodePointer.KERNEL32(004241B8), ref: 004242E5

Strings

RoUninitialize, xrefs: 004242A7
combase.dll, xrefs: 004242B3

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 38a029e66ea7d27f7a9163d1d7d860f5c65e6d37c153c2e42146312fef8db417
Instruction ID: 15b1a5aa7e18a967cd8893ea7d93c869ab9a07ceb3ae99f86fd7b01cca389b21
Opcode Fuzzy Hash: 38a029e66ea7d27f7a9163d1d7d860f5c65e6d37c153c2e42146312fef8db417
Instruction Fuzzy Hash: 71E04F78681300EFDB409B21FE0CF493AA4F750742F140539F041D11A0CFB84644CB1C

Uniqueness

Uniqueness Score: 100.00%

Function 0046675A, Relevance: 9.2, APIs: 6, Instructions: 205COMMON

APIs

Part of subcall function 00465B29: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,?,004667E1,00000000,00000000), ref: 00465B55
Part of subcall function 00465B29: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,004667E1,00000000,00000000,00000000,?), ref: 00465B7C

_memmove.LIBCMT ref: 004667E8

Part of subcall function 004079AB: _memmove.LIBCMT ref: 004079F9

_memmove.LIBCMT ref: 0046685B

Part of subcall function 0046573E: _strlen.LIBCMT ref: 00465756
Part of subcall function 0046573E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,?,00000000,?,00000000,?,00466870), ref: 00465769
Part of subcall function 0046573E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,?,00466870), ref: 0046579D

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 004668AD

Part of subcall function 00409997: __itow.LIBCMT ref: 004099C2
Part of subcall function 00409997: __swprintf.LIBCMT ref: 00409A0C
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9B1
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9DD
Part of subcall function 00409997: __swprintf.LIBCMT ref: 0043F9F7
Part of subcall function 00409997: __i64tow.LIBCMT ref: 0043FA0F

_memmove.LIBCMT ref: 00466942
_memmove.LIBCMT ref: 0046695B
_memmove.LIBCMT ref: 00466977

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$ByteCharMultiWide$__swprintf_wcscpy$Exception@8Throw__i64tow__itow_strlenstd::exception::exception
String ID:
API String ID: 1432503114-0
Opcode ID: 91a5b9742c17e5bb88d913d28afab178534e55022ba6e840a720fd2715564a6d
Instruction ID: 6f91ede795408b0bfae053ebd451bddb5c2729c6fb0f0f0f08a4ed72ad27e223
Opcode Fuzzy Hash: 91a5b9742c17e5bb88d913d28afab178534e55022ba6e840a720fd2715564a6d
Instruction Fuzzy Hash: C9619F7060025A9BDF11EF66C881EFE37A4AF0430CF45452EF8556B2D2EB38AD05CB5A

Uniqueness

Uniqueness Score: 0.36%

Function 0045F3DD, Relevance: 9.2, APIs: 6, Instructions: 159UNIQUE

APIs

#8.OLEAUT32(?,?,?), ref: 0045F3F7
#9.OLEAUT32(00000013,?,?), ref: 0045F469
#9.OLEAUT32(00000000,?,?), ref: 0045F4C4
_memmove.LIBCMT ref: 0045F4EE
#9.OLEAUT32(?,?,?), ref: 0045F53B
#12.OLEAUT32(?,?,00000000,00000013,?,?), ref: 0045F569

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: e0e4c2a5e8745864faa56e5889f7aed8dc9d36647b4b934b0d9476528ef57ffe
Instruction ID: 2e2eaad49763833bbcfc7c68f572f088d5f8d2798b4c1c5c41ffca29e6c5e6c5
Opcode Fuzzy Hash: e0e4c2a5e8745864faa56e5889f7aed8dc9d36647b4b934b0d9476528ef57ffe
Instruction Fuzzy Hash: E6517BB5A00209EFCB10CF58D880AAAB7B8FF4C354B15856AED59DB301E734E915CFA5

Uniqueness

Uniqueness Score: 100.00%

Function 004626F9, Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

APIs

_memset.LIBCMT ref: 00462747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00462792
IsMenu.USER32(00000000), ref: 004627B2
CreatePopupMenu.USER32 ref: 004627E6

Part of subcall function 00462C42: _memset.LIBCMT ref: 00462CAF
Part of subcall function 00462C42: GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00462CCB
Part of subcall function 00462C42: DeleteMenu.USER32(?,00000007,00000000), ref: 00462D11
Part of subcall function 00462C42: DeleteMenu.USER32(?,00000000,00000000), ref: 00462D5A

GetMenuItemCount.USER32(000000FF), ref: 00462844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00462875

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Menu$Item$DeleteInfo_memset$CountCreateInsertPopup
String ID:
API String ID: 1721661707-0
Opcode ID: 26be2bb6517104d0e06652614555473398c1a5c4668b3e74760e83b0a7226d5a
Instruction ID: ae907cd3f2aa1f5fb6f168798142b7ed047680f4cd9d897be70698fd7a4ddbb7
Opcode Fuzzy Hash: 26be2bb6517104d0e06652614555473398c1a5c4668b3e74760e83b0a7226d5a
Instruction Fuzzy Hash: FD51B270A00705FFDF14DF68CE88AAEBBF4AF44314F10462EE4119B291E7B88904CB56

Uniqueness

Uniqueness Score: 2.20%

Function 00401765, Relevance: 9.1, APIs: 6, Instructions: 113COMMON

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

BeginPaint.USER32(?,?), ref: 0040179A
GetWindowRect.USER32(?,?), ref: 004017FE
ScreenToClient.USER32(?,?), ref: 0040181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0040182C
EndPaint.USER32(?,?), ref: 00401876

Part of subcall function 004012F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0040134D
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040135C
Part of subcall function 004012F3: BeginPath.GDI32(?), ref: 00401373
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040139C
Part of subcall function 004012F3: DeleteObject.GDI32(00000000), ref: 0043B8B6

Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0043BACB

Part of subcall function 004013B0: EndPath.GDI32(?), ref: 004013BF
Part of subcall function 004013B0: StrokeAndFillPath.GDI32(?), ref: 004013DB
Part of subcall function 004013B0: SelectObject.GDI32(?,00000000), ref: 004013EE
Part of subcall function 004013B0: DeleteObject.GDI32 ref: 00401401
Part of subcall function 004013B0: StrokePath.GDI32(?), ref: 0040141C

Part of subcall function 00401424: MoveToEx.GDI32(?,000000FE,?,00000000), ref: 0043B8CD
Part of subcall function 00401424: AngleArc.GDI32(?,000000FE,?,?,-00000010,-00000010), ref: 0043B90E
Part of subcall function 00401424: LineTo.GDI32(?,000000FE,?), ref: 0043B919
Part of subcall function 00401424: CloseFigure.GDI32(?), ref: 0043B920
Part of subcall function 00401424: Ellipse.GDI32(?,000000FE,?,?,00000000), ref: 0043B967
Part of subcall function 00401424: Rectangle.GDI32(?,000000FE,?,?,?), ref: 0043B9C2
Part of subcall function 00401424: SetPixel.GDI32(?,000000FE,?,?), ref: 0043B9FE

Part of subcall function 0040152E: BeginPath.GDI32(00000000), ref: 0040154C
Part of subcall function 0040152E: PolyDraw.GDI32(00000000,00000002,?,?), ref: 004015C3
Part of subcall function 0040152E: PolyDraw.GDI32(00000000,00000002,00000810,?), ref: 00401602

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ObjectPath$BeginSelect$DeleteDrawPaintPolyRectangleStrokeWindow$AngleClientCloseCreateEllipseFigureFillLineLongMovePixelRectScreenViewport
String ID:
API String ID: 248873171-0
Opcode ID: 96bee910b95448c1c32d2d7cbaec34173df8798859d468da8578c2ee1054d098
Instruction ID: f496b0d24a919446a821901bb08c967343d20a2d6e91284dadc4af8012d8984c
Opcode Fuzzy Hash: 96bee910b95448c1c32d2d7cbaec34173df8798859d468da8578c2ee1054d098
Instruction Fuzzy Hash: F8418C71100200AFD710EF25C884FAA7BE8EB49724F044A3EFA94962F1C7359946DB6A

Uniqueness

Uniqueness Score: 0.16%

Function 0048B958, Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

APIs

ShowWindow.USER32(004C67B0,00000000), ref: 0048B9CC
EnableWindow.USER32(?,00000000), ref: 0048B9F0
ShowWindow.USER32(004C67B0,00000000), ref: 0048BA50
ShowWindow.USER32(?,00000004), ref: 0048BA62
EnableWindow.USER32(?,00000001), ref: 0048BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0048BAA9

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 7ca0fe6c9807323bcc0ac8ff00a913c3fb6576fd02a22b3a16232a66ac7b93cd
Instruction ID: 4bbfffa5aca34bc284a6f875752b5b7a56a0dd7a11c68d007de5de2d50af2dcc
Opcode Fuzzy Hash: 7ca0fe6c9807323bcc0ac8ff00a913c3fb6576fd02a22b3a16232a66ac7b93cd
Instruction Fuzzy Hash: 6E416470600241EFDB25DF14C489B9A7BE0FF05314F1846BAEE589F3A2C735A84ADB95

Uniqueness

Uniqueness Score: 0.15%

Function 0048C19A, Relevance: 9.0, APIs: 6, Instructions: 50COMMON

APIs

Part of subcall function 004012F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0040134D
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040135C
Part of subcall function 004012F3: BeginPath.GDI32(?), ref: 00401373
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040139C
Part of subcall function 004012F3: DeleteObject.GDI32(00000000), ref: 0043B8B6

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0048C1C4
LineTo.GDI32(00000000,00000003,?), ref: 0048C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0048C1E6
LineTo.GDI32(00000000,00000000,?), ref: 0048C1F6
EndPath.GDI32(00000000), ref: 0048C206
StrokePath.GDI32(00000000), ref: 0048C216

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
String ID:
API String ID: 372113273-0
Opcode ID: bcce67e3e298e3a6bc6f4242255c7147e032c19fae9192ab638b55bf4357f776
Instruction ID: 89b87adcafcd02c20156ebc744166949cd87f219d271a2b64e3a0db778f8eb43
Opcode Fuzzy Hash: bcce67e3e298e3a6bc6f4242255c7147e032c19fae9192ab638b55bf4357f776
Instruction Fuzzy Hash: E5111B7640010CBFDB11AF90DC88EAA7FADEB04394F048476BE185A1A1C7719E55DBA4

Uniqueness

Uniqueness Score: 0.15%

Function 004674D2, Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMON

APIs

InterlockedExchange.KERNEL32(?,?), ref: 004674E5
EnterCriticalSection.KERNEL32(?,?,00411044,?,?), ref: 004674F6
TerminateThread.KERNEL32(00000000,000001F6,?,00411044,?,?), ref: 00467503
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00467510

Part of subcall function 00466ED7: CloseHandle.KERNEL32(00000000), ref: 00466EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00467523
LeaveCriticalSection.KERNEL32(?,?,00411044,?,?), ref: 0046752A

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 007701f69a9d5ed9de85b122c5e4605bf6e21b132c868c5f449004ca5f003f85
Instruction ID: 9734b5ccd6540a82fb48e8287cb809d44fcf662c2da7f217d7ce71899fdcd72b
Opcode Fuzzy Hash: 007701f69a9d5ed9de85b122c5e4605bf6e21b132c868c5f449004ca5f003f85
Instruction Fuzzy Hash: 9EF0823A140A12EBDB111B64FC8C9EF773AFF45312B5009BAF203914B0EB7A5815CB59

Uniqueness

Uniqueness Score: 0.15%

Function 0040410D, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowUNIQUE

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0043D5EC

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

_memset.LIBCMT ref: 0040418D

Part of subcall function 0040463E: _wcsncpy.LIBCMT ref: 00404652

_wcscpy.LIBCMT ref: 004041E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 004041F1

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

Strings

Line: , xrefs: 0043D615

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$IconLoadNotifyShell_String_memset_wcscpy_wcsncpy
String ID: Line:
API String ID: 3448885215-1585850449
Opcode ID: 4dabcb287aa0014f2b865201e2cf0eafda2d30f8a4c5563cc53a3e2912b2ce29
Instruction ID: 58a74a7614972f0f445e6137c0dd90b430b5bf5ec00f8e3566b7ff54c1cdf52a
Opcode Fuzzy Hash: 4dabcb287aa0014f2b865201e2cf0eafda2d30f8a4c5563cc53a3e2912b2ce29
Instruction Fuzzy Hash: 8B31C171408304AAD761EB60DC45FDB73E8AF44304F10497FB184A21D1EB78A649C79F

Uniqueness

Uniqueness Score: 100.00%

Function 00486656, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowlibraryCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 004866D0
LoadLibraryW.KERNEL32(?), ref: 004866D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 004866EC
DestroyWindow.USER32(?), ref: 004866F4

Strings

SysAnimate32, xrefs: 004866AB

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSendWindow$CreateDestroyLibraryLoadObjectShowStock
String ID: SysAnimate32
API String ID: 2125232845-1011021900
Opcode ID: 6ff0cea8df7c8dbd966367875cc0fa59ce0a78d58aa6e2900808d1d81c72dfb1
Instruction ID: 107bb2381c9b110c9a3b8e0dc5be6575e68445ddc2201bb672f8ab0b69eab8f0
Opcode Fuzzy Hash: 6ff0cea8df7c8dbd966367875cc0fa59ce0a78d58aa6e2900808d1d81c72dfb1
Instruction Fuzzy Hash: 6E21D471100205BFEF506F64EC80EBF37ADEF55328F114A2AF910A2290E779CC419769

Uniqueness

Uniqueness Score: 0.15%

Function 004241C9, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderUNIQUELIBRARYCODE

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize), ref: 004241E3
GetProcAddress.KERNEL32(00000000), ref: 004241EA
EncodePointer.KERNEL32(00000000), ref: 004241F6
DecodePointer.KERNEL32(00000001), ref: 00424213

Strings

combase.dll, xrefs: 004241DE
RoInitialize, xrefs: 004241D2

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: dd13c08ab37e80bf1927b8ff06d098bbfda6e910d72f62f948d3123e59d291c0
Instruction ID: 4a732e24270c1dda5bee5a6c288e9bc2dfac411a4ff9226b3ae07dfd94810194
Opcode Fuzzy Hash: dd13c08ab37e80bf1927b8ff06d098bbfda6e910d72f62f948d3123e59d291c0
Instruction Fuzzy Hash: 5EE01770391300AAEF612BB1ED0DF193994ABA0B43FA08979B551E40E0DBE944999B1C

Uniqueness

Uniqueness Score: 100.00%

Function 0042564D, Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

APIs

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

_memset.LIBCMT ref: 004256AB
_memcpy_s.LIBCMT ref: 0042571D

Part of subcall function 00430F18: _memmove.LIBCMT ref: 00430F51
Part of subcall function 00430F18: _memset.LIBCMT ref: 00430F63

__read_nolock.LIBCMT ref: 0042577B

Part of subcall function 004310AB: __malloc_crt.LIBCMT ref: 00431194
Part of subcall function 004310AB: __lseeki64_nolock.LIBCMT ref: 004311C5
Part of subcall function 004310AB: GetConsoleMode.KERNEL32(00000080,?), ref: 004312A7
Part of subcall function 004310AB: ReadConsoleW.KERNEL32(0048FB24,?,004385D3,?,00000000), ref: 004312D3
Part of subcall function 004310AB: GetLastError.KERNEL32(?,?,?,?,?,0048FB24,00000001,00000000,?,?,?,?,?,?,004385D3,0048FB24), ref: 004312DD
Part of subcall function 004310AB: __dosmaperr.LIBCMT ref: 004312E4
Part of subcall function 004310AB: ReadFile.KERNEL32(0048FB24,?,004385D3,?,00000000), ref: 00431317
Part of subcall function 004310AB: ReadFile.KERNEL32(?,?,00000001,?,00000000), ref: 004313DD
Part of subcall function 004310AB: GetLastError.KERNEL32(?,0048FB24,00000001,00000000,?,?,?,?,?,?,004385D3,0048FB24,00000080,00000003), ref: 004313E7
Part of subcall function 004310AB: __lseeki64_nolock.LIBCMT ref: 00431452
Part of subcall function 004310AB: __lseeki64_nolock.LIBCMT ref: 00431561
Part of subcall function 004310AB: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,004385D3,004385D2,0048FB24,?,?,?,?,?,?,0048FB24,00000001,00000000), ref: 00431580
Part of subcall function 004310AB: _free.LIBCMT ref: 004315B3
Part of subcall function 004310AB: ReadFile.KERNEL32(00000080,00000080,00000002,?,00000000), ref: 004316E6
Part of subcall function 004310AB: GetLastError.KERNEL32(?,0048FB24,00000001,00000000), ref: 004316F0
Part of subcall function 004310AB: __lseeki64_nolock.LIBCMT ref: 0043178A
Part of subcall function 004310AB: GetLastError.KERNEL32(?,0048FB24,00000001,00000000,?,?,?,?,?,?,004385D3,0048FB24,00000080,00000003), ref: 004317E3

__filbuf.LIBCMT ref: 0042579E

Part of subcall function 00430DF7: __getbuf.LIBCMT ref: 00430E47
Part of subcall function 00430DF7: __read.LIBCMT ref: 00430E62

_memset.LIBCMT ref: 004257E2

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ErrorLastRead__lseeki64_nolock$File_memset$Console$ByteCharModeMultiWide__dosmaperr__filbuf__getbuf__getptd_noexit__malloc_crt__read__read_nolock_free_memcpy_s_memmove
String ID:
API String ID: 1189629394-0
Opcode ID: 81411999657e3e763d812df863fa8787a6ab3c9ff8487da223325fcefd1e7ca8
Instruction ID: 8f486d84be92ee44d8014861303fa160b6b430e9f344387c801a4323594451c0
Opcode Fuzzy Hash: 81411999657e3e763d812df863fa8787a6ab3c9ff8487da223325fcefd1e7ca8
Instruction Fuzzy Hash: B951D930B00B25DBDB248F79E88466F77B1AF40324FA4832FF829962D0D7789D518B49

Uniqueness

Uniqueness Score: 3.75%

Function 0043196E, Relevance: 7.6, APIs: 5, Instructions: 69UNIQUELIBRARYCODE

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,?,00000001), ref: 004319A8
SetFilePointerEx.KERNEL32(00000000,?,?,?,?), ref: 004319BC
GetLastError.KERNEL32(?,?), ref: 004319C2
__dosmaperr.LIBCMT ref: 004319C9
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 004319E2

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: FilePointer$ErrorLast__dosmaperr__getptd_noexit
String ID:
API String ID: 3275556073-0
Opcode ID: 5020ea8c7c08a2c1d974e05f6122347255403b42e583d755c53856760baf4a0f
Instruction ID: 42343e62d8a757b4a28060c1c9b42eb39466e64cca7891ad5fd8ae8a4149cba5
Opcode Fuzzy Hash: 5020ea8c7c08a2c1d974e05f6122347255403b42e583d755c53856760baf4a0f
Instruction Fuzzy Hash: 65113D72611228BFDB115BA89C40FBE3778AF45724F50025BF520A71E1DB78D800C759

Uniqueness

Uniqueness Score: 100.00%

Function 004012F3, Relevance: 7.6, APIs: 5, Instructions: 67COMMON

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0040134D
SelectObject.GDI32(?,00000000), ref: 0040135C
BeginPath.GDI32(?), ref: 00401373

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

SelectObject.GDI32(?,00000000), ref: 0040139C
DeleteObject.GDI32(00000000), ref: 0043B8B6

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Object$CreateSelect$BeginBrushDeletePathSolid
String ID:
API String ID: 1512498296-0
Opcode ID: ebd5db839387be117ed7d3fbb214bec0919e75378db44ca2cc759e7a000b0216
Instruction ID: 01809ca1199762821c7ccc43aba1927c018ed3358b57c1522327ad2857708082
Opcode Fuzzy Hash: ebd5db839387be117ed7d3fbb214bec0919e75378db44ca2cc759e7a000b0216
Instruction Fuzzy Hash: 9B213070801304EFEB11AF65DC04B6A7BB8FB00321F55863BF810A62F0D7799995DBA9

Uniqueness

Uniqueness Score: 0.15%

Function 00457631, Relevance: 7.6, APIs: 5, Instructions: 60stringCOMMON

APIs

Part of subcall function 0045810E: RaiseException.KERNEL32(8007000E,?,00000000,00000000,?,00457651,-C0000018,00000001,?,0045758C,80070057,?,?,?,0045799D), ref: 0045811B

CLSIDFromProgID.OLE32 ref: 0045766F
ProgIDFromCLSID.OLE32(?,00000000), ref: 0045768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0045758C,80070057,?,?), ref: 00457698
CoTaskMemFree.OLE32(00000000), ref: 004576A8
CLSIDFromString.OLE32(?,?), ref: 004576B4

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: From$Prog$ExceptionFreeRaiseStringTasklstrcmpi
String ID:
API String ID: 450394209-0
Opcode ID: bc25b6519a94f10dbb251a0eebce8836490a121c9ede26846711f318317bd882
Instruction ID: 7358ad2804b9dc9911c054a84f83c2ad3ef792169d9fc978e4c4218005fc1a73
Opcode Fuzzy Hash: bc25b6519a94f10dbb251a0eebce8836490a121c9ede26846711f318317bd882
Instruction Fuzzy Hash: 4B11E572604618BBDB105F69EC04B9E7BACEB04762F144439FD08D2212E779DE4487A8

Uniqueness

Uniqueness Score: 0.24%

Function 004654E6, Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00465502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00465510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00465518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00465522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0046555E

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 72de52679d9368bff63ea29de6d144572b9e7e287c6a07ba23d639df65210cf3
Instruction ID: 904bb0919bfdc2718e962a82bb6b112c9c46cd464800c0dd09bb372580e459e7
Opcode Fuzzy Hash: 72de52679d9368bff63ea29de6d144572b9e7e287c6a07ba23d639df65210cf3
Instruction Fuzzy Hash: 1A016131D00A19EBCF00DFE8E84D6EDBB78FB09711F04046AE502F2154EB345954C7AA

Uniqueness

Uniqueness Score: 0.22%

Function 004013B0, Relevance: 7.5, APIs: 5, Instructions: 29COMMON

APIs

EndPath.GDI32(?), ref: 004013BF
StrokeAndFillPath.GDI32(?), ref: 004013DB
SelectObject.GDI32(?,00000000), ref: 004013EE
DeleteObject.GDI32 ref: 00401401
StrokePath.GDI32(?), ref: 0040141C

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 61c54fb263eb1c5a127bc7e68abcd113e5aa2c7f8e8059b9e487d898b006b3c2
Instruction ID: f812cb0b4e4429ed7f7e618ed03f07a0aa621b4c15f073e4694ef7f498b4602e
Opcode Fuzzy Hash: 61c54fb263eb1c5a127bc7e68abcd113e5aa2c7f8e8059b9e487d898b006b3c2
Instruction Fuzzy Hash: 67F01930001208EFDB516F26EC4CB593BA4AB41326F15C639E829941F1C7358999DF28

Uniqueness

Uniqueness Score: 0.17%

Function 0045B7B6, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comUNIQUE

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Part of subcall function 0045BC53: GetDC.USER32(00000000), ref: 0045BC78
Part of subcall function 0045BC53: GetDeviceCaps.GDI32(00000000,00000058), ref: 0045BC89
Part of subcall function 0045BC53: GetDeviceCaps.GDI32(00000000,0000005A), ref: 0045BC90
Part of subcall function 0045BC53: ReleaseDC.USER32(00000000,00000000), ref: 0045BC98
Part of subcall function 0045BC53: MulDiv.KERNEL32(000009EC,0045B928,00000000), ref: 0045BCAF
Part of subcall function 0045BC53: MulDiv.KERNEL32(000009EC,016A52EC,?), ref: 0045BCC1

OleSetContainedObject.OLE32(0000000C,00000001), ref: 0045B981

Part of subcall function 0045BCCD: OleSetContainedObject.OLE32(?,00000000), ref: 0045BD3F
Part of subcall function 0045BCCD: IsWindow.USER32(?), ref: 0045BD9C
Part of subcall function 0045BCCD: DestroyWindow.USER32(?), ref: 0045BDA9

Part of subcall function 004796DB: GetLastError.KERNEL32(?,00000000,?,0048FB84,?,00000016,?,00000016), ref: 004798A5
Part of subcall function 004796DB: #8.OLEAUT32(?,?,?,?), ref: 00479999
Part of subcall function 004796DB: #9.OLEAUT32(?,0048FB84,00000000,?,?,?,?,?), ref: 00479A43

Strings

%I, xrefs: 0045BA24
AutoIt3GUI, xrefs: 0045B8F9
Container, xrefs: 0045B8FE

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CapsContainedDeviceObjectWindow$DestroyErrorException@8LastReleaseThrowstd::exception::exception
String ID: AutoIt3GUI$Container$%I
API String ID: 2766584483-4251005282
Opcode ID: 29290dedffe005a17191b9d84606516f9259bcdc4a782ed29488de89124237b8
Instruction ID: fb3361167640a3393b05a66091946d0b3b2d9ad6d528c81b3883d5ecba530668
Opcode Fuzzy Hash: 29290dedffe005a17191b9d84606516f9259bcdc4a782ed29488de89124237b8
Instruction Fuzzy Hash: 66914B70600601AFDB24DF24C885B6ABBE8FF48711F24856EED49CB392DB74E845CB94

Uniqueness

Uniqueness Score: 100.00%

Function 0042524D, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

APIs

__startOneArgErrorHandling.LIBCMT ref: 004252DD
__powhlp.LIBCMT ref: 00425360

Part of subcall function 00430594: __d_inttype.LIBCMT ref: 00430675

Part of subcall function 00430357: __87except.LIBCMT ref: 0043037B

__startOneArgErrorHandling.LIBCMT ref: 004304CE

Strings

pow, xrefs: 004252B5, 004252D2

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ErrorHandling__start$__87except__d_inttype__powhlp
String ID: pow
API String ID: 2541061979-2276729525
Opcode ID: c0169014571c8a50f035cbb27ee8a623963b058b02fd8f6767b6d6d046ddd236
Instruction ID: af649323224186c0ce66bda7a16df25405c3c0d3a13ea4765fd3bccd6769ca7e
Opcode Fuzzy Hash: c0169014571c8a50f035cbb27ee8a623963b058b02fd8f6767b6d6d046ddd236
Instruction Fuzzy Hash: AC517C21B1C60197C710B724E92137F27949F14350FA0ABABE885823E6EE7C8DD4DA5E

Uniqueness

Uniqueness Score: 0.38%

Function 0042023B, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

APIs

VkKeyScanW.USER32(?), ref: 00455DD0

Part of subcall function 0042313D: __wcsicmp_l.LIBCMT ref: 004231C6

VkKeyScanW.USER32(?), ref: 00455D94

Strings

+, xrefs: 00420277
#, xrefs: 00420280

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Scan$__wcsicmp_l
String ID: #$+
API String ID: 18157523-2552117581
Opcode ID: 78aac638b891657a84596e610b96ba33317af811142ca3f19ad5b172345e43d7
Instruction ID: 37aff8002e02ada0918aa30981c6d68896c3d675e4df38188cf454e749cffd85
Opcode Fuzzy Hash: 78aac638b891657a84596e610b96ba33317af811142ca3f19ad5b172345e43d7
Instruction Fuzzy Hash: EB513232200215CBCB14DF28D4986FA7BB0EF55310F548067EC80AB3A2D7389C4ACB69

Uniqueness

Uniqueness Score: 0.24%

Function 00413297, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161UNIQUE

APIs

Part of subcall function 00407E8C: _memmove.LIBCMT ref: 00407ED5

Part of subcall function 00456665: _memmove.LIBCMT ref: 004566AF

Part of subcall function 0042594C: __FF_MSGBANNER.LIBCMT ref: 00425963
Part of subcall function 0042594C: __NMSG_WRITE.LIBCMT ref: 0042596A
Part of subcall function 0042594C: RtlAllocateHeap.NTDLL(00A30000,00000000,00000001,00000000,00000000,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28), ref: 0042598F

_memmove.LIBCMT ref: 004133D7

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 00413470
_free.LIBCMT ref: 00413496

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

_memmove.LIBCMT ref: 00413549

Strings

OaA, xrefs: 00413482

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$Heap$AllocateErrorException@8FreeLastThrow_freestd::exception::exception
String ID: OaA
API String ID: 1824289774-4189730831
Opcode ID: 38c948e852b62267e39f965348a95f4e8dfcd4bdf0d603f868d564617685fc43
Instruction ID: b445b8fa1597fd77ac91e8f36571279a65bd22c4855345799867881e3280ac98
Opcode Fuzzy Hash: 38c948e852b62267e39f965348a95f4e8dfcd4bdf0d603f868d564617685fc43
Instruction Fuzzy Hash: 58518AB16083519FDB24CF29C440B6BBBE1BF85304F45496EE88987351DB39D941CB8A

Uniqueness

Uniqueness Score: 100.00%

Function 00487648, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 004876D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 004876E4

Part of subcall function 0046589F: GetLocalTime.KERNEL32(?,00000200,?), ref: 004658AC
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 004658E1
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 00465913
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 00465946
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 00465988
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 004659C2
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 004659F1

SendMessageW.USER32(?,00001002,00000000,?), ref: 00487708

Strings

SysMonthCal32, xrefs: 0048769B

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _wcsncpy$MessageSendWindow$CreateLocalObjectShowStockTime
String ID: SysMonthCal32
API String ID: 3258503128-1439706946
Opcode ID: 8df40860f00383b0d6c3c964195447c3cde1b00ce37527eab5e6f159fde48afd
Instruction ID: 1307edf48a77a6559d14c6dee31d15e92fea33bca7a193078042eb65218a36c2
Opcode Fuzzy Hash: 8df40860f00383b0d6c3c964195447c3cde1b00ce37527eab5e6f159fde48afd
Instruction Fuzzy Hash: B421AD32600218ABDF119E94CC52FEF3B69EF48764F210615FA156B1D0DAB9E8548BA4

Uniqueness

Uniqueness Score: 0.16%

Function 0048797D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 004879E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 004879F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00487A03

Strings

msctls_trackbar32, xrefs: 004879B8

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectShowStock
String ID: msctls_trackbar32
API String ID: 269107984-1010561917
Opcode ID: f9de2675f9dbbe1aac8b53f7c0ec9e088f0411dbf2a2d6fcc0aa0f3bf777801e
Instruction ID: 0de93e4c80c6f3c9c16b6b4dc0969efecf6b6414ad0caf4bffc16717d87381f0
Opcode Fuzzy Hash: f9de2675f9dbbe1aac8b53f7c0ec9e088f0411dbf2a2d6fcc0aa0f3bf777801e
Instruction Fuzzy Hash: 9F113A72244208BEEF24AF60CC15FDF37ADEF89764F21491AFA01A61D0D675D811CB64

Uniqueness

Uniqueness Score: 0.15%

Function 004576C5, Relevance: 6.3, APIs: 4, Instructions: 334stringUNIQUE

APIs

#6.OLEAUT32(?), ref: 00457818
lstrcmpiW.KERNEL32(?,?), ref: 004578F2
SysFreeString.OLEAUT32(?), ref: 004578FF
SysFreeString.OLEAUT32(?), ref: 0045791F

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: FreeString$lstrcmpi
String ID:
API String ID: 3563800057-0
Opcode ID: 243eb1bb77c329aa80634928938631c45a4dd5376c5b101ad48a1cfc64343361
Instruction ID: 84902a8fcdc76aa46939935bd970338d8b2f52d4cee566ed92c109812de06c3e
Opcode Fuzzy Hash: 243eb1bb77c329aa80634928938631c45a4dd5376c5b101ad48a1cfc64343361
Instruction Fuzzy Hash: E8C19E74A04216EFDB14CF94D884EAEB7B5FF48311B1085AAE805EB352D734ED85CB94

Uniqueness

Uniqueness Score: 100.00%

Function 0042493A, Relevance: 6.1, APIs: 4, Instructions: 136COMMON

APIs

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

_memmove.LIBCMT ref: 004249D0
__flush.LIBCMT ref: 004249F0

Part of subcall function 00424C6D: __write.LIBCMT ref: 00424C9F

__write.LIBCMT ref: 00424A23

Part of subcall function 0042DAC6: ___lock_fhandle.LIBCMT ref: 0042DB33
Part of subcall function 0042DAC6: __write_nolock.LIBCMT ref: 0042DB52

__flsbuf.LIBCMT ref: 00424A51

Part of subcall function 0042B05E: __getbuf.LIBCMT ref: 0042B0F5
Part of subcall function 0042B05E: __write.LIBCMT ref: 0042B121
Part of subcall function 0042B05E: __lseeki64.LIBCMT ref: 0042B165
Part of subcall function 0042B05E: __write.LIBCMT ref: 0042B18A

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: __write$___lock_fhandle__flsbuf__flush__getbuf__getptd_noexit__lseeki64__write_nolock_memmove
String ID:
API String ID: 653938232-0
Opcode ID: 77f2016c9fe07f3f4c6b5a71a57f6989e74bda5ebcf982639f8c246fb637a88d
Instruction ID: 44f2cbb3ea973b2da694034fd3275bff3404365078f258258cd20a66cb2e0f27
Opcode Fuzzy Hash: 77f2016c9fe07f3f4c6b5a71a57f6989e74bda5ebcf982639f8c246fb637a88d
Instruction Fuzzy Hash: FE41E5B07006259BDB288EB9E88096F77A6EFC0360B64816FE85587740D7799D818B4C

Uniqueness

Uniqueness Score: 1.64%

Function 00436415, Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043644B
__isleadbyte_l.LIBCMT ref: 00436479

Part of subcall function 004237FB: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00423807

MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 004364A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 004364DD

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Locale$ByteCharMultiUpdateUpdate::_Wide$__getptd_noexit__isleadbyte_l
String ID:
API String ID: 3164516598-0
Opcode ID: f95d2081635511957ee21cbff85720af553d1923269aba5ee5c8224bed042a40
Instruction ID: 00bfbab79281597f36fe53e4f64e7450777474697505dafcb940073344e51601
Opcode Fuzzy Hash: f95d2081635511957ee21cbff85720af553d1923269aba5ee5c8224bed042a40
Instruction Fuzzy Hash: 4A31F030A00257BFDB218F65CC44BAB7BA9FF59310F16802AE8548B290D738E850DB9C

Uniqueness

Uniqueness Score: 0.46%

Function 0048C788, Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

GetCursorPos.USER32(?), ref: 0048C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0048C7D7

Part of subcall function 004025DB: GetWindowLongW.USER32(?,000000EB), ref: 004025EC

GetCursorPos.USER32(?), ref: 0048C824
DefDlgProcW.USER32(?,0000007B,?), ref: 0048C85E

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CursorLongWindow$MenuPopupProcTrack
String ID:
API String ID: 2780618515-0
Opcode ID: a5a98a92077e2aaa59aca06ed05bce2560aa70a0f09ba78dbcc783647833ee95
Instruction ID: 757619bd3f98b372d46f3818d8faf94b3fa09ae1c323e5c89f059bb0ed552e39
Opcode Fuzzy Hash: a5a98a92077e2aaa59aca06ed05bce2560aa70a0f09ba78dbcc783647833ee95
Instruction Fuzzy Hash: 00318F35600018AFCB15EF58C898EEF7BB6EB49311F04486AF9058B2A1C7359950DB68

Uniqueness

Uniqueness Score: 0.24%

Function 00426007, Relevance: 6.1, APIs: 4, Instructions: 67threadUNIQUE

APIs

Part of subcall function 0042A007: TlsGetValue.KERNEL32(?,?,00429C19,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 0042A01E

GetLastError.KERNEL32 ref: 00426030
ExitThread.KERNEL32 ref: 00426037
__freefls@4.LIBCMT ref: 00426053

Part of subcall function 00429A81: _free.LIBCMT ref: 00429AA1
Part of subcall function 00429A81: _free.LIBCMT ref: 00429AB0
Part of subcall function 00429A81: _free.LIBCMT ref: 00429ABF
Part of subcall function 00429A81: _free.LIBCMT ref: 00429ACE
Part of subcall function 00429A81: _free.LIBCMT ref: 00429ADD
Part of subcall function 00429A81: _free.LIBCMT ref: 00429AEC
Part of subcall function 00429A81: _free.LIBCMT ref: 00429AFB
Part of subcall function 00429A81: _free.LIBCMT ref: 00429B0D
Part of subcall function 00429A81: __lock.LIBCMT ref: 00429B15
Part of subcall function 00429A81: _free.LIBCMT ref: 00429B38
Part of subcall function 00429A81: __lock.LIBCMT ref: 00429B4C
Part of subcall function 00429A81: ___removelocaleref.LIBCMT ref: 00429B61
Part of subcall function 00429A81: ___freetlocinfo.LIBCMT ref: 00429B7D
Part of subcall function 00429A81: _free.LIBCMT ref: 00429B90

Part of subcall function 00425F9B: __XcptFilter.LIBCMT ref: 00425FC8

__indefinite.LIBCMT ref: 004320B0

Part of subcall function 0042A026: TlsSetValue.KERNEL32(?,?,?,00429C40,00000000,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62), ref: 0042A040

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _free$Value__lock$ErrorExitFilterLastThreadXcpt___freetlocinfo___removelocaleref__freefls@4__indefinite
String ID:
API String ID: 3523928031-0
Opcode ID: 09eca4a38ffbd79079618dca8b3590f84901a86624746c396240826a582f099c
Instruction ID: 77b52fc407f2c0acf1bbb9cbbec5ad7614d10c7695271f01b9e1a8fbf42c950b
Opcode Fuzzy Hash: 09eca4a38ffbd79079618dca8b3590f84901a86624746c396240826a582f099c
Instruction Fuzzy Hash: 53113674604215ABCB14BFB4D80655E7BA4EF04308F50896EF9048A351EB3CEC91DB8F

Uniqueness

Uniqueness Score: 100.00%

Function 00435332, Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMONLIBRARYCODE

APIs

_free.LIBCMT ref: 00435351

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

HeapReAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,?,00428AB6,?,?,00000000,00000000,?,00422F40,00000000,00000010), ref: 0043536F
GetLastError.KERNEL32(?,00428AB6,?,?,00000000,00000000,?,00422F40,00000000,00000010,?,?,?,?,?,00422EA5), ref: 004353CA

Part of subcall function 004235E1: DecodePointer.KERNEL32(?,004259CD,?,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62), ref: 004235EA

GetLastError.KERNEL32(?,00428AB6,?,?,00000000,00000000,?,00422F40,00000000,00000010,?,?,?,?,?,00422EA5), ref: 004353B2

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

Part of subcall function 0042594C: __FF_MSGBANNER.LIBCMT ref: 00425963
Part of subcall function 0042594C: __NMSG_WRITE.LIBCMT ref: 0042596A
Part of subcall function 0042594C: RtlAllocateHeap.NTDLL(00A30000,00000000,00000001,00000000,00000000,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28), ref: 0042598F

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ErrorHeapLast$AllocAllocateDecodeFreePointer__getptd_noexit_free
String ID:
API String ID: 2334374242-0
Opcode ID: ab35778a9cc97f6e0a94f0b3f5ee58bea3ade87e3782345d4463fa0fc8671856
Instruction ID: ca36ded951c5b74dcd14922bdbfcb28a3672708b69dba933c6c60362b96cb12c
Opcode Fuzzy Hash: ab35778a9cc97f6e0a94f0b3f5ee58bea3ade87e3782345d4463fa0fc8671856
Instruction Fuzzy Hash: 7211C132605A25AECB212F71B84565E37A89F183B4F60182FFD049A290DABD8941879D

Uniqueness

Uniqueness Score: 1.55%

Function 00404531, Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

APIs

_memset.LIBCMT ref: 00404560

Part of subcall function 0040410D: _memset.LIBCMT ref: 0040418D
Part of subcall function 0040410D: _wcscpy.LIBCMT ref: 004041E1
Part of subcall function 0040410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 004041F1
Part of subcall function 0040410D: LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0043D5EC

KillTimer.USER32(?,00000001), ref: 004045B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 004045C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0043D6CE

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$KillLoadString_wcscpy
String ID:
API String ID: 1203397457-0
Opcode ID: 9017d92aafd25a15b7bd45833115f0549aca239c36473df683567b390838c4b6
Instruction ID: ee13d0e14117257c6e1bf6a2afa9c18cb2a9610526be340c73f4befcf8864d37
Opcode Fuzzy Hash: 9017d92aafd25a15b7bd45833115f0549aca239c36473df683567b390838c4b6
Instruction Fuzzy Hash: 14210AB0904784AFE7328B24DC45BE7BBEC9F45308F0000AFE79E66281C7781A858B59

Uniqueness

Uniqueness Score: 2.04%

Function 00401290, Relevance: 6.1, APIs: 4, Instructions: 59COMMON

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

DefDlgProcW.USER32(?,00000020,?), ref: 004012D8

Part of subcall function 0048A779: LoadCursorW.USER32(00000000,00007F00), ref: 0048A7F1
Part of subcall function 0048A779: SetCursor.USER32(00000000), ref: 0048A7F8

GetClientRect.USER32(?,?), ref: 0043B84B
GetCursorPos.USER32(?), ref: 0043B855
ScreenToClient.USER32(?,?), ref: 0043B860

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Cursor$Client$LoadLongProcRectScreenWindow
String ID:
API String ID: 3055988096-0
Opcode ID: 0ece2ee9bdbf1d33a90fc67de420260cd1354e737385e85e7b59386c5e1efca1
Instruction ID: 88478fa3ad29557ab13713681797212a94603c3b61ccda0d63648654153e7648
Opcode Fuzzy Hash: 0ece2ee9bdbf1d33a90fc67de420260cd1354e737385e85e7b59386c5e1efca1
Instruction Fuzzy Hash: 82112B39510019EBCB00EF94D8859AE77B8FB05300F1048AAF901F7291D734AA569BA9

Uniqueness

Uniqueness Score: 0.23%

Function 00437207, Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

APIs

__cftof_l.LIBCMT ref: 0043722B

Part of subcall function 00437912: __fltout2.LIBCMT ref: 0043793B
Part of subcall function 00437912: __fptostr.LIBCMT ref: 0043799D
Part of subcall function 00437912: __cftof2_l.LIBCMT ref: 004379BA

__cftog_l.LIBCMT ref: 00437251

Part of subcall function 004379D3: __fltout2.LIBCMT ref: 004379FC
Part of subcall function 004379D3: __fptostr.LIBCMT ref: 00437A5D
Part of subcall function 004379D3: __cftof2_l.LIBCMT ref: 00437A9E
Part of subcall function 004379D3: __cftoe2_l.LIBCMT ref: 00437AB9

__cftoa_l.LIBCMT ref: 0043726A

Part of subcall function 0043728D: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004372AD
Part of subcall function 0043728D: _mbstowcs_s.LIBCMT ref: 00437324
Part of subcall function 0043728D: _strrchr.LIBCMT ref: 0043735F
Part of subcall function 0043728D: _memset.LIBCMT ref: 004374F6
Part of subcall function 0043728D: __alldvrm.LIBCMT ref: 00437571
Part of subcall function 0043728D: __alldvrm.LIBCMT ref: 00437594
Part of subcall function 0043728D: __alldvrm.LIBCMT ref: 004375B7

__cftoe_l.LIBCMT ref: 00437283

Part of subcall function 00437758: __fltout2.LIBCMT ref: 00437785
Part of subcall function 00437758: __fptostr.LIBCMT ref: 004377ED
Part of subcall function 00437758: __cftoe2_l.LIBCMT ref: 0043780D

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: __alldvrm__fltout2__fptostr$Locale__cftoe2_l__cftof2_l$UpdateUpdate::___cftoa_l__cftoe_l__cftof_l__cftog_l_mbstowcs_s_memset_strrchr
String ID:
API String ID: 621885885-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 99b9b692cf18fd2280f287716e5b4489036060bef9d5190ceb0c0b5b499c977f
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 71016DB204418EBBCF225E84CC018EE3F22BF1D354F089656FE9858121C23AC9B1AB85

Uniqueness

Uniqueness Score: 0.60%

Function 0048B57F, Relevance: 6.0, APIs: 4, Instructions: 47COMMON

APIs

GetWindowRect.USER32(?,?), ref: 0048B59E
ScreenToClient.USER32(?,?), ref: 0048B5B6
ScreenToClient.USER32(?,?), ref: 0048B5DA
InvalidateRect.USER32(?,?,?), ref: 0048B5F5

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: e8173e98fc73e507b6a04d2f7e54522757b65c9b70d93ac78b94b59699abf8f9
Instruction ID: c1ec13a6a315efdf6b243f43d6614c5161e9ce39f19ad1524a172358c11b1c05
Opcode Fuzzy Hash: e8173e98fc73e507b6a04d2f7e54522757b65c9b70d93ac78b94b59699abf8f9
Instruction Fuzzy Hash: 261146B5D00209EFDB41DF99C444AEEFBB5FF18310F104566E914E3620D735AA558F94

Uniqueness

Uniqueness Score: 0.17%

Function 0048B8EF, Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

APIs

_memset.LIBCMT ref: 0048B8FE
_memset.LIBCMT ref: 0048B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,004C7F20,004C7F64), ref: 0048B93C
CloseHandle.KERNEL32 ref: 0048B94E

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 20938f2380c00bee8b77b7cffb68c01d981cfa171dd9b4496317a146dae37767
Instruction ID: 82d0d7306074909859a51e75144c9fe9cb012601897826516f2148835353e407
Opcode Fuzzy Hash: 20938f2380c00bee8b77b7cffb68c01d981cfa171dd9b4496317a146dae37767
Instruction Fuzzy Hash: DDF05EB26443107BE2506B61AC85FBB3A5CEB08358F00443AFB08D5296D77959008BBC

Uniqueness

Uniqueness Score: 2.28%

Function 0048C00C, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

APIs

Part of subcall function 004012F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0040134D
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040135C
Part of subcall function 004012F3: BeginPath.GDI32(?), ref: 00401373
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040139C
Part of subcall function 004012F3: DeleteObject.GDI32(00000000), ref: 0043B8B6

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0048C030
LineTo.GDI32(00000000,?,?), ref: 0048C03D
EndPath.GDI32(00000000), ref: 0048C04D
StrokePath.GDI32(00000000), ref: 0048C05B

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
String ID:
API String ID: 2783949968-0
Opcode ID: edfbcd623de5c465fbf958c9dabb36f9443974b16c1799f8a50be9d4dd4f4236
Instruction ID: 674b4468024ad211d301666b20e3bfa7de505a3549e2e29f62cfbf593809ea28
Opcode Fuzzy Hash: edfbcd623de5c465fbf958c9dabb36f9443974b16c1799f8a50be9d4dd4f4236
Instruction Fuzzy Hash: BAF0BE31001219BBDB127F90AC09FCE3F58AF06310F148429FA11210E287794564DBAD

Uniqueness

Uniqueness Score: 0.15%

Function 00402218, Relevance: 6.0, APIs: 4, Instructions: 23COMMON

APIs

GetSysColor.USER32(00000008), ref: 00402231
SetTextColor.GDI32(?,000000FF), ref: 0040223B
SetBkMode.GDI32(?,00000001), ref: 00402250
GetStockObject.GDI32(00000005), ref: 00402258
GetWindowDC.USER32(?), ref: 0043C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0043C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0043C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0043C112
GetPixel.GDI32(00000000,?,?), ref: 0043C132
ReleaseDC.USER32(?,00000000), ref: 0043C13D
SetBkColor.GDI32(?,00000000), ref: 0043C159

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pixel$Color$BrushCreateModeObjectReleaseSolidStockTextWindow
String ID:
API String ID: 88331326-0
Opcode ID: 27b2581c254cdff319ff0ea5d8f2be35128cc34943b3abbe395981e759962590
Instruction ID: 007a7e945b926db1975f0eb4024d1954444be121fda63f18d3fd7a61cce91000
Opcode Fuzzy Hash: 27b2581c254cdff319ff0ea5d8f2be35128cc34943b3abbe395981e759962590
Instruction Fuzzy Hash: 58E03932100244EADB215FA8EC4D7DD3B20AB05332F10837AFAA9580E287764994DB15

Uniqueness

Uniqueness Score: 0.25%

Function 00442187, Relevance: 6.0, APIs: 4, Instructions: 20COMMON

APIs

GetDesktopWindow.USER32 ref: 00442187
GetDC.USER32(00000000), ref: 00442191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004421B1
ReleaseDC.USER32(?), ref: 004421D2

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 6ccce6c581eecdf91341cc96db6383502fda410d9a8940bdb714612b0f6538cf
Instruction ID: e80bcdaed25015b38fc075b9af120d0661f73bd954452babf2cca2976e4e6e99
Opcode Fuzzy Hash: 6ccce6c581eecdf91341cc96db6383502fda410d9a8940bdb714612b0f6538cf
Instruction Fuzzy Hash: 8BE01A75900204EFDB019FA0C808A9D7BF1EF5C350F108A3AF95AE7260DB7885569F49

Uniqueness

Uniqueness Score: 0.08%

Function 0044219B, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

APIs

GetDesktopWindow.USER32 ref: 0044219B
GetDC.USER32(00000000), ref: 004421A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004421B1
ReleaseDC.USER32(?), ref: 004421D2

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 56bdb0173f3b1fd63dc82c5c3953b40893d4d886f94812d9d464ad18ef1fe862
Instruction ID: 0585887194f83d5896a0f01572a955ee9a0ca529f388d05c95cdd3c21f880870
Opcode Fuzzy Hash: 56bdb0173f3b1fd63dc82c5c3953b40893d4d886f94812d9d464ad18ef1fe862
Instruction Fuzzy Hash: 98E01A75900204EFCB019FB0C80869D7BF1EF5C310F108939F95AA7260DB3895569F48

Uniqueness

Uniqueness Score: 0.08%

Function 004063A0, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317UNIQUE

APIs

_memmove.LIBCMT ref: 0043E402

Part of subcall function 00407CB3: _memmove.LIBCMT ref: 00407D13

Part of subcall function 00407FAF: _memmove.LIBCMT ref: 00408003

CharUpperBuffW.USER32(00000000,00000000), ref: 004065A1

Part of subcall function 0040766F: _memmove.LIBCMT ref: 0040774A

Part of subcall function 00405FD2: CharUpperBuffW.USER32(00000040,?), ref: 00406032

Part of subcall function 00407A84: _memmove.LIBCMT ref: 00407B0D
Part of subcall function 00407A84: _memmove.LIBCMT ref: 0043F009

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Part of subcall function 0045FDBA: GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000001,?,0043E452,00000001,0000138C,00000001,00000001,00000001,?,00000000,00000001), ref: 0045FDEF
Part of subcall function 0045FDBA: LoadStringW.USER32(00000000,?,0043E452,00000001), ref: 0045FDF8
Part of subcall function 0045FDBA: GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,0043E452,00000001,0000138C,00000001,00000001,00000001,?,00000000,00000001,00000001), ref: 0045FE1A
Part of subcall function 0045FDBA: LoadStringW.USER32(00000000,?,0043E452,00000001), ref: 0045FE1D
Part of subcall function 0045FDBA: __swprintf.LIBCMT ref: 0045FE6D
Part of subcall function 0045FDBA: __swprintf.LIBCMT ref: 0045FE7E
Part of subcall function 0045FDBA: _wprintf.LIBCMT ref: 0045FF27
Part of subcall function 0045FDBA: MessageBoxW.USER32(00000000,?,?,00011010), ref: 0045FF3E

Strings

%I, xrefs: 004063AE

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$BuffCharHandleLoadModuleStringUpper__swprintf$Exception@8MessageThrow_wprintfstd::exception::exception
String ID: %I
API String ID: 1460846173-63094095
Opcode ID: 8f5c73ea1c93cb2696c2b0e3a7f91fe69737ae6729f64a5f08641e96e0e69f4a
Instruction ID: 84bc00bdb2e4020951578f3af3c94fec4ee35539559d4017637e04890254edec
Opcode Fuzzy Hash: 8f5c73ea1c93cb2696c2b0e3a7f91fe69737ae6729f64a5f08641e96e0e69f4a
Instruction Fuzzy Hash: 25B18F71900109AACF14EB99C8819EEB7B4EF44314F51403BE903B72D5DA3C9D96CB5E

Uniqueness

Uniqueness Score: 100.00%

Function 00486943, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004869D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004869DB

Strings

Combobox, xrefs: 0048699D

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectShowStock
String ID: Combobox
API String ID: 269107984-2096851135
Opcode ID: 9cfe375ed6e0b34d9a506390f0cd77aadc23eb3c644841765a6bbab8cb0b8bcc
Instruction ID: 83f828f06193a85efc0b0adebec9c430e4e02a922dab4690574673653ee6290d
Opcode Fuzzy Hash: 9cfe375ed6e0b34d9a506390f0cd77aadc23eb3c644841765a6bbab8cb0b8bcc
Instruction Fuzzy Hash: 9711B6B17002086FEF51AE14CC90EAF376FEB853A4F22452AF9589B3D0D6799C5187A4

Uniqueness

Uniqueness Score: 0.15%

Function 0048E0E7, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52UNIQUE

APIs

_memmove.LIBCMT ref: 0048E129

Strings

.dll, xrefs: 0048E0EB, 0048E10D
OaA, xrefs: 0048E14B

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove
String ID: .dll$OaA
API String ID: 4104443479-4235742178
Opcode ID: d023c89e2568cbe47c7e9be05447d0614d03dd1bdc5753fbcacbf1ef5e56afe8
Instruction ID: 4a953e2e287933c67df9e601e5b7dd51d2cf1e1eb743514fd817fef83038cb5d
Opcode Fuzzy Hash: d023c89e2568cbe47c7e9be05447d0614d03dd1bdc5753fbcacbf1ef5e56afe8
Instruction Fuzzy Hash: 19018071204B019FD7209E2DDD8891AB7F9FB44304B504D3EE146C6B51E7B5F8048B48

Uniqueness

Uniqueness Score: 100.00%

Function 0046901B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

APIs

_memmove.LIBCMT ref: 00469036
__fread_nolock.LIBCMT ref: 0046904B

Strings

EA06, xrefs: 0046907D

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 0ffa3d434e5b6a956c6ed572106e06fd0ca4870dbeab2ecb47157eb41c369f2b
Instruction ID: 69ed26fe311b0cc63e55e163675035c3f2ff08f97f20fd5c9232a639071a0922
Opcode Fuzzy Hash: 0ffa3d434e5b6a956c6ed572106e06fd0ca4870dbeab2ecb47157eb41c369f2b
Instruction Fuzzy Hash: 50014971904228AEDB28C6A8D816FFE7BFC8B11301F00419FF152D2181E4B8EA188B64

Uniqueness

Uniqueness Score: 2.71%

Function 0043B511, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22UNIQUE

APIs

Part of subcall function 0043B564: _memset.LIBCMT ref: 0043B571

Part of subcall function 00420B84: InitializeCriticalSectionAndSpinCount.KERNEL32(004C5158,00000000,004C5144,0043B540,?,?,?,0040100A), ref: 00420B89
Part of subcall function 00420B84: GetLastError.KERNEL32(?,?,?,0040100A), ref: 004562E7

IsDebuggerPresent.KERNEL32(?,?,?,0040100A), ref: 0043B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0040100A), ref: 0043B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0043B54E

Memory Dump Source

Source File: 00000000.00000002.1829962092.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1829911393.00400000.00000002.sdmp
Associated: 00000000.00000002.1830852023.00564000.00000004.sdmp
Associated: 00000000.00000002.1832043812.00565000.00000002.sdmp
Associated: 00000000.00000002.1839239526.00575000.00000002.sdmp
Associated: 00000000.00000002.1840068284.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 436010757-631824599
Opcode ID: cfdba6c3f5d1c47e0915195a6a61c30b6b4130fea4c9ebe93c9a57294c91e8a4
Instruction ID: bbad548b5aabf2add28ed68359945d9081cd17edac9c4c9c4009ad7997521b12
Opcode Fuzzy Hash: cfdba6c3f5d1c47e0915195a6a61c30b6b4130fea4c9ebe93c9a57294c91e8a4
Instruction Fuzzy Hash: 7EE06DB02003108BD720DF69E5047467BE0EB14748F00C97EE946C6251D7BCE448CBA9

Uniqueness

Uniqueness Score: 100.00%

Analysis Process: TkAngEQurH.exe PID: 1292 Parent PID: 3768TkAngEQurH.exeUNIQUE

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.2%
Total number of Nodes:	1372
Total number of Limit Nodes:	98

Executed Functions

Function 00403B4C, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153windowUNIQUE

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00403B7A
IsDebuggerPresent.KERNEL32(?,?), ref: 00403B8C
SetCurrentDirectoryW.KERNEL32(?), ref: 00403C81

Part of subcall function 004073E5: _memset.LIBCMT ref: 0043EE62
Part of subcall function 004073E5: GetOpenFileNameW.COMDLG32(?), ref: 0043EEAC

GetFullPathNameW.KERNEL32(00007FFF,?,?,004C62F8,004C62E0,?,?), ref: 00403BFD

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Part of subcall function 00410A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00403C26,004C62F8,?,?,?), ref: 00410ACE
Part of subcall function 00410A8D: _wcscat.LIBCMT ref: 004450E1

Part of subcall function 00403A58: GetSysColorBrush.USER32(0000000F), ref: 00403A62
Part of subcall function 00403A58: LoadCursorW.USER32(00000000,00007F00), ref: 00403A71
Part of subcall function 00403A58: LoadIconW.USER32(00000063), ref: 00403A88
Part of subcall function 00403A58: LoadIconW.USER32(000000A4), ref: 00403A9A
Part of subcall function 00403A58: LoadIconW.USER32(000000A2), ref: 00403AAC
Part of subcall function 00403A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00403AD2
Part of subcall function 00403A58: RegisterClassExW.USER32(?), ref: 00403B28

Part of subcall function 004039E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000), ref: 00403A15
Part of subcall function 004039E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00403A36
Part of subcall function 004039E7: ShowWindow.USER32(00000000), ref: 00403A4A
Part of subcall function 004039E7: ShowWindow.USER32(00000000), ref: 00403A53

Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410BBB
Part of subcall function 00410B30: timeGetTime.WINMM ref: 00410E76
Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410FB3
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 00410FC7
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00410FD5
Part of subcall function 00410B30: Sleep.KERNELBASE(0000000A), ref: 00410FDF
Part of subcall function 00410B30: LockWindowUpdate.USER32(00000000), ref: 0041105A
Part of subcall function 00410B30: DestroyWindow.USER32 ref: 00411066
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00411080
Part of subcall function 00410B30: timeGetTime.WINMM ref: 004110B2
Part of subcall function 00410B30: TranslateAcceleratorW.USER32(?,?,?), ref: 00445189
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,%I,?), ref: 004452AD
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,?,?), ref: 004454A2
Part of subcall function 00410B30: #9.OLEAUT32(00000000,00000000,?,00000000,?,00000001,?,?,?,00000001,?,?,?,?,?), ref: 00445844
Part of subcall function 00410B30: #9.OLEAUT32(00000000), ref: 00445A00
Part of subcall function 00410B30: #9.OLEAUT32(?,00000000,?,00000000,00000000,?,-00000001,00000000,00000001,@COM_EVENTOBJ,?,?,?,?,?), ref: 00445A96
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,0000000A), ref: 00445C51
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445C71
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445C7D
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A), ref: 00445F24
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445FBF
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,00000000), ref: 00445FD7
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445FEB
Part of subcall function 00410B30: Sleep.KERNEL32(?,CCCCCCCC,00000000), ref: 00446058
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 0044608A
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00446098
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004460AC

Part of subcall function 004044CB: _memset.LIBCMT ref: 004044F7
Part of subcall function 004044CB: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00404527

Part of subcall function 004043DB: _memset.LIBCMT ref: 00404401
Part of subcall function 004043DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 004044A6
Part of subcall function 004043DB: Shell_NotifyIconW.SHELL32(00000001,?), ref: 004044C3

Part of subcall function 00404864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,004072BA,?,?,?,?,0040108C,-004C5E84), ref: 00404882

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,004B93F0,00000010), ref: 0043D4BC
SetCurrentDirectoryW.KERNEL32(?,004C62F8,?,?,?), ref: 0043D4F4

Part of subcall function 00464C03: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00464C2C
Part of subcall function 00464C03: CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00464C43
Part of subcall function 00464C03: FreeSid.ADVAPI32(?), ref: 00464C53

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

GetForegroundWindow.USER32 ref: 0043D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 0043D581

Strings

This is a third-party compiled AutoIt script., xrefs: 0043D4B4
runas, xrefs: 0043D575
%I, xrefs: 00403C56

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Window$Icon$LoadSleep$Name$CurrentDirectoryNotifyShell_Translate_memmove_memset$CloseCodeCreateDispatchExitFileFullHandleObjectPathPeekProcessShowSingleTimeWaittime$AcceleratorAllocateBrushCheckClassColorCursorDebuggerDestroyExecuteForegroundFreeImageInitializeLockMembershipModuleOpenPresentRegisterShellTokenUpdate_wcscat
String ID: This is a third-party compiled AutoIt script.$runas$%I
API String ID: 1869514552-2806069697
Opcode ID: 92bddc9d16258cac0c6ba8490af65682ccdc987d8cab2c76bacb08fcd54519d5
Instruction ID: 0f2c37a458a75ddd4165d4490fb1e043a1c32b8e6bc4467291d23e22a2595f58
Opcode Fuzzy Hash: 92bddc9d16258cac0c6ba8490af65682ccdc987d8cab2c76bacb08fcd54519d5
Instruction Fuzzy Hash: F351B575D08248AADB11AFB5DC05EEE7B78AB45304B1081BFF811B21E1DA7C5645CB2E

Uniqueness

Uniqueness Score: 100.00%

Function 0038C787, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 106fileUNIQUE

APIs

CreateFileA.KERNELBASE(00000000,553B5C78,\\.\PhysicalDrive,00000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?), ref: 0038C7D9
DeviceIoControl.KERNELBASE(00000000,0AC8FB92,00000000,002D1400,00000040,0000000C,?,00000C00,?,00000000,?,?,?), ref: 0038C81D

Strings

PhysicalDrive, xrefs: 0038C85B
Drive, xrefs: 0038C845
\\.\PhysicalDrive, xrefs: 0038C7C2, 0038C7D1

Memory Dump Source

Source File: 00000004.00000002.1883487060.00380000.00000040.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_380000_TkAngEQurH.jbxd

Similarity

API ID: ControlCreateDeviceFile
String ID: Drive$PhysicalDrive$\\.\PhysicalDrive
API String ID: 107608037-2339725666
Opcode ID: dcafa7a0a2f5d4e0ef67c8717be0da1d6095b06ac5dfbc444127fdd3411b048a
Instruction ID: 6e97d5f3dd76719445c4b58b64016f5afdb8d55bc7e53abbdfafe1e10bd25318
Opcode Fuzzy Hash: dcafa7a0a2f5d4e0ef67c8717be0da1d6095b06ac5dfbc444127fdd3411b048a
Instruction Fuzzy Hash: 3C31A472A50309BBEB11AFA4CC45FDEBB79FB49705F504655F618FA280D371E9108BA0

Uniqueness

Uniqueness Score: 100.00%

Function 0038C6D8, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67fileUNIQUE

APIs

CreateFileA.KERNELBASE(00000000,553B5C78,\\.\,00000000,00000003,00000000,00000003,00000000,00000000,?), ref: 0038C70D
DeviceIoControl.KERNELBASE(00000000,0AC8FB92,00000000,00560000,00000000,00000000,?,00000020,?,00000000), ref: 0038C74B

Strings

\\.\, xrefs: 0038C6F6, 0038C705
:, xrefs: 0038C6F0
\\.\, xrefs: 0038C6EA

Memory Dump Source

Source File: 00000004.00000002.1883487060.00380000.00000040.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_380000_TkAngEQurH.jbxd

Similarity

API ID: ControlCreateDeviceFile
String ID: :$\\.\$\\.\
API String ID: 107608037-741549441
Opcode ID: d57965d3291f6108405969ab9198c99898ee88127be41fb3baa620809d65ae0e
Instruction ID: 1e9719f60d58091eab8599f90c6f6a6b8777df2fcb2d662cabdc3125379d0d3e
Opcode Fuzzy Hash: d57965d3291f6108405969ab9198c99898ee88127be41fb3baa620809d65ae0e
Instruction Fuzzy Hash: 22113071A44309BEE750DFB48C45FEDFBB8EB48715F508156F628B61C0E6B06A008BA4

Uniqueness

Uniqueness Score: 100.00%

Function 003988CA, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 305UNIQUE

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 00398A38

Strings

$, xrefs: 00398DC0

Memory Dump Source

Source File: 00000004.00000002.1883487060.00380000.00000040.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_380000_TkAngEQurH.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID: $
API String ID: 3662101638-3993045852
Opcode ID: d8cc61129b63baa32b9eab7a95e1ab547848dc20c2337d8b7e00507b7179dedc
Instruction ID: a150198904316d2c78137f8fd25e3ece2c28598d9d6eec270ca16433b53df820
Opcode Fuzzy Hash: d8cc61129b63baa32b9eab7a95e1ab547848dc20c2337d8b7e00507b7179dedc
Instruction Fuzzy Hash: 24B1C37090D246DADF278F10C480B79B678BBF3310F3A86A6D906598C6DF358D81E792

Uniqueness

Uniqueness Score: 100.00%

Function 0040E800, Relevance: 3.6, Strings: 2, Instructions: 1102UNIQUE

Strings

Variable must be of type 'Object'., xrefs: 0044428C
%I, xrefs: 0040E80E

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: LoadString_wprintf$ErrorLastMessage_memmove
String ID: Variable must be of type 'Object'.$%I
API String ID: 645758847-549709184
Opcode ID: ceb3e4fcce268cff78fa85b5df37f718cd604031b0f498da301670de14921990
Instruction ID: 646285330f24ea673303868bc9691634490c9c151704f09186753778590e683b
Opcode Fuzzy Hash: ceb3e4fcce268cff78fa85b5df37f718cd604031b0f498da301670de14921990
Instruction Fuzzy Hash: 88A28C74A04205CFDB24CF59C480AAAB7B1FF48304F24847AE916BB391D739EC56CB99

Uniqueness

Uniqueness Score: 100.00%

Function 00397585, Relevance: 1.7, APIs: 1, Instructions: 245COMMON

APIs

KiUserExceptionDispatcher.NTDLL(E00001A9), ref: 00397931

Memory Dump Source

Source File: 00000004.00000002.1883487060.00380000.00000040.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_380000_TkAngEQurH.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 69a6b07ee7fe447d1970dcead3094be8cd3c3585ed5c51ff8be90354ab8af60f
Instruction ID: 9013b0e4bc31c07bda94c1574e6c1d57f9ae631cc28807ff316b2e806f267c2e
Opcode Fuzzy Hash: 69a6b07ee7fe447d1970dcead3094be8cd3c3585ed5c51ff8be90354ab8af60f
Instruction Fuzzy Hash: 09817F3093D206EBDF575AA48D4EFB9777CAB05340F3544A6E90BAACD1D3308900FA62

Uniqueness

Uniqueness Score: 0.19%

Function 0042A364, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0042A36A

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: de316c34264f802ad97e41e2d96b97a4976e2443a0324b54249a0beeda03384a
Instruction ID: 5f0b767449e3d37fa0a9cb76ca1a1966b2bcebad2f74a673b8e7725f9ca30b43
Opcode Fuzzy Hash: de316c34264f802ad97e41e2d96b97a4976e2443a0324b54249a0beeda03384a
Instruction Fuzzy Hash: E2A0113000020CAB8A022B82EC08888BFACEA022A0B008030F80C808228B32A8208A88

Uniqueness

Uniqueness Score: 0.01%

Function 00410B30, Relevance: 59.1, APIs: 27, Strings: 6, Instructions: 1304windowsleepsynchronizationUNIQUE

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410BBB
Sleep.KERNEL32(?,CCCCCCCC,00000000), ref: 00446058

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

timeGetTime.WINMM ref: 00410E76

Part of subcall function 0040FE40: _memmove.LIBCMT ref: 0041047A
Part of subcall function 0040FE40: _memmove.LIBCMT ref: 004107DF
Part of subcall function 0040FE40: _memmove.LIBCMT ref: 0041080E

Part of subcall function 004031CE: IsDialogMessageW.USER32(?,?), ref: 00403208
Part of subcall function 004031CE: GetClassLongW.USER32(?,000000E0), ref: 0043D186

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410FB3
TranslateMessage.USER32(?), ref: 00410FC7
DispatchMessageW.USER32(?), ref: 00410FD5
Sleep.KERNELBASE(0000000A), ref: 00410FDF
LockWindowUpdate.USER32(00000000), ref: 0041105A
DestroyWindow.USER32 ref: 00411066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00411080
timeGetTime.WINMM ref: 004110B2

Part of subcall function 0046A0B5: LoadStringW.USER32(00000066,?,00000FFF,%I), ref: 0046A0FC
Part of subcall function 0046A0B5: LoadStringW.USER32(?,?,00000FFF,?), ref: 0046A11E
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A246
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A264
Part of subcall function 0046A0B5: MessageBoxW.USER32(?,?,00011010,?), ref: 0046A27F

TranslateAcceleratorW.USER32(?,?,?), ref: 00445189
Sleep.KERNEL32(0000000A,%I,?), ref: 004452AD
Sleep.KERNEL32(0000000A,?,?), ref: 004454A2
TranslateMessage.USER32(?), ref: 0044608A

Part of subcall function 00409997: __itow.LIBCMT ref: 004099C2
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9B1
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9DD
Part of subcall function 00409997: __i64tow.LIBCMT ref: 0043FA0F

Part of subcall function 00456665: _memmove.LIBCMT ref: 004566AF

#9.OLEAUT32(00000000,00000000,?,00000000,?,00000001,?,?,?,00000001,?,?,?,?,?), ref: 00445844
#9.OLEAUT32(00000000), ref: 00445A00
#9.OLEAUT32(?,00000000,?,00000000,00000000,?,-00000001,00000000,00000001,@COM_EVENTOBJ,?,?,?,?,?), ref: 00445A96
DispatchMessageW.USER32(?), ref: 00446098

Part of subcall function 004628F7: Sleep.KERNEL32(0000000A,%I,?,00445B57,?), ref: 00462965

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00445C51
GetExitCodeProcess.KERNEL32(?,?), ref: 00445C71
CloseHandle.KERNEL32(?), ref: 00445C7D

Part of subcall function 004861AC: GetForegroundWindow.USER32 ref: 004861D7

Part of subcall function 0040B93D: IsWindow.USER32(00000000), ref: 00441054

Part of subcall function 004654E6: QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,%I,?), ref: 00465502
Part of subcall function 004654E6: QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,%I,?), ref: 00465510
Part of subcall function 004654E6: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,%I,?), ref: 00465518
Part of subcall function 004654E6: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,%I,?), ref: 00465522
Part of subcall function 004654E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,%I,?), ref: 0046555E

Sleep.KERNEL32(0000000A), ref: 00445F24
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004460AC

Part of subcall function 00463E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00463EB6
Part of subcall function 00463E91: Process32FirstW.KERNEL32(00000000,?), ref: 00463EC4
Part of subcall function 00463E91: Process32NextW.KERNEL32(00000000,?), ref: 00463EE4
Part of subcall function 00463E91: CloseHandle.KERNEL32(00000000), ref: 00463F8E

Part of subcall function 00420719: timeGetTime.WINMM ref: 0042071D

GetExitCodeProcess.KERNEL32(?,?), ref: 00445FBF
WaitForSingleObject.KERNEL32(?,00000000), ref: 00445FD7
CloseHandle.KERNEL32(?), ref: 00445FEB

Strings

@TRAY_ID, xrefs: 00445BB9
%I, xrefs: 00410B3D
@GUI_CTRLID, xrefs: 00445364
@GUI_WINHANDLE, xrefs: 004453B9
@COM_EVENTOBJ, xrefs: 0044591A
@GUI_CTRLHANDLE, xrefs: 0044540E

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Sleep$_memmove$Window$CloseHandlePerformanceQueryTimeTranslatetime$CodeCounterDispatchExitLoadObjectPeekProcessProcess32SingleStringWait_wcscpy_wprintf$AcceleratorClassCreateDestroyDialogException@8FirstForegroundFrequencyLockLongNextSnapshotThrowToolhelp32Update__i64tow__itowstd::exception::exception
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$%I
API String ID: 3301474788-2696040622
Opcode ID: 1e3baf7e7487a3f4b25296290a3073f6f71e122eeff8e3c80853fc6499edc5cf
Instruction ID: abb91fbfb1f178075637fae0d8e48f5fa84006329822cc06d63061e15e90d741
Opcode Fuzzy Hash: 1e3baf7e7487a3f4b25296290a3073f6f71e122eeff8e3c80853fc6499edc5cf
Instruction Fuzzy Hash: ABB2A570608741DFEB24DF25C844BAAB7E5BF84308F14492FE44997392DB79E885CB4A

Uniqueness

Uniqueness Score: 100.00%

Function 00403015, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 75windowregistryUNIQUE

APIs

GetSysColorBrush.USER32(0000000F), ref: 00403074
RegisterClassExW.USER32(00000030), ref: 0040309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004030AF
InitCommonControlsEx.COMCTL32(?), ref: 004030CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004030DC
LoadIconW.USER32(000000A9), ref: 004030F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00403101

Strings

0, xrefs: 00403056
+, xrefs: 0040305D
TaskbarCreated, xrefs: 004030A4
AutoIt v3 GUI, xrefs: 00403090
F;@, xrefs: 0040307D

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$F;@$TaskbarCreated
API String ID: 2914291525-2219658845
Opcode ID: b32fe6db03ccba481f670429e5c7b523f4edffb20c87d4c464e52b45bc5e04fc
Instruction ID: 979edb967f183c55e8c669bfc31fc45122444ef7f147c2a4b30f384e98b85c10
Opcode Fuzzy Hash: b32fe6db03ccba481f670429e5c7b523f4edffb20c87d4c464e52b45bc5e04fc
Instruction Fuzzy Hash: 043149B1941304EFEB40DFA4D884ADDBBF4FB09310F14856EE941EA2A1D3B54545CFA9

Uniqueness

Uniqueness Score: 100.00%

Function 00403041, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 54windowregistryUNIQUE

APIs

GetSysColorBrush.USER32(0000000F), ref: 00403074
RegisterClassExW.USER32(00000030), ref: 0040309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004030AF
InitCommonControlsEx.COMCTL32(?), ref: 004030CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004030DC
LoadIconW.USER32(000000A9), ref: 004030F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00403101

Strings

0, xrefs: 00403056
+, xrefs: 0040305D
TaskbarCreated, xrefs: 004030A4
AutoIt v3 GUI, xrefs: 00403090
F;@, xrefs: 0040307D

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$F;@$TaskbarCreated
API String ID: 2914291525-2219658845
Opcode ID: f316edc5448d5b1c0adbc22ddb0f2bed62490a930fea9617621b6011003a6786
Instruction ID: 0e09ac2d9919322b342d86481b19008a338d121ad3b6117744e7067feae746c8
Opcode Fuzzy Hash: f316edc5448d5b1c0adbc22ddb0f2bed62490a930fea9617621b6011003a6786
Instruction Fuzzy Hash: 4021C9B1911218AFEB40EF94EC49B9DBBF4FB08710F10853AF511A62A0D7B545448FA9

Uniqueness

Uniqueness Score: 100.00%

Function 004071EB, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 202registryCOMMON

APIs

Part of subcall function 00404864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,004072BA,?,?,?,?,0040108C,-004C5E84), ref: 00404882

Part of subcall function 0042074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,004072C5,?,?,?,?,0040108C,-004C5E84), ref: 00420771

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

Part of subcall function 00403F84: _memmove.LIBCMT ref: 0040400E

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\,?,?,?,?,0040108C,-004C5E84), ref: 00407308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?,?,?,?,?,0040108C,-004C5E84), ref: 0043ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000,?,?,?,?,0040108C,-004C5E84), ref: 0043ED32

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

RegCloseKey.ADVAPI32(?,?,?,?,?,0040108C,-004C5E84), ref: 0043ED70
_wcscat.LIBCMT ref: 0043EDC9
_wcscat.LIBCMT ref: 0043EDFE

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Strings

Include, xrefs: 0043ECE8, 0043ED29
\Include\, xrefs: 004072C5
Software\AutoIt v3\AutoIt, xrefs: 004072FE
\, xrefs: 0043EDEC

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$NameQueryValue_wcscat$CloseException@8FileFullModuleOpenPathThrowstd::exception::exception
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2320919795-2727554177
Opcode ID: b2ce1c3b15ed0b52e14b87e964901d62c51fe1087ad277a6667d9399eeb24960
Instruction ID: 261d5c66dfbaa65f37115b6835693a56036b98bc8c14fb280ac0ce69df8225bb
Opcode Fuzzy Hash: b2ce1c3b15ed0b52e14b87e964901d62c51fe1087ad277a6667d9399eeb24960
Instruction Fuzzy Hash: 2D7159715093019BC354EF26E88195BBBE8FF98354F80487FF445932A1EB749948CF5A

Uniqueness

Uniqueness Score: 0.47%

Function 00403633, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151windowtimeregistryUNIQUE

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 004036D2
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0040371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0040372A
CreatePopupMenu.USER32 ref: 0040373E

Part of subcall function 004045DF: _memset.LIBCMT ref: 004045F9
Part of subcall function 004045DF: GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 0043D750
Part of subcall function 004045DF: GetMenuItemCount.USER32(004C6890), ref: 0043D7CD
Part of subcall function 004045DF: DeleteMenu.USER32(004C6890,00000005,00000000), ref: 0043D85D
Part of subcall function 004045DF: DeleteMenu.USER32(004C6890,00000004,00000000), ref: 0043D865
Part of subcall function 004045DF: DeleteMenu.USER32(004C6890,00000006,00000000), ref: 0043D86D
Part of subcall function 004045DF: DeleteMenu.USER32(004C6890,00000003,00000000), ref: 0043D875
Part of subcall function 004045DF: GetMenuItemCount.USER32(004C6890), ref: 0043D87D
Part of subcall function 004045DF: SetMenuItemInfoW.USER32(004C6890,00000004,00000000,00000030), ref: 0043D8B7
Part of subcall function 004045DF: GetCursorPos.USER32(?), ref: 0043D8C1
Part of subcall function 004045DF: SetForegroundWindow.USER32(00000000), ref: 0043D8CA
Part of subcall function 004045DF: TrackPopupMenuEx.USER32(004C6890,00000000,?,00000000,00000000,00000000), ref: 0043D8DD
Part of subcall function 004045DF: PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0043D8E9

PostQuitMessage.USER32(00000000), ref: 0040375F

Part of subcall function 00404531: _memset.LIBCMT ref: 00404560
Part of subcall function 00404531: KillTimer.USER32(?,00000001), ref: 004045B5
Part of subcall function 00404531: SetTimer.USER32(?,00000001,000002EE,00000000), ref: 004045C4
Part of subcall function 00404531: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0043D6CE

SetFocus.USER32 ref: 0043D2ED
MoveWindow.USER32(00000000,00000000,?,?,00000001), ref: 0043D311
KillTimer.USER32(?,00000001), ref: 004036FC

Part of subcall function 004044CB: _memset.LIBCMT ref: 004044F7
Part of subcall function 004044CB: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00404527

Part of subcall function 00403114: DeleteObject.GDI32(?), ref: 0040314D
Part of subcall function 00403114: DestroyWindow.USER32(?), ref: 004031A6

Part of subcall function 004043DB: _memset.LIBCMT ref: 00404401
Part of subcall function 004043DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 004044A6
Part of subcall function 004043DB: Shell_NotifyIconW.SHELL32(00000001,?), ref: 004044C3

Part of subcall function 00462A16: _memset.LIBCMT ref: 00462A31
Part of subcall function 00462A16: GetMenuItemInfoW.USER32(004C6890,000000FF,00000000,00000030), ref: 00462A92
Part of subcall function 00462A16: SetMenuItemInfoW.USER32(004C6890,00000004,00000000,00000030), ref: 00462AC8
Part of subcall function 00462A16: Sleep.KERNEL32(000001F4), ref: 00462ADA
Part of subcall function 00462A16: GetMenuItemCount.USER32(?), ref: 00462B1E
Part of subcall function 00462A16: GetMenuItemID.USER32(?,00000000), ref: 00462B3A
Part of subcall function 00462A16: GetMenuItemID.USER32(?,-00000001), ref: 00462B64
Part of subcall function 00462A16: GetMenuItemID.USER32(?,?), ref: 00462BA9
Part of subcall function 00462A16: CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00462BEF
Part of subcall function 00462A16: GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00462C03
Part of subcall function 00462A16: SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00462C24

Strings

%I, xrefs: 0043D2D1, 0043D31F
TaskbarCreated, xrefs: 00403725

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Menu$Item$Info$DeleteWindow_memset$IconNotifyShell_Timer$CountMessage$KillPopupPost$CheckCreateCursorDestroyFocusForegroundMoveObjectProcQuitRadioRegisterSleepTrack
String ID: TaskbarCreated$%I
API String ID: 2219433024-1195164674
Opcode ID: 79d529fd6cdb04e6dfd49a914938d723b06876f1bf7da1c4650920242c0a1355
Instruction ID: 10ee0b11622f1361c7ec63440bed57d6dff5d427fb300c744ab7812cb175661f
Opcode Fuzzy Hash: 79d529fd6cdb04e6dfd49a914938d723b06876f1bf7da1c4650920242c0a1355
Instruction Fuzzy Hash: 6A4117B11101057BDB646F68EC09F7A3A58E744302F10853FFA02A23E1CA7D9D45976E

Uniqueness

Uniqueness Score: 100.00%

Function 00403A58, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 72windowregistryCOMMON

APIs

GetSysColorBrush.USER32(0000000F), ref: 00403A62
LoadCursorW.USER32(00000000,00007F00), ref: 00403A71
LoadIconW.USER32(00000063), ref: 00403A88
LoadIconW.USER32(000000A4), ref: 00403A9A
LoadIconW.USER32(000000A2), ref: 00403AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00403AD2
RegisterClassExW.USER32(?), ref: 00403B28

Part of subcall function 00403041: GetSysColorBrush.USER32(0000000F), ref: 00403074
Part of subcall function 00403041: RegisterClassExW.USER32(00000030), ref: 0040309E
Part of subcall function 00403041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004030AF
Part of subcall function 00403041: InitCommonControlsEx.COMCTL32(?), ref: 004030CC
Part of subcall function 00403041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004030DC
Part of subcall function 00403041: LoadIconW.USER32(000000A9), ref: 004030F2
Part of subcall function 00403041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00403101

Part of subcall function 004048FE: LoadImageW.USER32(00400000,00000063,00000001,00000010,00000010,00000000), ref: 00404922
Part of subcall function 004048FE: EnumResourceNamesW.KERNEL32(00000000,0000000E,00464189,00000063), ref: 0043DA68

Strings

AutoIt v3, xrefs: 00403B17
0, xrefs: 00403B06
#, xrefs: 00403B0D

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Load$Icon$Image$Register$BrushClassColorList_$CommonControlsCreateCursorEnumInitMessageNamesReplaceResourceWindow
String ID: #$0$AutoIt v3
API String ID: 2567192541-4155596026
Opcode ID: 42269966c74440c862dba0538370040d40d20385bd46122014e27266a7ce1093
Instruction ID: 8e7cc5216a3b211786643bcbc5a53bf5eabc0ef71c34cfd7d652ed0fcc69659d
Opcode Fuzzy Hash: 42269966c74440c862dba0538370040d40d20385bd46122014e27266a7ce1093
Instruction Fuzzy Hash: 7F214B74E00304BFEB50AFA4EC09F9D7FB4EB08711F11857AF504A62A0D3BA56548F98

Uniqueness

Uniqueness Score: 0.20%

Function 00404FE9, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62UNIQUE

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00404FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00404EEE,?,?,00000000,00000000), ref: 00405010
LoadResource.KERNEL32(?,00000000,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F), ref: 0043DD60
SizeofResource.KERNEL32(?,00000000,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F), ref: 0043DD75
LockResource.KERNEL32(N@,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F,00000000), ref: 0043DD88

Strings

N@, xrefs: 0043DD85
SCRIPT, xrefs: 00405006

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT$N@
API String ID: 3051347437-2499734412
Opcode ID: 5ec92892c76f8d1a0b25561ef3fd13e1900f32b078569a65020aaf11a3c9a4ea
Instruction ID: 67856c902de3f53bc3f8eb18af461e19ea0094fb9f07ee8290f0089f1c16aac3
Opcode Fuzzy Hash: 5ec92892c76f8d1a0b25561ef3fd13e1900f32b078569a65020aaf11a3c9a4ea
Instruction Fuzzy Hash: 33115A75200700AFD7218B65EC58F6B7BB9EBC9B11F20457DF406D62A0DB72E8048A69

Uniqueness

Uniqueness Score: 100.00%

Function 00422EC8, Relevance: 10.6, APIs: 7, Instructions: 75UNIQUE

APIs

RtlDecodePointer.NTDLL ref: 00422EDB
RtlDecodePointer.NTDLL ref: 00422EE6

Part of subcall function 004289E4: HeapSize.KERNEL32(00000000,00000000,?,00422F07,00000000,?,?,?,?,?,00422EA5,?,004BBB50,0000000C,00422F8B,?), ref: 00428A0D

__realloc_crt.LIBCMT ref: 00422F27
__realloc_crt.LIBCMT ref: 00422F3B
EncodePointer.KERNEL32(00000000,?,?,?,?,?,00422EA5,?,004BBB50,0000000C,00422F8B,?,?,00401014,0043B7A9), ref: 00422F4D
RtlEncodePointer.NTDLL(?,?,?,?,?,?,00422EA5,?,004BBB50,0000000C,00422F8B,?,?,00401014,0043B7A9), ref: 00422F5B
RtlEncodePointer.NTDLL(00000000,?,?,?,?,?,00422EA5,?,004BBB50,0000000C,00422F8B,?,?,00401014,0043B7A9), ref: 00422F67

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$HeapSize
String ID:
API String ID: 177749828-0
Opcode ID: 84a00aaf028b4249c7e1c5d66ab9dc667d834f1d9d23803f899ef7f94023533b
Instruction ID: ea3efdf8e2bad2a4f7d05d94394ea50cef9674f9c70b6f81548ced0ca2bbb24c
Opcode Fuzzy Hash: 84a00aaf028b4249c7e1c5d66ab9dc667d834f1d9d23803f899ef7f94023533b
Instruction Fuzzy Hash: BF118172714225BF9B149B34EF848AABBF9EB05390791457BF805D3210EB75EC009B98

Uniqueness

Uniqueness Score: 100.00%

Function 004073E5, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 65UNIQUE

APIs

_memset.LIBCMT ref: 0043EE62
GetOpenFileNameW.COMDLG32(?), ref: 0043EEAC

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Part of subcall function 004048AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004048A1,?,?,?,004072BA,?,?,?,?,0040108C), ref: 004048CE

Part of subcall function 004209D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 004209F4

Part of subcall function 004069CA: _free.LIBCMT ref: 0043E68C
Part of subcall function 004069CA: _free.LIBCMT ref: 0043E6D3

Strings

AutoIt script files (*.au3, *.a3x), xrefs: 0043EE90
au3, xrefs: 0043EEA5
X, xrefs: 0043EE7A
Run Script:, xrefs: 0043EE81

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Name$Path_free$FileFullLongOpen_memmove_memset
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$X$au3
API String ID: 1116811270-1954568251
Opcode ID: b4d37d12c6d2a76a87de7929d6b0db4a55e5567a859db527ed9755684b5293fe
Instruction ID: 5559bcc2e5b0ce129e075af18a443fb14fc0140c0908acbd47f5bc3bdc75694c
Opcode Fuzzy Hash: b4d37d12c6d2a76a87de7929d6b0db4a55e5567a859db527ed9755684b5293fe
Instruction Fuzzy Hash: CF21F671A142589BCB01DF95C845BEE7BF89F49314F00802BE508F7281DBBC598A8FA9

Uniqueness

Uniqueness Score: 100.00%

Function 004039E7, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46COMMON

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000), ref: 00403A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00403A36
ShowWindow.USER32(00000000), ref: 00403A4A
ShowWindow.USER32(00000000), ref: 00403A53

Strings

AutoIt v3, xrefs: 00403A0D, 00403A12, 00403A13
edit, xrefs: 00403A30

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 0bc3cb8581d30033406bf709693028d192d2a29ffe70b3422ed3ac2c8c0a6a91
Instruction ID: cb3e65218c39cbcb5fba8b0d7b0502fae8825f6b165f745e847789765139e861
Opcode Fuzzy Hash: 0bc3cb8581d30033406bf709693028d192d2a29ffe70b3422ed3ac2c8c0a6a91
Instruction Fuzzy Hash: 54F05E706412907EEA7027236C09F372E7DD7C3F50F21817EB900A2171C6A90800CAB8

Uniqueness

Uniqueness Score: 0.13%

Function 00404AFE, Relevance: 9.2, APIs: 6, Instructions: 223COMMON

APIs

GetVersionExW.KERNEL32(?,?,00000000), ref: 00404B2B

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Part of subcall function 00407E8C: _memmove.LIBCMT ref: 00407ED5

GetCurrentProcess.KERNEL32(?,0048FAEC,00000000,00000000,?,?,00000000), ref: 00404BF8
IsWow64Process.KERNELBASE(00000000,?,00000000), ref: 00404BFF
GetSystemInfo.KERNELBASE(00000000,?,00000000), ref: 00404C8D

Part of subcall function 00404C95: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00404CA3
Part of subcall function 00404C95: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo,?,00000000), ref: 00404CB5

FreeLibrary.KERNEL32(00000000,?,00000000), ref: 00404C50
GetSystemInfo.KERNEL32(00000000,?,00000000), ref: 00404C81

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: InfoLibraryProcessSystem_memmove$AddressCurrentFreeLoadProcVersionWow64
String ID:
API String ID: 4273104156-0
Opcode ID: 3ed813c13ab6b729a72130ac9ebb5d7e38d938aafd0c7b4dc5ce7f0b8531fff9
Instruction ID: a2a37668ba8dc9db7c0339275d8cd71390b5c234514a477f546c7b3e3bed8d02
Opcode Fuzzy Hash: 3ed813c13ab6b729a72130ac9ebb5d7e38d938aafd0c7b4dc5ce7f0b8531fff9
Instruction Fuzzy Hash: D591C17194A7C0DAC731CB6894511ABBFE4AF6A300F44496FD1CAA3B41D238F908D72E

Uniqueness

Uniqueness Score: 0.39%

Function 004069CA, Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

APIs

Part of subcall function 00404F3D: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404F6F

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_free.LIBCMT ref: 0043E6D3

Part of subcall function 0045FC4D: _memmove.LIBCMT ref: 0045FC88

Part of subcall function 0045FB6E: __wcsnicmp.LIBCMT ref: 0045FB81
Part of subcall function 0045FB6E: __wcsnicmp.LIBCMT ref: 0045FBA2
Part of subcall function 0045FB6E: __wcsnicmp.LIBCMT ref: 0045FBBC

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

Part of subcall function 00406999: _wcscmp.LIBCMT ref: 004069AC

Part of subcall function 0040766F: _memmove.LIBCMT ref: 0040774A

_free.LIBCMT ref: 0043E68C

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

Part of subcall function 00404FAA: FreeLibrary.KERNEL32(?,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404FDE

Part of subcall function 0045FCB1: GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0043E6C9,00000010,?,Bad directive syntax error,0048F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0045FCD2
Part of subcall function 0045FCB1: LoadStringW.USER32(00000000,?,0043E6C9,00000010), ref: 0045FCD9
Part of subcall function 0045FCB1: _wprintf.LIBCMT ref: 0045FD0C
Part of subcall function 0045FCB1: MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0045FD9D

Part of subcall function 00464534: GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0046454E
Part of subcall function 00464534: LoadStringW.USER32(00000000), ref: 00464555
Part of subcall function 00464534: GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0046456B
Part of subcall function 00464534: LoadStringW.USER32(00000000), ref: 00464572
Part of subcall function 00464534: _wprintf.LIBCMT ref: 00464598
Part of subcall function 00464534: MessageBoxW.USER32(00000000,?,?,00011010), ref: 004645B6

Part of subcall function 00406BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00406D0D
Part of subcall function 00406BEC: SetCurrentDirectoryW.KERNEL32(?), ref: 00406E5A
Part of subcall function 00406BEC: _free.LIBCMT ref: 0043EB9C
Part of subcall function 00406BEC: _free.LIBCMT ref: 0043EBE2

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0043E462
Bad directive syntax error, xrefs: 0043E6BB

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Load_free$HandleModuleString__wcsnicmp_memmove$CurrentDirectoryFreeLibraryMessage_wprintf$ErrorException@8HeapLastThrow_wcscmpstd::exception::exception
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 3239964445-1757145024
Opcode ID: 95ae7851350ff6c6f6e42d18b6a68ba5525c75ab88974c659dd6f3e40d4efdb4
Instruction ID: 2258a68d981662f44974eb8b497df540c6efdf5e7203b7320ea2560545df3755
Opcode Fuzzy Hash: 95ae7851350ff6c6f6e42d18b6a68ba5525c75ab88974c659dd6f3e40d4efdb4
Instruction Fuzzy Hash: 92915E71910219AFCF04EFA6C8819EEB7B4BF18318F54446FE815AB2D1DB38A905CB59

Uniqueness

Uniqueness Score: 2.28%

Function 0040F8CF, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 168comUNIQUE

APIs

Part of subcall function 004203A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 004203D3
Part of subcall function 004203A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 004203DB
Part of subcall function 004203A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 004203E6
Part of subcall function 004203A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 004203F1
Part of subcall function 004203A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 004203F9
Part of subcall function 004203A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00420401

Part of subcall function 00416259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0040FA90), ref: 004162B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0040FB2D
OleInitialize.OLE32(00000000), ref: 0040FBAA

Part of subcall function 004674A9: CreateThread.KERNEL32(00000000,00000000,0046748F,00000000,00000000,?), ref: 004674C4

CloseHandle.KERNEL32(00000000), ref: 004449F2

Strings

%I, xrefs: 0040F8F6, 0040F908, 0040FACE, 0040FBB1

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Virtual$Handle$CloseCreateInitializeMessageRegisterThreadWindow
String ID: %I
API String ID: 2562920190-63094095
Opcode ID: 02239ccd336f757ca34483d5bbfe3c2a34f3ebbc87da09f49494e0eb5c8a791c
Instruction ID: 1cfffd179986f18d43a6ac5aa0dacd7918427e6922d3cb84a31c4b765cbc4a66
Opcode Fuzzy Hash: 02239ccd336f757ca34483d5bbfe3c2a34f3ebbc87da09f49494e0eb5c8a791c
Instruction Fuzzy Hash: 5B8198B49012909EC7C8EF2AE954E557BE5EB88308312C93FD819C7272EB399409CF5D

Uniqueness

Uniqueness Score: 100.00%

Function 004035B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,004035A1,SwapMouseButtons,00000004,?), ref: 004035D4
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,004035A1,SwapMouseButtons,00000004,?,?,?,?,00402754), ref: 004035F5
RegCloseKey.ADVAPI32(00000000,?,?,004035A1,SwapMouseButtons,00000004,?,?,?,?,00402754), ref: 00403617

Strings

Control Panel\Mouse, xrefs: 004035D2

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: fddb709fe4a1b7e3bb6eda9662e0779279b58f522ad42de317fca39f37a0c6b5
Instruction ID: b1ff216ba3ee978410a1c1c06e663b0c2c98cd46aaa17f39490786bf8a1b1252
Opcode Fuzzy Hash: fddb709fe4a1b7e3bb6eda9662e0779279b58f522ad42de317fca39f37a0c6b5
Instruction Fuzzy Hash: 84114871510208BFDB20CF64DC409AFBBBCEF45741F10486AE805E7250D6729E449768

Uniqueness

Uniqueness Score: 0.19%

Function 00404DD0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141UNIQUE

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 00404E1A

Part of subcall function 0040506B: __fread_nolock.LIBCMT ref: 00405089

Part of subcall function 00405045: _fseek.LIBCMT ref: 0040505D

Part of subcall function 00404FE9: CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00404FF9
Part of subcall function 00404FE9: FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00404EEE,?,?,00000000,00000000), ref: 00405010
Part of subcall function 00404FE9: LoadResource.KERNEL32(?,00000000,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F), ref: 0043DD60
Part of subcall function 00404FE9: SizeofResource.KERNEL32(?,00000000,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F), ref: 0043DD75
Part of subcall function 00404FE9: LockResource.KERNEL32(N@,?,?,00404EEE,?,?,00000000,00000000,?,?,?,?,?,?,00404F8F,00000000), ref: 0043DD88

Strings

AU3!P/I, xrefs: 00404E14
EA06, xrefs: 0043DCF5

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Resource$CreateException@8FindGlobalLoadLockSizeofStreamThrow__fread_nolock_fseek_memmovestd::exception::exception
String ID: AU3!P/I$EA06
API String ID: 2347112480-1914660620
Opcode ID: 616ad67979b1f1bd45485429c489281964772726d7ecda918b3089ea528929d2
Instruction ID: e4f2d0695f8a23f075e311890a29d80e38cea7919c4102c3fad58ec67193dbe6
Opcode Fuzzy Hash: 616ad67979b1f1bd45485429c489281964772726d7ecda918b3089ea528929d2
Instruction Fuzzy Hash: 11417BB1A041546BCF214B64C8517BF7FA6EB85304F28407BEE42BA2C2C57C8D41C7EA

Uniqueness

Uniqueness Score: 100.00%

Function 00420FF6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44UNIQUE

APIs

Part of subcall function 0042594C: __FF_MSGBANNER.LIBCMT ref: 00425963
Part of subcall function 0042594C: __NMSG_WRITE.LIBCMT ref: 0042596A
Part of subcall function 0042594C: RtlAllocateHeap.NTDLL(00B90000,00000000,00000001,00000000,00000000,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28), ref: 0042598F

Part of subcall function 004235E1: DecodePointer.KERNEL32(?,004259CD,?,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62), ref: 004235EA

std::exception::exception.LIBCMT ref: 0042102C
__CxxThrowException@8.LIBCMT ref: 00421041

Part of subcall function 004287DB: RaiseException.KERNEL32(?,?,?,004BBAF8,?,?,?,?,?,00421046,?,004BBAF8,?,00000001), ref: 00428830

Strings

bad allocation, xrefs: 00421021

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: AllocateDecodeExceptionException@8HeapPointerRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 2525242304-2104205924
Opcode ID: 12e3ba17a8172669695ef04a998e8a6190de6a729f9817d9ed93927822ba5661
Instruction ID: 7ef10c6c1173b09cd5bea89a6eb30a235393a82e45e25364796afe6b045364de
Opcode Fuzzy Hash: 12e3ba17a8172669695ef04a998e8a6190de6a729f9817d9ed93927822ba5661
Instruction Fuzzy Hash: BAF0F93470127DB6CB20AA55FD059DF7BA89F00354F90402FF804A2691EFF88A8082EC

Uniqueness

Uniqueness Score: 100.00%

Function 003898C5, Relevance: 4.8, APIs: 3, Instructions: 256memoryCOMMON

APIs

VirtualProtect.KERNELBASE(?,?,00000004,00000004,?,00000000,53EC8B55,?,?,?,?), ref: 00389966
VirtualProtect.KERNELBASE(?,00D1510B,00000004,?,?), ref: 0038998C
VirtualProtect.KERNELBASE(?,?,?,00000040,?,00000000,53EC8B55,?,?,?,?), ref: 003899E7

Memory Dump Source

Source File: 00000004.00000002.1883487060.00380000.00000040.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_380000_TkAngEQurH.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 79ca0a962b01af71572204504f8767120e5532883995fa19102ae5d9e3e05eb1
Instruction ID: 6804c14baf8538b1f89881f23c7c1877b7e82823d3a45002173641ba3966a011
Opcode Fuzzy Hash: 79ca0a962b01af71572204504f8767120e5532883995fa19102ae5d9e3e05eb1
Instruction Fuzzy Hash: 3CB1F831645202EFEB2AEF90C495BB9F7B5BB84300B2E47D6D8099B641D731B980CBD1

Uniqueness

Uniqueness Score: 0.03%

Function 0042594C, Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMON

APIs

__FF_MSGBANNER.LIBCMT ref: 00425963

Part of subcall function 0042A3AB: __NMSG_WRITE.LIBCMT ref: 0042A3D2
Part of subcall function 0042A3AB: __NMSG_WRITE.LIBCMT ref: 0042A3DC

__NMSG_WRITE.LIBCMT ref: 0042596A

Part of subcall function 0042A408: GetModuleFileNameW.KERNEL32(00000000,004C43BA,00000104,00000000,00000000,?), ref: 0042A49A
Part of subcall function 0042A408: GetStdHandle.KERNEL32(000000F4,00000000,00000000,?), ref: 0042A554
Part of subcall function 0042A408: _strlen.LIBCMT ref: 0042A594
Part of subcall function 0042A408: WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0042A5A3
Part of subcall function 0042A408: __invoke_watson.LIBCMT ref: 0042A5BF

Part of subcall function 004232DF: ___crtCorExitProcess.LIBCMT ref: 004232E5
Part of subcall function 004232DF: ExitProcess.KERNEL32 ref: 004232EE

RtlAllocateHeap.NTDLL(00B90000,00000000,00000001,00000000,00000000,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28), ref: 0042598F

Part of subcall function 004235E1: DecodePointer.KERNEL32(?,004259CD,?,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62), ref: 004235EA

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: ExitFileProcess$AllocateDecodeHandleHeapModuleNamePointerWrite___crt__getptd_noexit__invoke_watson_strlen
String ID:
API String ID: 15092741-0
Opcode ID: c00ab26dc2cd3f1d57d41560e0b46e4202be8d45b80d44de397e9cae70c6823a
Instruction ID: 51681375befe7b4efc193715c803360cbf5942a41623950cdb13c0d60d2addc5
Opcode Fuzzy Hash: c00ab26dc2cd3f1d57d41560e0b46e4202be8d45b80d44de397e9cae70c6823a
Instruction Fuzzy Hash: 0D01D2B1341B35EEE6157B26F852B6E72588F81775FD0003FF8049A2C1DA7C9D828A6D

Uniqueness

Uniqueness Score: 2.20%

Function 004235AC, Relevance: 4.5, APIs: 3, Instructions: 19COMMON

APIs

__lock.LIBCMT ref: 004235B2

Part of subcall function 00429E4B: __mtinitlocknum.LIBCMT ref: 00429E5D
Part of subcall function 00429E4B: EnterCriticalSection.KERNEL32(?,?,0042345E,00000008,00422E99,004BBB50,0000000C,00422F8B,?,?,00401014,0043B7A9), ref: 00429E76

RtlDecodePointer.NTDLL(00000001,?,004049A7,004581BC), ref: 004235BE
RtlEncodePointer.NTDLL(?,?,004049A7,004581BC), ref: 004235C9

Part of subcall function 00429FB5: LeaveCriticalSection.KERNEL32(?,00429D1B,0000000D,00429CD6), ref: 00429FC2

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: CriticalPointerSection$DecodeEncodeEnterLeave__lock__mtinitlocknum
String ID:
API String ID: 2625109469-0
Opcode ID: f0f687c99d72e35ff3597eea0d1eb39ddd87317301f877e45278460e588003d2
Instruction ID: 43b77fceb529d27b8fed4b1eaa527640059df970b8b7b5fac95191ab6a691f5a
Opcode Fuzzy Hash: f0f687c99d72e35ff3597eea0d1eb39ddd87317301f877e45278460e588003d2
Instruction Fuzzy Hash: 69D05B726003146BCA017BF6FD0EA497F54D7447A1F04043EFF08C61A0DE754850878C

Uniqueness

Uniqueness Score: 4.01%

Function 00407BB1, Relevance: 3.1, APIs: 2, Instructions: 97COMMON

APIs

Part of subcall function 00407CB3: _memmove.LIBCMT ref: 00407D13

_memmove.LIBCMT ref: 00407C0B

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 00407C76

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 777cbc845bfd00394b90e8724b6553a128f1c9f6bd5f96b2cd1a45470a349808
Instruction ID: dca2659d15994c90c6c09ac9109f1b02cf59a28755a4f5d1953427ae19ac93cb
Opcode Fuzzy Hash: 777cbc845bfd00394b90e8724b6553a128f1c9f6bd5f96b2cd1a45470a349808
Instruction Fuzzy Hash: 2F31D3B1A08506AFD714CF28D881E6AB3A8FF48314715823EE915CB391EB74F851CB95

Uniqueness

Uniqueness Score: 0.36%

Function 0040492E, Relevance: 3.1, APIs: 2, Instructions: 59COMMON

APIs

IsThemeActive.UXTHEME ref: 00404992

Part of subcall function 004235AC: __lock.LIBCMT ref: 004235B2
Part of subcall function 004235AC: RtlDecodePointer.NTDLL(00000001,?,004049A7,004581BC), ref: 004235BE
Part of subcall function 004235AC: RtlEncodePointer.NTDLL(?,?,004049A7,004581BC), ref: 004235C9

Part of subcall function 00404A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00404A73
Part of subcall function 00404A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00404A88

Part of subcall function 00403B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00403B7A
Part of subcall function 00403B4C: IsDebuggerPresent.KERNEL32(?,?), ref: 00403B8C
Part of subcall function 00403B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,004C62F8,004C62E0,?,?), ref: 00403BFD
Part of subcall function 00403B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00403C81
Part of subcall function 00403B4C: MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,004B93F0,00000010), ref: 0043D4BC
Part of subcall function 00403B4C: SetCurrentDirectoryW.KERNEL32(?,004C62F8,?,?,?), ref: 0043D4F4
Part of subcall function 00403B4C: GetForegroundWindow.USER32 ref: 0043D57A
Part of subcall function 00403B4C: ShellExecuteW.SHELL32(00000000,?,?), ref: 0043D581

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 004049D2

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: CurrentDirectoryInfoParametersSystem$Pointer$ActiveDebuggerDecodeEncodeExecuteForegroundFullMessageNamePathPresentShellThemeWindow__lock
String ID:
API String ID: 266129024-0
Opcode ID: 5410f46a1a81539200a2eeef6a8c5e81a175194c6352785b6e035db14a7f21cc
Instruction ID: 4f3c985aaa7260ea6862a91c50e24ca429db6960d63ed6b712eae347e098ba5b
Opcode Fuzzy Hash: 5410f46a1a81539200a2eeef6a8c5e81a175194c6352785b6e035db14a7f21cc
Instruction Fuzzy Hash: FA116D716043119BC300EF29E80591AFBF8EB94714F00853FF545932A2DB749945CB9E

Uniqueness

Uniqueness Score: 0.25%

Function 00412E02, Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

APIs

timeGetTime.WINMM ref: 00412E1A

Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410BBB
Part of subcall function 00410B30: timeGetTime.WINMM ref: 00410E76
Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410FB3
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 00410FC7
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00410FD5
Part of subcall function 00410B30: Sleep.KERNELBASE(0000000A), ref: 00410FDF
Part of subcall function 00410B30: LockWindowUpdate.USER32(00000000), ref: 0041105A
Part of subcall function 00410B30: DestroyWindow.USER32 ref: 00411066
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00411080
Part of subcall function 00410B30: timeGetTime.WINMM ref: 004110B2
Part of subcall function 00410B30: TranslateAcceleratorW.USER32(?,?,?), ref: 00445189
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,%I,?), ref: 004452AD
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,?,?), ref: 004454A2
Part of subcall function 00410B30: #9.OLEAUT32(00000000,00000000,?,00000000,?,00000001,?,?,?,00000001,?,?,?,?,?), ref: 00445844
Part of subcall function 00410B30: #9.OLEAUT32(00000000), ref: 00445A00
Part of subcall function 00410B30: #9.OLEAUT32(?,00000000,?,00000000,00000000,?,-00000001,00000000,00000001,@COM_EVENTOBJ,?,?,?,?,?), ref: 00445A96
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,0000000A), ref: 00445C51
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445C71
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445C7D
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A), ref: 00445F24
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445FBF
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,00000000), ref: 00445FD7
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445FEB
Part of subcall function 00410B30: Sleep.KERNEL32(?,CCCCCCCC,00000000), ref: 00446058
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 0044608A
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00446098
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004460AC

Sleep.KERNEL32(00000000), ref: 00412E53

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Sleep$TimeTranslatetime$CloseCodeDispatchExitHandleObjectPeekProcessSingleWaitWindow$AcceleratorDestroyLockUpdate
String ID:
API String ID: 2075848024-0
Opcode ID: 4f661270d66c229034034d54e3c30d960e7b35e1359dad9d1b9127d91c7bc182
Instruction ID: d1c300ea91655eb9307443d86ffdf73ab59f85eace83877eb630077676957e6f
Opcode Fuzzy Hash: 4f661270d66c229034034d54e3c30d960e7b35e1359dad9d1b9127d91c7bc182
Instruction Fuzzy Hash: 54F05E312446019BD350AF69D559BA6B7E4AF45350F00003EE86DD7352CB70AC44C795

Uniqueness

Uniqueness Score: 0.31%

Function 00422E55, Relevance: 3.0, APIs: 2, Instructions: 21COMMON

APIs

__calloc_crt.LIBCMT ref: 00422E5A

Part of subcall function 00428A15: __calloc_impl.LIBCMT ref: 00428A24

RtlEncodePointer.NTDLL(00000000), ref: 00422E64

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: EncodePointer__calloc_crt__calloc_impl
String ID:
API String ID: 1313826993-0
Opcode ID: c8676dd660c7eefd106528180395904a2849ec008534d2bae86df56401002fe1
Instruction ID: da289241f13c79bf68db0239506904f1207daf2422722450c71c90c663fb0b43
Opcode Fuzzy Hash: c8676dd660c7eefd106528180395904a2849ec008534d2bae86df56401002fe1
Instruction Fuzzy Hash: FDD05B33A497305EE3B16B257C05B9A37D0D744730F12446FF900D61C0DF644841478C

Uniqueness

Uniqueness Score: 1.23%

Function 0038C975, Relevance: 2.6, APIs: 2, Instructions: 64memoryCOMMON

APIs

VirtualAlloc.KERNELBASE(00000000,09CE0D4A,00000000,00000000,00003000,00000004), ref: 0038C9D2
VirtualFree.KERNELBASE(00000000,CD53F5DD,?,00000000,00008000), ref: 0038CA26

Memory Dump Source

Source File: 00000004.00000002.1883487060.00380000.00000040.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_380000_TkAngEQurH.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 14568cc286a4688675cd45f9b73adf225e7e265cd117d232f7d45d2520d78309
Instruction ID: d8c311b08a9e992617a5dc4ab8b3b6204c11ed6d73d53bbd9efa0abdac57d2fa
Opcode Fuzzy Hash: 14568cc286a4688675cd45f9b73adf225e7e265cd117d232f7d45d2520d78309
Instruction Fuzzy Hash: 16211F70A54309BFFB119F708C8AFA9BB78FF04B40F5491A5BA18BE1D1D77599108B24

Uniqueness

Uniqueness Score: 0.17%

Function 00397C16, Relevance: 1.6, APIs: 1, Instructions: 141COMMON

APIs

KiUserExceptionDispatcher.NTDLL(E0000216,00000000,003977D1,?,?,?,003A47F0,?), ref: 00397C22

Memory Dump Source

Source File: 00000004.00000002.1883487060.00380000.00000040.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_380000_TkAngEQurH.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4caa01125b3d56e58b4fa56734df7197a4113a0d9abc20f14e24a50d037a8e4c
Instruction ID: 9c9e2e50d5b835af339f433660e9b859514305efc3f8e6807e7bb9358ba3de5a
Opcode Fuzzy Hash: 4caa01125b3d56e58b4fa56734df7197a4113a0d9abc20f14e24a50d037a8e4c
Instruction Fuzzy Hash: E441C13192D6D68BDF2B9E78C8943E5BBA1FF57360B6905D5C4804F193D713944ACB80

Uniqueness

Uniqueness Score: 0.19%

Function 0040766F, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 0040774A

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Exception@8Throw_memmovestd::exception::exception
String ID:
API String ID: 1602317333-0
Opcode ID: c7ff76707e68dd1649446b8809288c315ccfb6490b93a1f86683a2138af42fb8
Instruction ID: 148bf7845b9bfd5bb1bd6289e710206c27fb0d1581dedbb952c856e9d84f120b
Opcode Fuzzy Hash: c7ff76707e68dd1649446b8809288c315ccfb6490b93a1f86683a2138af42fb8
Instruction Fuzzy Hash: 5131D475A08A12DFC7249F19D190922F7A0FF08360714C53FE84A9B7A1E774F881CB8A

Uniqueness

Uniqueness Score: 0.36%

Function 00407CB3, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

APIs

_memmove.LIBCMT ref: 00407D13

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 691215b5fde71f84ba4157909e6c6bd8e9f2b14ba3ae5d5d846b05b691d97e04
Instruction ID: 4f35de3bd7cb32edc3c82026cddc1214cbdb1bf771d77ce34197b3f11daa4a73
Opcode Fuzzy Hash: 691215b5fde71f84ba4157909e6c6bd8e9f2b14ba3ae5d5d846b05b691d97e04
Instruction Fuzzy Hash: 3E21FE71A08609EBEB144F25FC4277A7BB4FF18350F21857FE486D5191EB3894A4874E

Uniqueness

Uniqueness Score: 0.36%

Function 00404F3D, Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

APIs

Part of subcall function 00404D13: FreeLibrary.KERNEL32(00000000,?), ref: 00404D4D

Part of subcall function 0042548B: __wfsopen.LIBCMT ref: 00425496

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404F6F

Part of subcall function 00404DD0: _memmove.LIBCMT ref: 00404E1A

Part of subcall function 00404FAA: FreeLibrary.KERNEL32(?,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404FDE

Part of subcall function 00404CC8: FreeLibrary.KERNEL32(00000000), ref: 00404D02

Part of subcall function 0040506B: __fread_nolock.LIBCMT ref: 00405089

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Library$Free$Load__fread_nolock__wfsopen_memmove
String ID:
API String ID: 1609775715-0
Opcode ID: fbbe6342810aae6eb3a13c8902bab970ddb5b1228b8784956d1a4a8ed967591a
Instruction ID: 5856fbc04598f8720763e5afc42e8c3a4794c7060b7466c2264c1c7e33684289
Opcode Fuzzy Hash: fbbe6342810aae6eb3a13c8902bab970ddb5b1228b8784956d1a4a8ed967591a
Instruction Fuzzy Hash: 8211E771600606AADB10BF71DC02B6E77A89F84714F10843FFA41B72C1DA7D9A159B59

Uniqueness

Uniqueness Score: 0.09%

Function 00407F41, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

APIs

_memmove.LIBCMT ref: 00407F82

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Exception@8Throw_memmovestd::exception::exception
String ID:
API String ID: 1602317333-0
Opcode ID: 8760702c13fc74c5039c64040808ec9a9645cb46cb96adaba1e76e788e64bae9
Instruction ID: a481b228ba030df6875f9a6dd2da52b06f57c7a09d876ea22ea353c417f4835c
Opcode Fuzzy Hash: 8760702c13fc74c5039c64040808ec9a9645cb46cb96adaba1e76e788e64bae9
Instruction Fuzzy Hash: EB0126B26043027ED3205B39DC02F63BB94AB44760F10863FF51ACB2D1EA79E4008758

Uniqueness

Uniqueness Score: 0.36%

Function 0045FC4D, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 0045FC88

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Exception@8Throw_memmovestd::exception::exception
String ID:
API String ID: 1602317333-0
Opcode ID: bb67aa961ed85a7a54b5feca877a1ff1f2a2effc2d0ffda91d0c5cec861b0993
Instruction ID: 2728c7377d2fb3091888e666e74eab3efefd279969e8fcd463a9dd8d880a9b88
Opcode Fuzzy Hash: bb67aa961ed85a7a54b5feca877a1ff1f2a2effc2d0ffda91d0c5cec861b0993
Instruction Fuzzy Hash: B401D6322002256BCB24DF2DD88196BB7A9EFC5358714443EFC0ACB246E631E905C791

Uniqueness

Uniqueness Score: 0.36%

Function 00404FAA, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

APIs

FreeLibrary.KERNEL32(?,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404FDE

Part of subcall function 004255D6: __lock_file.LIBCMT ref: 0042561B
Part of subcall function 004255D6: __fclose_nolock.LIBCMT ref: 00425626

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: FreeLibrary__fclose_nolock__lock_file
String ID:
API String ID: 1424536762-0
Opcode ID: 33e20a952f2e8d0d1fe5c77e63e757c0056158892867987900cbbd52313694f7
Instruction ID: 9f4c00c3caf65de6ea716a0b429dd2d7583c2b82718a0f3f6db7eedc70ddef11
Opcode Fuzzy Hash: 33e20a952f2e8d0d1fe5c77e63e757c0056158892867987900cbbd52313694f7
Instruction Fuzzy Hash: B3F039B1105712DFCB349F64E494816BBE2BF443293208A3FE2D692A50C739A884DF49

Uniqueness

Uniqueness Score: 0.03%

Function 004209D5, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 004209F4

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 782b4155a6be5666b9d6f7013c8adbab57ca25bad31f58bf0dd3291e7fbeca14
Instruction ID: 7974ecc8d6474924d437b965a90c8222220e8c30f7c7811ba04b272f454b6667
Opcode Fuzzy Hash: 782b4155a6be5666b9d6f7013c8adbab57ca25bad31f58bf0dd3291e7fbeca14
Instruction Fuzzy Hash: 23E0263290022857C720E2589C05FFAB3ACDF88290F0001BAFC0CD3204D964AC818694

Uniqueness

Uniqueness Score: 0.21%

Function 0039817D, Relevance: 1.5, APIs: 1, Instructions: 273memoryCOMMON

APIs

VirtualAlloc.KERNELBASE(00000000,09CE0D4A,00000000,?,00003000,00000004), ref: 0039835E

Memory Dump Source

Source File: 00000004.00000002.1883487060.00380000.00000040.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_380000_TkAngEQurH.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5b072f8f7ccd644d1863391c81af6dae480b7708c2c32fcbde894d917b1f8024
Instruction ID: 7ccf41003649a3e5a7e17a3623c913186d81a12512e5ab7771863117e0061afd
Opcode Fuzzy Hash: 5b072f8f7ccd644d1863391c81af6dae480b7708c2c32fcbde894d917b1f8024
Instruction Fuzzy Hash: 5C91C23490C206EAEF134B658D85FBA767CAFC3740F354867E947A9C80DF309905BA26

Uniqueness

Uniqueness Score: 0.00%

Function 0042548B, Relevance: 1.5, APIs: 1, Instructions: 9COMMON

APIs

__wfsopen.LIBCMT ref: 00425496

Part of subcall function 004254A0: __getstream.LIBCMT ref: 004254F0
Part of subcall function 004254A0: @_EH4_CallFilterFunc@8.LIBCMT ref: 0042552B
Part of subcall function 004254A0: __wopenfile.LIBCMT ref: 0042553B

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: CallFilterFunc@8__getstream__wfsopen__wopenfile
String ID:
API String ID: 4064380324-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 46a80e34e794c1a8cabf707ff87d233abccaec3d4d3113a971d4033361891bdf
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: CBB0927694020C77DE012E82FC02B697B199B44678F808021FB0C18162A677A6A09689

Uniqueness

Uniqueness Score: 2.04%

Function 003985AE, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

APIs

KiUserExceptionDispatcher.NTDLL(E0000156,?,003984D1,?,00380198,?,-00DA36EC,00380198,-6345E181,00380198,?,?), ref: 003985BA

Memory Dump Source

Source File: 00000004.00000002.1883487060.00380000.00000040.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_380000_TkAngEQurH.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8d000ff5603b81d0488a500497f1b8ef7f2d3fc7e3d88bdb03da15b1d34e2658
Instruction ID: 4f396ec3a82cd598686e0c6bb24346187e1e1b115ab055eacadd83e131ab56df
Opcode Fuzzy Hash: 8d000ff5603b81d0488a500497f1b8ef7f2d3fc7e3d88bdb03da15b1d34e2658
Instruction Fuzzy Hash: 06B092791618108FC201EB99D99CEA9B3E1FFCD312F5598E1E25DCB211DA1046029B84

Uniqueness

Uniqueness Score: 0.19%

Function 00397E65, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

APIs

KiUserExceptionDispatcher.NTDLL(E0000107,?,00397751,?), ref: 00397E71

Memory Dump Source

Source File: 00000004.00000002.1883487060.00380000.00000040.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_380000_TkAngEQurH.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a37cf9b971665701cfb3ec4bfeb27e3888c67994b9ea65ffdbd490416e5108fe
Instruction ID: 44a40747177551ccd23d9d07e4ef71f414bfd9716f7cb3d6abfcb7930697a32c
Opcode Fuzzy Hash: a37cf9b971665701cfb3ec4bfeb27e3888c67994b9ea65ffdbd490416e5108fe
Instruction Fuzzy Hash: 3EB09231A441168FC601EFA8D08CAE873E6BB8C300F3188B1E288C7230E620990A8B11

Uniqueness

Uniqueness Score: 0.19%

Function 0042A764, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

APIs

RtlEncodePointer.NTDLL(0042A730,004233F0,00000000,00000000,00000000,00000000,00000000), ref: 0042A769

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: b099f3d81180c5901ffbe3b9a6e79c65983757674502b88ca7a2d2bad456539b
Instruction ID: eebce8f2417fcbd939ec70b27f3c6012329136301deee71cbb14e520e27e25f6
Opcode Fuzzy Hash: b099f3d81180c5901ffbe3b9a6e79c65983757674502b88ca7a2d2bad456539b
Instruction Fuzzy Hash: 69A002F4E563608B87505F70FE1990A7AF0B7C5702B51057EEC5181264DB784025AB1E

Uniqueness

Uniqueness Score: 0.05%

Non-executed Functions

Function 0048804A, Relevance: 61.8, APIs: 33, Strings: 2, Instructions: 575windowUNIQUE

APIs

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 004880E0
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 004880FF
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00488123
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00488134
SendMessageW.USER32(?,00000149,00000000,00000000), ref: 00488153
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00488186
SendMessageW.USER32(?,0000133C,00000000,?), ref: 004881AC
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004881E7
SendMessageW.USER32(?,0000113E,00000000,00000004), ref: 0048822E
SendMessageW.USER32(?,0000113E,00000000,00000004), ref: 00488256
IsMenu.USER32(?), ref: 0048826F
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004882CA
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004882F8
GetWindowLongW.USER32(?,000000F0), ref: 0048836C
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 004883BB
SendMessageW.USER32(?,00001001,00000000,?), ref: 00488456
wsprintfW.USER32 ref: 0048847E
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 004884A0
GetWindowTextW.USER32(?,00000000,00000001), ref: 004884C8
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 004884EA
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0048850A
GetWindowTextW.USER32(?,00000000,00000001), ref: 00488531

Part of subcall function 00409997: __itow.LIBCMT ref: 004099C2
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9B1
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9DD
Part of subcall function 00409997: __i64tow.LIBCMT ref: 0043FA0F

Part of subcall function 0040463E: _wcsncpy.LIBCMT ref: 00404652

GetWindowLongW.USER32(?,000000EC), ref: 004885AB
_memset.LIBCMT ref: 004885BD
SendMessageW.USER32(?,00001053,000000FF,?), ref: 004885EC
SendMessageW.USER32(?,0000104B,00000000,?), ref: 00488625

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 00488676
CharNextW.USER32(00000000), ref: 004886B1
SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 004886E1
SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 004886FC
_memset.LIBCMT ref: 00488709
SendMessageW.USER32(?,0000104B,00000000,?), ref: 0048872A
SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0048873F

Strings

0, xrefs: 0048829A
%d/%02d/%02d, xrefs: 00488478

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend$Window$Menu$InfoItemLongText_memset_wcscpy$CharException@8NextThrow__i64tow__itow_wcsncpystd::exception::exceptionwsprintf
String ID: %d/%02d/%02d$0
API String ID: 2743317742-4206205729
Opcode ID: 5059ae11ea541f98f5c1cd242e66ed88df343c98d396fc69c2da753e30ebbc98
Instruction ID: 1694620be85d9f4a29f3fb548ce2e2fcd9673ad025b7a1e90bc8429aa5b278b6
Opcode Fuzzy Hash: 5059ae11ea541f98f5c1cd242e66ed88df343c98d396fc69c2da753e30ebbc98
Instruction Fuzzy Hash: DA12F471500214ABEB24AF24CC49FAF7BB4EF45710F60492EF915EA2E1EF788941CB18

Uniqueness

Uniqueness Score: 100.00%

Function 0041710E, Relevance: 52.3, APIs: 19, Strings: 8, Instructions: 5093UNIQUE

APIs

_memmove.LIBCMT ref: 004175C2
_memset.LIBCMT ref: 004176B1

Part of subcall function 00416DB8: _memmove.LIBCMT ref: 00451BBD

_memmove.LIBCMT ref: 00417C4B
_memmove.LIBCMT ref: 00417E4F
_memmove.LIBCMT ref: 0045205F
_memmove.LIBCMT ref: 0045286D
_memmove.LIBCMT ref: 00452A2E
_memmove.LIBCMT ref: 00452B08
_memmove.LIBCMT ref: 00452BDB
_memmove.LIBCMT ref: 00452D3D

Part of subcall function 0048E0E7: _memmove.LIBCMT ref: 0048E129

_memmove.LIBCMT ref: 00452F07
_memmove.LIBCMT ref: 00453045
_memmove.LIBCMT ref: 00453149
_memmove.LIBCMT ref: 004531AD
_memmove.LIBCMT ref: 0045321E
_memmove.LIBCMT ref: 0045335C
_memmove.LIBCMT ref: 00453E8E
_memmove.LIBCMT ref: 004544F9
_memmove.LIBCMT ref: 00454528

Strings

Q\E, xrefs: 004181C1
DEFINE, xrefs: 004525AF
[:>:]], xrefs: 0041760A
athan, xrefs: 004527FC, 0045360B
\b(?=\w), xrefs: 00453C34
\b(?<=\w), xrefs: 00453C41
OaA, xrefs: 0045287E
[:<:]], xrefs: 004175F1

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$OaA$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$athan
API String ID: 1357608183-1312225879
Opcode ID: 7d82e88c8c583c3cf55e43ee8ba79f162b63989cccceeed3ce797de6903fdd66
Instruction ID: 0f2016292ce7af36af0f0c3c89fa088be26185f2ba7aa12bc90a9d7b287e4a4c
Opcode Fuzzy Hash: 7d82e88c8c583c3cf55e43ee8ba79f162b63989cccceeed3ce797de6903fdd66
Instruction Fuzzy Hash: 2C93A371A002199BDB24CF58C8817EEB7B1FF48715F24816BED45AB381E7789D86CB48

Uniqueness

Uniqueness Score: 100.00%

Function 00435CCC, Relevance: 50.9, APIs: 23, Strings: 6, Instructions: 173libraryloaderUNIQUELIBRARYCODE

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00435CF4
___crtIsPackagedApp.LIBCMT ref: 00435CFB
LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000800,?,?,?,?,?,0042A54D,004C4388,Microsoft Visual C++ Runtime Library,00012010), ref: 00435D1A
GetLastError.KERNEL32(?,?,?,?,?,0042A54D,004C4388,Microsoft Visual C++ Runtime Library,00012010), ref: 00435D26
LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000000,?,?,?,?,?,0042A54D,004C4388,Microsoft Visual C++ Runtime Library,00012010), ref: 00435D3C
GetProcAddress.KERNEL32(00000000,MessageBoxW,?,?,?,?,?,0042A54D,004C4388,Microsoft Visual C++ Runtime Library,00012010), ref: 00435D52
RtlEncodePointer.NTDLL(00000000), ref: 00435D61
GetProcAddress.KERNEL32(00000000,GetActiveWindow,?,?,?,?,?,0042A54D,004C4388,Microsoft Visual C++ Runtime Library,00012010), ref: 00435D6E
RtlEncodePointer.NTDLL(00000000), ref: 00435D75
GetProcAddress.KERNEL32(00000000,GetLastActivePopup,?,?,?,?,?,0042A54D,004C4388,Microsoft Visual C++ Runtime Library,00012010), ref: 00435D82
RtlEncodePointer.NTDLL(00000000), ref: 00435D89
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationW,?,?,?,?,?,0042A54D,004C4388,Microsoft Visual C++ Runtime Library,00012010), ref: 00435D96
RtlEncodePointer.NTDLL(00000000), ref: 00435D9D
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation,?,?,?,?,?,0042A54D,004C4388,Microsoft Visual C++ Runtime Library,00012010), ref: 00435DAE
RtlEncodePointer.NTDLL(00000000), ref: 00435DB5
IsDebuggerPresent.KERNEL32(?,?,?,?,?,0042A54D,004C4388,Microsoft Visual C++ Runtime Library,00012010), ref: 00435DBF
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,0042A54D,004C4388,Microsoft Visual C++ Runtime Library,00012010), ref: 00435DD1
DecodePointer.KERNEL32(?,?,?,?,?,0042A54D,004C4388,Microsoft Visual C++ Runtime Library,00012010), ref: 00435DEF
RtlDecodePointer.NTDLL(00000000), ref: 00435E11
RtlDecodePointer.NTDLL ref: 00435E1C
RtlDecodePointer.NTDLL(00000000), ref: 00435E61
RtlDecodePointer.NTDLL(00000000), ref: 00435E79
RtlDecodePointer.NTDLL ref: 00435E8D

Part of subcall function 0042C836: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00435B51
Part of subcall function 0042C836: ___raise_securityfailure.LIBCMT ref: 00435C38

Strings

GetUserObjectInformationW, xrefs: 00435D8B
USER32.DLL, xrefs: 00435D15, 00435D37
GetProcessWindowStation, xrefs: 00435DA8
GetActiveWindow, xrefs: 00435D63
MessageBoxW, xrefs: 00435D4C
GetLastActivePopup, xrefs: 00435D77

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pointer$DecodeEncode$AddressProc$LibraryLoadPresent$DebugDebuggerErrorFeatureLastOutputPackagedProcessorString___crt___raise_securityfailure
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 97357100-564504941
Opcode ID: 67692df2a90b64cfb2ca71d2dab81c6183001a442f09778e226da224704586d6
Instruction ID: de014ab2273c1a8db88a068a7f435dd34fa8e165460fc89267ca89f4e15a35a6
Opcode Fuzzy Hash: 67692df2a90b64cfb2ca71d2dab81c6183001a442f09778e226da224704586d6
Instruction Fuzzy Hash: 59518271900A06ABCB119BB59C49E6F7BB8BF48B40F24553AF505E3250DB78DD40CBAC

Uniqueness

Uniqueness Score: 100.00%

Function 00404A35, Relevance: 49.1, APIs: 24, Strings: 4, Instructions: 136threadkeyboardwindowUNIQUE

APIs

GetForegroundWindow.USER32 ref: 00404A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0043DA8E
IsIconic.USER32(?), ref: 0043DA97
ShowWindow.USER32(?,00000009), ref: 0043DAA4
SetForegroundWindow.USER32(?), ref: 0043DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0043DAC4
GetCurrentThreadId.KERNEL32 ref: 0043DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 0043DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 0043DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 0043DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 0043DAF8
SetForegroundWindow.USER32(?), ref: 0043DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 0043DB10
keybd_event.USER32(00000012,00000000), ref: 0043DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 0043DB25
keybd_event.USER32(00000012,00000000), ref: 0043DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 0043DB33
keybd_event.USER32(00000012,00000000), ref: 0043DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 0043DB42
keybd_event.USER32(00000012,00000000), ref: 0043DB47
SetForegroundWindow.USER32(?), ref: 0043DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 0043DB71
AttachThreadInput.USER32(?,00000000,00000000), ref: 0043DB79
AttachThreadInput.USER32(00000000,?,00000000), ref: 0043DB81

Strings

$k w, xrefs: 0043DB50
Lj w, xrefs: 0043DB05
Shell_TrayWnd, xrefs: 0043DA89
$k w, xrefs: 0043DAD9

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: $k w$$k w$Lj w$Shell_TrayWnd
API String ID: 3778422247-3904050060
Opcode ID: f9275528528b807d0c255385b8317845eae72d2de6d0c65feb9d7ed8998e7865
Instruction ID: b87912adca826af034faba5527973e3e3f308b649105ed48d0b0d9dcf2124600
Opcode Fuzzy Hash: f9275528528b807d0c255385b8317845eae72d2de6d0c65feb9d7ed8998e7865
Instruction Fuzzy Hash: 47318771E803187BEB306BA19C49F7F7E6CDB44B51F215036BA04E61C1CAB44D11AAA9

Uniqueness

Uniqueness Score: 100.00%

Function 00416843, Relevance: 19.6, Strings: 15, Instructions: 883UNIQUE

Strings

BSR_ANYCRLF), xrefs: 00451757
LIMIT_RECURSION=, xrefs: 00451635
BSR_UNICODE), xrefs: 00451771
CR), xrefs: 004516C0
OaA, xrefs: 00451888, 0045192F, 004519DD
LIMIT_MATCH=, xrefs: 004515A9
ANY), xrefs: 00451717
CRLF), xrefs: 004516FA
ANYCRLF), xrefs: 00451734
NO_START_OPT), xrefs: 00451588
UCP), xrefs: 00451546
UTF), xrefs: 00451533
UTF16), xrefs: 00451508
LF), xrefs: 004516DD
NO_AUTO_POSSESS), xrefs: 00451567

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$__isdigit_l_memcmp
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$OaA$UCP)$UTF)$UTF16)
API String ID: 354189410-3302439341
Opcode ID: b575eb5cd43adaea0de128a74aa3f58823f576806eefacb0f2dd0bce3e4b62d6
Instruction ID: 3784516a1003e1c275ce3f2ff5430e7d36dc90e0b9f0d34c2957a4bb797dab3e
Opcode Fuzzy Hash: b575eb5cd43adaea0de128a74aa3f58823f576806eefacb0f2dd0bce3e4b62d6
Instruction Fuzzy Hash: 8B72AE71E002199BDB24CF59C8807EEB7B5EF48310F15806BE849EB391E7789D85CB99

Uniqueness

Uniqueness Score: 100.00%

Function 00413190, Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587UNIQUE

APIs

Part of subcall function 00409997: __itow.LIBCMT ref: 004099C2
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9B1
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9DD
Part of subcall function 00409997: __i64tow.LIBCMT ref: 0043FA0F

Part of subcall function 0042594C: __FF_MSGBANNER.LIBCMT ref: 00425963
Part of subcall function 0042594C: __NMSG_WRITE.LIBCMT ref: 0042596A
Part of subcall function 0042594C: RtlAllocateHeap.NTDLL(00B90000,00000000,00000001,00000000,00000000,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28), ref: 0042598F

_memmove.LIBCMT ref: 004133D7

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 00413470
_free.LIBCMT ref: 00413496

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

_memmove.LIBCMT ref: 00413549

Part of subcall function 00407E8C: _memmove.LIBCMT ref: 00407ED5

Part of subcall function 00456665: _memmove.LIBCMT ref: 004566AF

Strings

OaA, xrefs: 00413482

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$Heap_wcscpy$AllocateErrorException@8FreeLastThrow__i64tow__itow_freestd::exception::exception
String ID: OaA
API String ID: 403207814-4189730831
Opcode ID: ed206b401d3418ddabb68cbd665224f90af44a32e33aa6551fdfab0439b26318
Instruction ID: 2ffd56a64c60677c5789fbd16bfbcfb13b798939f1cd0f2cf633511a31807f6c
Opcode Fuzzy Hash: ed206b401d3418ddabb68cbd665224f90af44a32e33aa6551fdfab0439b26318
Instruction Fuzzy Hash: 70229D716083019FD724DF14C881BABB7E5AF84704F10492EF89697392DB78EE45CB9A

Uniqueness

Uniqueness Score: 100.00%

Function 00463E91, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85processUNIQUE

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00463EB6
Process32FirstW.KERNEL32(00000000,?), ref: 00463EC4
Process32NextW.KERNEL32(00000000,?), ref: 00463EE4
CloseHandle.KERNEL32(00000000), ref: 00463F8E

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

Strings

%I, xrefs: 00463E9F

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID: %I
API String ID: 2576544623-63094095
Opcode ID: 3ffacf92776744d34e5bed9ce163fb83ba132918f27232e59d0ab2f5e8250a37
Instruction ID: bc57a40dc23490dc388bdabf7fd9d7894261e16e4d08916f741d4787c1592c25
Opcode Fuzzy Hash: 3ffacf92776744d34e5bed9ce163fb83ba132918f27232e59d0ab2f5e8250a37
Instruction Fuzzy Hash: B731C2715083419FD304EF21C885AAFBBF8EF99344F10093EF481921A1EB75AA49CB57

Uniqueness

Uniqueness Score: 100.00%

Function 0040192B, Relevance: 7.8, APIs: 5, Instructions: 308COMMON

APIs

DefDlgProcW.USER32(?,?), ref: 004019FA

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

GetSysColor.USER32(0000000F), ref: 00401A4E
SetBkColor.GDI32(?,00000000), ref: 00401A61

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

Part of subcall function 0040167D: DefDlgProcW.USER32(?,00000007,?,00000000), ref: 004016AB

Part of subcall function 00401290: DefDlgProcW.USER32(?,00000020,?), ref: 004012D8
Part of subcall function 00401290: GetClientRect.USER32(?,?), ref: 0043B84B
Part of subcall function 00401290: GetCursorPos.USER32(?), ref: 0043B855
Part of subcall function 00401290: ScreenToClient.USER32(?,?), ref: 0043B860

Part of subcall function 0040189B: DefDlgProcW.USER32(?,00000006,00000000,?), ref: 004018E2

Part of subcall function 0048CC88: GetWindowRect.USER32(?,?), ref: 0048CCAD
Part of subcall function 0048CC88: GetWindowRect.USER32(?,?), ref: 0048CD0C
Part of subcall function 0048CC88: MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0048CD46

Part of subcall function 0048D74C: GetSystemMetrics.USER32(0000000F), ref: 0048D78A
Part of subcall function 0048D74C: GetSystemMetrics.USER32(0000000F), ref: 0048D7AA
Part of subcall function 0048D74C: MoveWindow.USER32(00000003,?,?,?,?,00000000), ref: 0048D9E5
Part of subcall function 0048D74C: SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0048DA03
Part of subcall function 0048D74C: SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0048DA24
Part of subcall function 0048D74C: ShowWindow.USER32(00000003,00000000), ref: 0048DA43
Part of subcall function 0048D74C: InvalidateRect.USER32(?,00000000,00000001), ref: 0048DA68
Part of subcall function 0048D74C: DefDlgProcW.USER32(?,00000005,?,?), ref: 0048DA8B

Part of subcall function 004016B5: DefDlgProcW.USER32(?,00000002,00000000,00000000), ref: 004016D4

Part of subcall function 0048C86D: SendMessageW.USER32(?,00000401,00000000,00000000), ref: 0048C8C7
Part of subcall function 0048C86D: DefDlgProcW.USER32(?,0000002B,?,?), ref: 0048C8E1

Part of subcall function 0048D6C6: DefDlgProcW.USER32(?,00000115,?,?), ref: 0048D740

Part of subcall function 0048DA9A: DefDlgProcW.USER32(?,00000112,?,00000000), ref: 0048DB46

Part of subcall function 0048C49C: PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0048C4EC
Part of subcall function 0048C49C: GetFocus.USER32 ref: 0048C4FC
Part of subcall function 0048C49C: GetDlgCtrlID.USER32(00000000), ref: 0048C507
Part of subcall function 0048C49C: _memset.LIBCMT ref: 0048C632
Part of subcall function 0048C49C: GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0048C65D
Part of subcall function 0048C49C: GetMenuItemCount.USER32(?), ref: 0048C67D
Part of subcall function 0048C49C: GetMenuItemID.USER32(?,00000000), ref: 0048C690
Part of subcall function 0048C49C: GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0048C6C4
Part of subcall function 0048C49C: GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0048C70C
Part of subcall function 0048C49C: CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0048C744
Part of subcall function 0048C49C: DefDlgProcW.USER32(?,00000111,?,?), ref: 0048C779

Part of subcall function 0048CD6C: GetWindowLongW.USER32(?,000000EC), ref: 0048CD74
Part of subcall function 0048CD6C: DefDlgProcW.USER32(?,00000084,00000000), ref: 0048CDA2

Part of subcall function 0048C788: GetCursorPos.USER32(?), ref: 0048C7C2
Part of subcall function 0048C788: TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0048C7D7
Part of subcall function 0048C788: GetCursorPos.USER32(?), ref: 0048C824
Part of subcall function 0048C788: DefDlgProcW.USER32(?,0000007B,?), ref: 0048C85E

Part of subcall function 0048CBF9: DefDlgProcW.USER32(?,00000053,?,?), ref: 0048CC24

Part of subcall function 0048CDAC: DefDlgProcW.USER32(?,0000004E,?,?), ref: 0048CE50
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0048CE91
Part of subcall function 0048CDAC: GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0048CED6
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0048CF00
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048CF29
Part of subcall function 0048CDAC: _wcsncpy.LIBCMT ref: 0048CFA1
Part of subcall function 0048CDAC: GetKeyState.USER32(00000011), ref: 0048CFC2
Part of subcall function 0048CDAC: GetKeyState.USER32(00000009), ref: 0048CFCF
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0048CFE5
Part of subcall function 0048CDAC: GetKeyState.USER32(00000010), ref: 0048CFEF
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0048D018
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048D03F
Part of subcall function 0048CDAC: SendMessageW.USER32(?,00001030,?,0048B602), ref: 0048D145
Part of subcall function 0048CDAC: ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?), ref: 0048D15B
Part of subcall function 0048CDAC: ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0048D16E
Part of subcall function 0048CDAC: SetCapture.USER32(?), ref: 0048D177
Part of subcall function 0048CDAC: ClientToScreen.USER32(?,?), ref: 0048D1DC
Part of subcall function 0048CDAC: ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0048D1E9
Part of subcall function 0048CDAC: InvalidateRect.USER32(?,00000000,00000001), ref: 0048D203
Part of subcall function 0048CDAC: ReleaseCapture.USER32 ref: 0048D20E
Part of subcall function 0048CDAC: GetCursorPos.USER32(?), ref: 0048D248
Part of subcall function 0048CDAC: ScreenToClient.USER32(?,?), ref: 0048D255
Part of subcall function 0048CDAC: SendMessageW.USER32(?,00001012,00000000,?), ref: 0048D2B1
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048D2DF
Part of subcall function 0048CDAC: SendMessageW.USER32(?,00001111,00000000,?), ref: 0048D31C
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048D34B
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0048D36C
Part of subcall function 0048CDAC: SendMessageW.USER32(?,0000110B,00000009,?), ref: 0048D37B
Part of subcall function 0048CDAC: GetCursorPos.USER32(?), ref: 0048D39B
Part of subcall function 0048CDAC: ScreenToClient.USER32(?,?), ref: 0048D3A8
Part of subcall function 0048CDAC: GetParent.USER32(?), ref: 0048D3C8
Part of subcall function 0048CDAC: SendMessageW.USER32(?,00001012,00000000,?), ref: 0048D431
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048D462
Part of subcall function 0048CDAC: ClientToScreen.USER32(?,?), ref: 0048D4C0
Part of subcall function 0048CDAC: TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0048D4F0
Part of subcall function 0048CDAC: SendMessageW.USER32(?,00001111,00000000,?), ref: 0048D51A
Part of subcall function 0048CDAC: SendMessageW.USER32 ref: 0048D53D
Part of subcall function 0048CDAC: ClientToScreen.USER32(?,?), ref: 0048D58F
Part of subcall function 0048CDAC: TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0048D5C3
Part of subcall function 0048CDAC: GetWindowLongW.USER32(?,000000F0), ref: 0048D65F

Part of subcall function 00456BAE: GetSysColor.USER32(0000000F), ref: 00456BCD
Part of subcall function 00456BAE: SetBkColor.GDI32(?,00000000), ref: 00456BE2

Part of subcall function 00401765: BeginPaint.USER32(?,?), ref: 0040179A
Part of subcall function 00401765: GetWindowRect.USER32(?,?), ref: 004017FE
Part of subcall function 00401765: ScreenToClient.USER32(?,?), ref: 0040181B
Part of subcall function 00401765: SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0040182C
Part of subcall function 00401765: EndPaint.USER32(?,?), ref: 00401876
Part of subcall function 00401765: Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0043BACB

Part of subcall function 0048C220: DefDlgProcW.USER32(?,00000204,?), ref: 0048C272

Part of subcall function 0048CC2E: ClientToScreen.USER32(?,?), ref: 0048CC51
Part of subcall function 0048CC2E: ImageList_DragMove.COMCTL32(?,?,?,?,?,?,?,0043BC66), ref: 0048CC5D
Part of subcall function 0048CC2E: DefDlgProcW.USER32(?,00000200,?,?), ref: 0048CC7A

Part of subcall function 004016DE: GetParent.USER32(?), ref: 0043BA0A
Part of subcall function 004016DE: DefDlgProcW.USER32(?,00000133,?,?), ref: 0043BA84

Part of subcall function 0048C27C: ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?), ref: 0048C2E4
Part of subcall function 0048C27C: ImageList_EndDrag.COMCTL32 ref: 0048C2EA
Part of subcall function 0048C27C: ReleaseCapture.USER32 ref: 0048C2F0
Part of subcall function 0048C27C: SetWindowTextW.USER32(?,00000000), ref: 0048C39A
Part of subcall function 0048C27C: SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0048C3AD
Part of subcall function 0048C27C: DefDlgProcW.USER32(?,00000202,?), ref: 0048C48F

IsThemeActive.UXTHEME ref: 0043BC84
DefDlgProcW.USER32(?,0000031A), ref: 0043BC97

Part of subcall function 0048C8EE: DragQueryPoint.SHELL32(?,?), ref: 0048C917
Part of subcall function 0048C8EE: SendMessageW.USER32(?,000000B0,?,?), ref: 0048C980
Part of subcall function 0048C8EE: DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0048C98B
Part of subcall function 0048C8EE: DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0048C9AE
Part of subcall function 0048C8EE: _wcscat.LIBCMT ref: 0048C9DE
Part of subcall function 0048C8EE: SendMessageW.USER32(?,000000C2,00000001,?), ref: 0048C9F5
Part of subcall function 0048C8EE: SendMessageW.USER32(?,000000B0,?,?), ref: 0048CA0E
Part of subcall function 0048C8EE: SendMessageW.USER32(?,000000B1,?,?), ref: 0048CA25
Part of subcall function 0048C8EE: SendMessageW.USER32(?,000000B1,?,?), ref: 0048CA47
Part of subcall function 0048C8EE: DragFinish.SHELL32(?), ref: 0048CA4E
Part of subcall function 0048C8EE: DefDlgProcW.USER32(?,00000233,?,00000000), ref: 0048CB41

Part of subcall function 0048CBAE: DefDlgProcW.USER32(?,00000232,?,?), ref: 0048CBEE

Part of subcall function 0048CB7F: DefDlgProcW.USER32 ref: 0048CBA4

Part of subcall function 0048CB50: DefDlgProcW.USER32 ref: 0048CB75

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Send$Proc$Window$Drag$ClientMenu$Screen$Image$CursorItemList_Rect$ColorLong$CaptureInfoMovePopupQueryStateTrack$BeginFileInvalidateMetricsPaintParentReleaseSystem$ActiveBrushCheckCountCreateCtrlEnterFinishFocusLeavePointPostRadioRectangleShowSolidTextThemeViewport_memset_wcscat_wcsncpy
String ID:
API String ID: 961471779-0
Opcode ID: 2fb92fa242998f351c79376ef6791cc8e7c1b3e924aa0510fce2328af909611d
Instruction ID: 84d1a059880b126f76773d033bf70feb67e7e293265a24d36894b0b11499e700
Opcode Fuzzy Hash: 2fb92fa242998f351c79376ef6791cc8e7c1b3e924aa0510fce2328af909611d
Instruction Fuzzy Hash: DE7135A12064847AE53976AA4C89E7F244DDB85386F14093FF102F56F2CE3D9D0296BF

Uniqueness

Uniqueness Score: 0.46%

Function 0040E060, Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 539UNIQUE

APIs

_memmove.LIBCMT ref: 0040E234

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 00443BAC

Part of subcall function 0046A0B5: LoadStringW.USER32(00000066,?,00000FFF,%I), ref: 0046A0FC
Part of subcall function 0046A0B5: LoadStringW.USER32(?,?,00000FFF,?), ref: 0046A11E
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A246
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A264
Part of subcall function 0046A0B5: MessageBoxW.USER32(?,?,00011010,?), ref: 0046A27F

Strings

%I, xrefs: 0040E067

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: LoadString_memmove_wprintf$Exception@8MessageThrowstd::exception::exception
String ID: %I
API String ID: 120496405-63094095
Opcode ID: 85bb46bc2b1aa6167ab40a2ccaaf29d2805d63f1e8d932882a5f436b636b35b6
Instruction ID: 717d1ab0d90b391ed1eaae52652e6e1fa3a898975f929f0a44a13a0e96a5ed75
Opcode Fuzzy Hash: 85bb46bc2b1aa6167ab40a2ccaaf29d2805d63f1e8d932882a5f436b636b35b6
Instruction Fuzzy Hash: 0822A170A00215DFDB24DF55C480AAEBBF0FF04304F14887BE956AB391D778A995CB99

Uniqueness

Uniqueness Score: 100.00%

Function 0040FE40, Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

APIs

Part of subcall function 004082E0: CharUpperBuffW.USER32(?,?), ref: 004082FD

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 0041047A
_memmove.LIBCMT ref: 004107DF
_memmove.LIBCMT ref: 0041080E

Part of subcall function 0046A0B5: LoadStringW.USER32(00000066,?,00000FFF,%I), ref: 0046A0FC
Part of subcall function 0046A0B5: LoadStringW.USER32(?,?,00000FFF,?), ref: 0046A11E
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A246
Part of subcall function 0046A0B5: _wprintf.LIBCMT ref: 0046A264
Part of subcall function 0046A0B5: MessageBoxW.USER32(?,?,00011010,?), ref: 0046A27F

Part of subcall function 00409E9C: #9.OLEAUT32(?,?,?,?,?,00469D81,?,00000001,-004C5E88,?,00455CCE,?,?,?,0040FAE1,00000000), ref: 0043FE11

Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410BBB
Part of subcall function 00410B30: timeGetTime.WINMM ref: 00410E76
Part of subcall function 00410B30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00410FB3
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 00410FC7
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00410FD5
Part of subcall function 00410B30: Sleep.KERNELBASE(0000000A), ref: 00410FDF
Part of subcall function 00410B30: LockWindowUpdate.USER32(00000000), ref: 0041105A
Part of subcall function 00410B30: DestroyWindow.USER32 ref: 00411066
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00411080
Part of subcall function 00410B30: timeGetTime.WINMM ref: 004110B2
Part of subcall function 00410B30: TranslateAcceleratorW.USER32(?,?,?), ref: 00445189
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,%I,?), ref: 004452AD
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A,?,?), ref: 004454A2
Part of subcall function 00410B30: #9.OLEAUT32(00000000,00000000,?,00000000,?,00000001,?,?,?,00000001,?,?,?,?,?), ref: 00445844
Part of subcall function 00410B30: #9.OLEAUT32(00000000), ref: 00445A00
Part of subcall function 00410B30: #9.OLEAUT32(?,00000000,?,00000000,00000000,?,-00000001,00000000,00000001,@COM_EVENTOBJ,?,?,?,?,?), ref: 00445A96
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,0000000A), ref: 00445C51
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445C71
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445C7D
Part of subcall function 00410B30: Sleep.KERNEL32(0000000A), ref: 00445F24
Part of subcall function 00410B30: GetExitCodeProcess.KERNEL32(?,?), ref: 00445FBF
Part of subcall function 00410B30: WaitForSingleObject.KERNEL32(?,00000000), ref: 00445FD7
Part of subcall function 00410B30: CloseHandle.KERNEL32(?), ref: 00445FEB
Part of subcall function 00410B30: Sleep.KERNEL32(?,CCCCCCCC,00000000), ref: 00446058
Part of subcall function 00410B30: TranslateMessage.USER32(?), ref: 0044608A
Part of subcall function 00410B30: DispatchMessageW.USER32(?), ref: 00446098
Part of subcall function 00410B30: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004460AC

Part of subcall function 0047A5EE: CharUpperBuffW.USER32(?,?), ref: 0047A67E

Part of subcall function 00456C62: _memmove.LIBCMT ref: 00456CAC

Part of subcall function 00456665: _memmove.LIBCMT ref: 004566AF

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Sleep_memmove$Translate$BuffCharCloseCodeDispatchExitHandleLoadObjectPeekProcessSingleStringTimeUpperWaitWindow_wprintftime$AcceleratorDestroyException@8LockThrowUpdatestd::exception::exception
String ID:
API String ID: 1936138902-0
Opcode ID: 85ec54913d2ec06f42e54e0da5903a1174201aa5957c6857b12228ccd3c05745
Instruction ID: a3b9221dc64c310c941b5016b295edb8af427260a8d4055f717b05a0858251c0
Opcode Fuzzy Hash: 85ec54913d2ec06f42e54e0da5903a1174201aa5957c6857b12228ccd3c05745
Instruction Fuzzy Hash: B7926C706083419FD720DF15C580B6BB7E1BF84304F14896EE8969B392D7B9EC85CB9A

Uniqueness

Uniqueness Score: 0.36%

Function 00384017, Relevance: 5.2, Strings: 4, Instructions: 213UNIQUE

Strings

8F8K, xrefs: 00384208
6[6o, xrefs: 003841DE
==, xrefs: 00384073
G=i=, xrefs: 00384063

Memory Dump Source

Source File: 00000004.00000002.1883487060.00380000.00000040.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_380000_TkAngEQurH.jbxd

Similarity

API ID:
String ID: 6[6o$8F8K$G=i=$==
API String ID: 0-215436572
Opcode ID: f596ada32ba792109b92588ca95fa04a8cc938c57e523e540bb77404e5ebec36
Instruction ID: 6041a404935fe5e8f3c4124b5cfa89bc0f77da838e037d01bc32aeca3a1498c9
Opcode Fuzzy Hash: f596ada32ba792109b92588ca95fa04a8cc938c57e523e540bb77404e5ebec36
Instruction Fuzzy Hash: 8D71D5314493D2AFCB669F7484662C3BFE1AE4731035B65DEC8C18F863D2215497DB82

Uniqueness

Uniqueness Score: 100.00%

Function 00464C03, Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00464C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00464C43
FreeSid.ADVAPI32(?), ref: 00464C53

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 008726f0c27652ffd03f151f72c22d205906185045b9f325022e2ab268aa6496
Instruction ID: 10b911d193db4ddcb2d704d9467f516d67823663164fbfa441d12c43b64d2f16
Opcode Fuzzy Hash: 008726f0c27652ffd03f151f72c22d205906185045b9f325022e2ab268aa6496
Instruction Fuzzy Hash: 86F04F7591130CBFDF04DFF0DC89AAEB7BCEF09201F104879A501E2281E7746A148B54

Uniqueness

Uniqueness Score: 0.04%

Function 00464696, Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

APIs

GetFileAttributesW.KERNEL32(?,0043E7C1), ref: 004646A6
FindFirstFileW.KERNEL32(?,?), ref: 004646B7
FindClose.KERNEL32(00000000), ref: 004646C7

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 4840215ffa09c9e98f8c71f503fabca7b99ef5557041bbbf62c8821922d9d811
Instruction ID: d948841d4539c93f635718a430456d5b2beea82774a4ad5489b04229db4e1113
Opcode Fuzzy Hash: 4840215ffa09c9e98f8c71f503fabca7b99ef5557041bbbf62c8821922d9d811
Instruction Fuzzy Hash: 81E0D8318104005B46106738EC4D4EF7B5C9E86335F100B6BFC35C15E0F7B85964869F

Uniqueness

Uniqueness Score: 0.13%

Function 0042A395, Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042A39A
UnhandledExceptionFilter.KERNEL32(?), ref: 0042A3A3

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c2bfc4d91f5eef072ecd4d4a99461c52a82975f392c39b974fa7ca05b3ef40fa
Instruction ID: 9da78fce3b57c7d2137df8720d13279edd616241823e717daaa40eb201d223bb
Opcode Fuzzy Hash: c2bfc4d91f5eef072ecd4d4a99461c52a82975f392c39b974fa7ca05b3ef40fa
Instruction Fuzzy Hash: CCB09231254308ABCA022B91EC09B8C3F68EB46AA2F404434FA0D84C60CB6254548B99

Uniqueness

Uniqueness Score: 0.02%

Function 0042F419, Relevance: 2.1, APIs: 1, Instructions: 645COMMON

APIs

___libm_error_support.LIBCMT ref: 0042FC43

Part of subcall function 00433718: DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00432653), ref: 00433734

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: DecodePointer___libm_error_support
String ID:
API String ID: 3413902329-0
Opcode ID: fe7d9b8eee1d273b37d623b7cc6cd26b30c9621dfee01b7311cae72a06f2c816
Instruction ID: bce05383f65911ef53e75d5f2b7ae8bd864113105c6f5f1cb0bb4096b20a0191
Opcode Fuzzy Hash: fe7d9b8eee1d273b37d623b7cc6cd26b30c9621dfee01b7311cae72a06f2c816
Instruction Fuzzy Hash: 9A325921E29F114DD7235634D832336A258AFB73C8F95D737F819B5EA6DB28D4834208

Uniqueness

Uniqueness Score: 1.05%

Function 00418A0E, Relevance: .6, Instructions: 608COMMON

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f66ab0580a314d221ab9376d4eb50f49803d2a8e394490c5a9382fd7f99d6c8
Instruction ID: 9a981ba99b4911944b9919f44c7759cb7337f05dfe0c326ced162c2a54403da9
Opcode Fuzzy Hash: 4f66ab0580a314d221ab9376d4eb50f49803d2a8e394490c5a9382fd7f99d6c8
Instruction Fuzzy Hash: 47222730505656CBDF288B18C4A46BF77A1EB41311F64446FE8468B392EB3C9DC6CBAD

Uniqueness

Uniqueness Score: 0.00%

Function 00422405, Relevance: .3, Instructions: 345COMMON

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 3a63805bb8c2c01de1b6144fc2d7500bdbb157a027ed3d5f9b560445ff49f309
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: C2C1C6323050B309DB2D8639A63013FBAE15EA27B139A076FE4B3CB6D4EF58D564D614

Uniqueness

Uniqueness Score: 0.00%

Function 0042283A, Relevance: .3, Instructions: 341COMMON

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: aaf8636ec1f05b4987ac2accbf93641bd6487308852fa21464a5fdbc51815f71
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 18C1B7323050B309DB2D8639A63413FBBE15EA27B139A076FE4B2DB6D4EF18D524D614

Uniqueness

Uniqueness Score: 0.00%

Function 00421FD0, Relevance: .3, Instructions: 331COMMON

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 352b80a13901650c5d1a9b37a84c8fb9e1ba645c1686a9e0a67cf8c2712344ee
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: DEC1B7323050B30ADF1D8639A63403FBAE15EA27B135A076FE4B2CB6D5EF58D524D624

Uniqueness

Uniqueness Score: 0.00%

Function 00421BB8, Relevance: .3, Instructions: 323COMMON

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: bd4c7480dd6a54fddd699a2b0be912f6d58b05d3aceaa853b4bc4e982cd790e2
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 3FC165363051A309DB2D863AA53403FBAE15EB27B135B076FE4B2CB6E4EF18D5249614

Uniqueness

Uniqueness Score: 0.00%

Function 0048A849, Relevance: 49.8, APIs: 33, Instructions: 274windowCOMMON

APIs

SetTextColor.GDI32(?,00000000), ref: 0048A89F
SetTextColor.GDI32(?,000000FF), ref: 0048A8BE
GetSysColorBrush.USER32(0000000F), ref: 0048A8D0
GetSysColor.USER32(0000000F), ref: 0048A8DC
CreateSolidBrush.GDI32(000000FF), ref: 0048A8E7
SetBkColor.GDI32(?,000000FF), ref: 0048A8F6
SelectObject.GDI32(?,?), ref: 0048A905
InflateRect.USER32(?,000000FF,000000FF), ref: 0048A930
GetSysColor.USER32(00000010), ref: 0048A938
CreateSolidBrush.GDI32(00000000), ref: 0048A93F
FrameRect.USER32(?,?,00000000), ref: 0048A94E
DeleteObject.GDI32(00000000), ref: 0048A955
InflateRect.USER32(?,000000FF,000000FF), ref: 0048A96D
DrawFrameControl.USER32(?,?,00000004,00000010), ref: 0048A97D
InflateRect.USER32(?,000000FE,000000FE), ref: 0048A9A0
InflateRect.USER32(?,000000FE,000000FE), ref: 0048A9BA
FillRect.USER32(?,?,?), ref: 0048A9D2
GetWindowLongW.USER32(?,000000F0), ref: 0048A9FD
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0048AA4E

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

GetWindowTextW.USER32(?,00000000,00000001), ref: 0048AA79
DrawTextW.USER32(?,?,000000FF,?,00000104), ref: 0048AA8C
GetSysColor.USER32(00000011), ref: 0048AAAF
SetTextColor.GDI32(?,00000000), ref: 0048AAB7
DrawTextW.USER32(?,?,000000FF,?,00000000), ref: 0048AACD
CreateSolidBrush.GDI32(00000000), ref: 0048AAE8
FrameRect.USER32(?,00000000,00000000), ref: 0048AAF7
DeleteObject.GDI32(00000000), ref: 0048AAFE
InflateRect.USER32(?,000000FC,000000FC), ref: 0048AB0D
DrawFocusRect.USER32(?,00000000), ref: 0048AB19
SelectObject.GDI32(?,?), ref: 0048AB2E
DeleteObject.GDI32(?), ref: 0048AB38
SetTextColor.GDI32(?,?), ref: 0048AB43
SetBkColor.GDI32(?,?), ref: 0048AB4E

Part of subcall function 0048AB60: GetSysColor.USER32(00000012), ref: 0048AB99
Part of subcall function 0048AB60: SetTextColor.GDI32(?,?), ref: 0048AB9D
Part of subcall function 0048AB60: GetSysColorBrush.USER32(0000000F), ref: 0048ABB3
Part of subcall function 0048AB60: GetSysColor.USER32(0000000F), ref: 0048ABBE
Part of subcall function 0048AB60: CreateSolidBrush.GDI32(?), ref: 0048ABC3
Part of subcall function 0048AB60: GetSysColor.USER32(00000011), ref: 0048ABDB
Part of subcall function 0048AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0048ABE9
Part of subcall function 0048AB60: SelectObject.GDI32(?,00000000), ref: 0048ABFA
Part of subcall function 0048AB60: SetBkColor.GDI32(?,00000000), ref: 0048AC03
Part of subcall function 0048AB60: SelectObject.GDI32(?,?), ref: 0048AC10
Part of subcall function 0048AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 0048AC2F
Part of subcall function 0048AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0048AC46
Part of subcall function 0048AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 0048AC5B
Part of subcall function 0048AB60: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0048ACA7
Part of subcall function 0048AB60: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0048ACCE
Part of subcall function 0048AB60: InflateRect.USER32(?,000000FD,000000FD), ref: 0048ACEC
Part of subcall function 0048AB60: DrawFocusRect.USER32(?,?), ref: 0048ACF7
Part of subcall function 0048AB60: GetSysColor.USER32(00000011), ref: 0048AD05
Part of subcall function 0048AB60: SetTextColor.GDI32(?,00000000), ref: 0048AD0D
Part of subcall function 0048AB60: DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0048AD21
Part of subcall function 0048AB60: SelectObject.GDI32(?,0048A869), ref: 0048AD38
Part of subcall function 0048AB60: DeleteObject.GDI32(?), ref: 0048AD43
Part of subcall function 0048AB60: SelectObject.GDI32(?,?), ref: 0048AD49
Part of subcall function 0048AB60: DeleteObject.GDI32(?), ref: 0048AD4E
Part of subcall function 0048AB60: SetTextColor.GDI32(?,?), ref: 0048AD54
Part of subcall function 0048AB60: SetBkColor.GDI32(?,?), ref: 0048AD5E

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Color$Rect$Text$Object$Inflate$BrushDrawSelect$CreateDelete$SolidWindow$Frame$FocusLongMessageSend$ControlException@8FillRoundThrowstd::exception::exception
String ID:
API String ID: 2948665181-0
Opcode ID: 76d3aff8c14f81946196c8a998a3575b65bbb248a9691f256eae4fa49a1bd179
Instruction ID: 452232081cd78e43451fe9d0edc745e4d0d3487f89d4aa1c860563aee330a7d3
Opcode Fuzzy Hash: 76d3aff8c14f81946196c8a998a3575b65bbb248a9691f256eae4fa49a1bd179
Instruction Fuzzy Hash: ACA17D72408301BFD710AF64DC08A6F7BA9FB89321F104E3EF962961A1D774D859CB56

Uniqueness

Uniqueness Score: 0.25%

Function 00402C18, Relevance: 46.0, APIs: 25, Strings: 1, Instructions: 488windowCOMMON

APIs

DestroyWindow.USER32 ref: 00402CA2
DeleteObject.GDI32(00000000), ref: 00402CE8
DeleteObject.GDI32(00000000), ref: 00402CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00402CFE
DestroyWindow.USER32(00000000), ref: 00402D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0043C68B

Part of subcall function 004025DB: GetWindowLongW.USER32(?,000000EB), ref: 004025EC

ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0043C6C4
SendMessageW.USER32(?,0000133D,?,?), ref: 0043C792

Part of subcall function 0048B958: ShowWindow.USER32(004C67B0,00000000), ref: 0048B9CC
Part of subcall function 0048B958: EnableWindow.USER32(00000000,00000000), ref: 0048B9F0
Part of subcall function 0048B958: ShowWindow.USER32(004C67B0,00000000), ref: 0048BA50
Part of subcall function 0048B958: ShowWindow.USER32(00000000,00000004), ref: 0048BA62
Part of subcall function 0048B958: EnableWindow.USER32(00000000,00000001), ref: 0048BA86
Part of subcall function 0048B958: SendMessageW.USER32(?,0000130C,?,00000000), ref: 0048BAA9

Part of subcall function 00402C18: MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0043CAED

DestroyWindow.USER32 ref: 0043C856
ImageList_Destroy.COMCTL32(00000000,?,?,?), ref: 0043C869
DestroyMenu.USER32(?), ref: 0043C8EB
DestroyMenu.USER32(?), ref: 0043C904
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0043C92F
_memset.LIBCMT ref: 0043C98C
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0043C9A7
DeleteMenu.USER32(?,?,00000000), ref: 0043CA00
DeleteMenu.USER32(?,?,00000000), ref: 0043CA16
GetMenuItemCount.USER32(?), ref: 0043CA2D
SetMenu.USER32(?,00000000), ref: 0043CA3A
DestroyMenu.USER32(?), ref: 0043CA46
DrawMenuBar.USER32(?), ref: 0043CA55
SendMessageW.USER32(?,00001101,00000000,?), ref: 0043CA6D
SendMessageW.USER32(?,00001053), ref: 0043CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0043CB41

Strings

0, xrefs: 0043C981

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$DestroyMenu$MessageSend$Delete$ImageList_Show$EnableItemObject$CountDrawIconInfoLongMoveRemove_memset
String ID: 0
API String ID: 1516704526-4108050209
Opcode ID: 6187f4c0bb388091fe11e685e7b7da9a09c521fa3c2b3010c7494aa3c4575cd4
Instruction ID: b7389f8fee4e5da017ea5760de9854557745ca7af685468a7280b0f07d881e75
Opcode Fuzzy Hash: 6187f4c0bb388091fe11e685e7b7da9a09c521fa3c2b3010c7494aa3c4575cd4
Instruction Fuzzy Hash: CD12C030604201EFDB14DF24C988BAAB7E1BF09314F54557EE885EB2A2C779EC42CB59

Uniqueness

Uniqueness Score: 5.06%

Function 00406A3C, Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

__wcsnicmp.LIBCMT ref: 00406A91

Part of subcall function 00423A0B: __wcsnicmp_l.LIBCMT ref: 00423AB4

__wcsnicmp.LIBCMT ref: 00406AA9
__wcsnicmp.LIBCMT ref: 00406AC1
__wcsnicmp.LIBCMT ref: 00406AD9
__wcsnicmp.LIBCMT ref: 00406AF1
__wcsnicmp.LIBCMT ref: 00406B09
__wcsnicmp.LIBCMT ref: 00406B21
__wcsnicmp.LIBCMT ref: 00406B35
__wcsnicmp.LIBCMT ref: 00406B76
__wcsnicmp.LIBCMT ref: 00406B8A
__wcsnicmp.LIBCMT ref: 00406B9E
__wcsnicmp.LIBCMT ref: 00406BB2

Part of subcall function 0041FEC6: _wcscpy.LIBCMT ref: 0041FEE9

Part of subcall function 0046000D: _wcscpy.LIBCMT ref: 00460152

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

Part of subcall function 00406BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00406D0D
Part of subcall function 00406BEC: SetCurrentDirectoryW.KERNEL32(?), ref: 00406E5A
Part of subcall function 00406BEC: _free.LIBCMT ref: 0043EB9C
Part of subcall function 00406BEC: _free.LIBCMT ref: 0043EBE2

Part of subcall function 0045FCB1: GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0043E6C9,00000010,?,Bad directive syntax error,0048F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0045FCD2
Part of subcall function 0045FCB1: LoadStringW.USER32(00000000,?,0043E6C9,00000010), ref: 0045FCD9
Part of subcall function 0045FCB1: _wprintf.LIBCMT ref: 0045FD0C
Part of subcall function 0045FCB1: MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0045FD9D

Part of subcall function 004059CD: _wcscpy.LIBCMT ref: 00405A05

Strings

#OnAutoItStartRegister, xrefs: 00406AD3
#include-once, xrefs: 00406AEB
Cannot parse #include, xrefs: 0043E819
#include, xrefs: 00406B03
Unterminated group of comments, xrefs: 0043E82C
#notrayicon, xrefs: 00406AA3
#ce, xrefs: 00406BAC
#comments-end, xrefs: 00406B98
#cs, xrefs: 00406B2F, 00406B84
Bad directive syntax error, xrefs: 0043E743
#requireadmin, xrefs: 00406ABB
#comments-start, xrefs: 00406B1B, 00406B70
#pragma compile, xrefs: 00406A8B

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: __wcsnicmp$_wcscpy$CurrentDirectory_free$Exception@8HandleLoadMessageModuleStringThrow__wcsnicmp_l_memmove_wprintfstd::exception::exception
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1646735393-86951937
Opcode ID: da2fcaf9ef5c9a10b3db8a2e7ba8459d79afd212a10ec52453b0bee91e935911
Instruction ID: 8187de94c8bffb5aa90f003ee6c2c3bd34f27edaa7f64cb26bdd9306e81e5eb5
Opcode Fuzzy Hash: da2fcaf9ef5c9a10b3db8a2e7ba8459d79afd212a10ec52453b0bee91e935911
Instruction Fuzzy Hash: B381F8B0741215A6CB20BB22DD82FAF7768AF15304F14403BF946BA1C1E77CEA55C65D

Uniqueness

Uniqueness Score: 2.20%

Function 0048AB60, Relevance: 39.2, APIs: 26, Instructions: 205windowCOMMON

APIs

GetSysColor.USER32(00000012), ref: 0048AB99
SetTextColor.GDI32(?,?), ref: 0048AB9D
GetSysColorBrush.USER32(0000000F), ref: 0048ABB3
GetSysColor.USER32(0000000F), ref: 0048ABBE
CreateSolidBrush.GDI32(?), ref: 0048ABC3
GetSysColor.USER32(00000011), ref: 0048ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0048ABE9
SelectObject.GDI32(?,00000000), ref: 0048ABFA
SetBkColor.GDI32(?,00000000), ref: 0048AC03
SelectObject.GDI32(?,?), ref: 0048AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 0048AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0048AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 0048AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0048ACA7

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0048ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 0048ACEC
DrawFocusRect.USER32(?,?), ref: 0048ACF7
GetSysColor.USER32(00000011), ref: 0048AD05
SetTextColor.GDI32(?,00000000), ref: 0048AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0048AD21
SelectObject.GDI32(?,0048A869), ref: 0048AD38
DeleteObject.GDI32(?), ref: 0048AD43
SelectObject.GDI32(?,?), ref: 0048AD49
DeleteObject.GDI32(?), ref: 0048AD4E
SetTextColor.GDI32(?,?), ref: 0048AD54
SetBkColor.GDI32(?,?), ref: 0048AD5E

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$Exception@8FocusLongMessageRoundSendSolidThrowstd::exception::exception
String ID:
API String ID: 1165068691-0
Opcode ID: ca33d3042f408dd9160401dbc04af8b562fa4e5f3182410edd60d99307db504b
Instruction ID: a0d8ef5a968e449155e436a7069eb707e167a0f70bd7a905c438ca864edfdcef
Opcode Fuzzy Hash: ca33d3042f408dd9160401dbc04af8b562fa4e5f3182410edd60d99307db504b
Instruction Fuzzy Hash: 6C617471900218BFEF11DFA4DC48EAE7B79EF08320F244926F911AB2A1D7B59D50DB54

Uniqueness

Uniqueness Score: 0.24%

Function 004027D9, Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004028BC
GetSystemMetrics.USER32(00000007), ref: 004028C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004028EF
GetSystemMetrics.USER32(00000008), ref: 004028F7
GetSystemMetrics.USER32(00000004), ref: 0040291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00402939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00402949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0040297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00402990
GetClientRect.USER32(00000000,000000FF), ref: 004029AE
GetStockObject.GDI32(00000011), ref: 004029CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 004029D5

Part of subcall function 00402344: GetCursorPos.USER32(?), ref: 00402357
Part of subcall function 00402344: ScreenToClient.USER32(004C67B0,?), ref: 00402374
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000001), ref: 00402399
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000002), ref: 004023A7
Part of subcall function 00402344: GetWindowLongW.USER32(?,000000F0), ref: 0043C23A

SetTimer.USER32(00000000,00000000,00000028,Function_00001256), ref: 004029FC

Part of subcall function 0048B00F: DestroyWindow.USER32(?), ref: 0048B04A

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

GetWindowRect.USER32(?,?), ref: 0043C39C
GetClientRect.USER32(?,?), ref: 0043C3A9
GetSystemMetrics.USER32(00000007), ref: 0043C3B1
GetSystemMetrics.USER32(00000008), ref: 0043C3C4
GetSystemMetrics.USER32(00000004), ref: 0043C3E9

Part of subcall function 00402A5B: ShowWindow.USER32(FFFFFFFF,?), ref: 00402ACF
Part of subcall function 00402A5B: ShowWindow.USER32(FFFFFFFF,00000000), ref: 00402B17
Part of subcall function 00402A5B: ShowWindow.USER32(FFFFFFFF,00000006), ref: 0043C46A
Part of subcall function 00402A5B: LockWindowUpdate.USER32(00000000), ref: 0043C492
Part of subcall function 00402A5B: InvalidateRect.USER32(00000000,00000000,00000001), ref: 0043C49E
Part of subcall function 00402A5B: LockWindowUpdate.USER32(FFFFFFFF), ref: 0043C4AE
Part of subcall function 00402A5B: EnableWindow.USER32(FFFFFFFF,00000001), ref: 0043C4BF
Part of subcall function 00402A5B: ShowWindow.USER32(FFFFFFFF,?), ref: 0043C4D6

Part of subcall function 004034C2: _memmove.LIBCMT ref: 0043D28C

Strings

AutoIt v3 GUI, xrefs: 00402974
athan, xrefs: 00402855

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$System$MetricsRect$Show$ClientLong$AsyncInfoLockParametersStateUpdate$AdjustCreateCursorDestroyEnableException@8InvalidateMessageObjectScreenSendStockThrowTimer_memmovestd::exception::exception
String ID: AutoIt v3 GUI$athan
API String ID: 3027708390-1045250848
Opcode ID: bb1922fa0d3274e5e5d9c46e7996511c92627301f57afafe0139ac51e934f35e
Instruction ID: 34a51bb5a318ae1a344add4034b802b2dd09297663e35ec0c622bb09f95dc302
Opcode Fuzzy Hash: bb1922fa0d3274e5e5d9c46e7996511c92627301f57afafe0139ac51e934f35e
Instruction Fuzzy Hash: 21B18275600205AFDB14DF68DD89BAE7BB4FB08314F10863AFA15A72D0DB78A851CF58

Uniqueness

Uniqueness Score: 1.69%

Function 00415F88, Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 350UNIQUE

APIs

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

GetForegroundWindow.USER32 ref: 00416042

Part of subcall function 004034C2: _memmove.LIBCMT ref: 0043D28C

Part of subcall function 0045B1E0: __wcsnicmp.LIBCMT ref: 0045B23F
Part of subcall function 0045B1E0: __wcsnicmp.LIBCMT ref: 0045B25B
Part of subcall function 0045B1E0: __wcsnicmp.LIBCMT ref: 0045B283

EnumChildWindows.USER32(00000000), ref: 004510D1

Part of subcall function 0045A3E6: CharUpperBuffW.USER32(?,00000001), ref: 0045A470

IsWindow.USER32(?), ref: 00450FFA
GetForegroundWindow.USER32 ref: 0045100E
CharUpperBuffW.USER32(?,?), ref: 004510A2
EnumWindows.USER32(0045B397,?), ref: 004510D9

Part of subcall function 00407FAF: _memmove.LIBCMT ref: 00408003

CharUpperBuffW.USER32(?,?), ref: 004510BD
GetDesktopWindow.USER32 ref: 004510CA

Strings

TITLE, xrefs: 00450F8F
CLASS, xrefs: 00450E24
REGEXPCLASS, xrefs: 00450E45
INSTANCE, xrefs: 00450F39
LAST, xrefs: 00450DB1
ACTIVE, xrefs: 00450DC7
%I, xrefs: 00415F93
ALL, xrefs: 00450F61
HANDLE, xrefs: 00450DDD
REGEXPTITLE, xrefs: 00450DF3

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$BuffCharUpper__wcsnicmp_memmove$EnumForegroundWindows$ChildDesktop
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE$%I
API String ID: 1617993030-1162635239
Opcode ID: 7afad609ab36abd7c166971e199184ce53bd6c78a1c8726f8686002e5627edb1
Instruction ID: b47751c77230b49a93ab5999e00c69dfd5d66f05824f9e1bf1f711ef4991895b
Opcode Fuzzy Hash: 7afad609ab36abd7c166971e199184ce53bd6c78a1c8726f8686002e5627edb1
Instruction Fuzzy Hash: 6CD10C31104602EFCB14EF11C441A9ABBA0BF54349F104A2FF855576A3CB7CE99ECB9A

Uniqueness

Uniqueness Score: 100.00%

Function 0045B1E0, Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

APIs

__wcsnicmp.LIBCMT ref: 0045B23F

Part of subcall function 00423A0B: __wcsnicmp_l.LIBCMT ref: 00423AB4

__wcsnicmp.LIBCMT ref: 0045B25B
__wcsnicmp.LIBCMT ref: 0045B283

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

Part of subcall function 0042313D: __wcsicmp_l.LIBCMT ref: 004231C6

Strings

[ALL, xrefs: 0045B2E5
REGEXP=, xrefs: 0045B254
HANDLE=, xrefs: 0045B238
[REGEXPTITLE:, xrefs: 0045B267
[ACTIVE, xrefs: 0045B22C
LAST, xrefs: 0045B204
ACTIVE, xrefs: 0045B21A
[LAST, xrefs: 0045B2EC
[HANDLE:, xrefs: 0045B24B
ALL, xrefs: 0045B2D3
[CLASS:, xrefs: 0045B28F
CLASSNAME=, xrefs: 0045B27C

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: __wcsnicmp$_memmove$__wcsicmp_l__wcsnicmp_l
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 4253603199-1810252412
Opcode ID: 0b693f046f3cbb4e9986c71513b34e1c2095760d41905b3713bfb5f333990725
Instruction ID: 0a4734ff45ec4583e3e81acf795fc21f567cbd392f16838e952200b8ee8254f0
Opcode Fuzzy Hash: 0b693f046f3cbb4e9986c71513b34e1c2095760d41905b3713bfb5f333990725
Instruction Fuzzy Hash: B5318B30A04205A6DB14EA62CD43BEE77A4DF24756F60006FB941720D2EF6D6E09C9AE

Uniqueness

Uniqueness Score: 2.28%

Function 0048C8EE, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileUNIQUE

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

DragQueryPoint.SHELL32(?,?), ref: 0048C917

Part of subcall function 0048ADF1: ClientToScreen.USER32(?,?), ref: 0048AE1A
Part of subcall function 0048ADF1: GetWindowRect.USER32(?,?), ref: 0048AE90
Part of subcall function 0048ADF1: PtInRect.USER32(?,?,?), ref: 0048AEA0
Part of subcall function 0048ADF1: MessageBeep.USER32(00000000), ref: 0048AF11

SendMessageW.USER32(?,000000B0,?,?), ref: 0048C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0048C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0048C9AE
_wcscat.LIBCMT ref: 0048C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0048C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 0048CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 0048CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 0048CA47
DragFinish.SHELL32(?), ref: 0048CA4E

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

DefDlgProcW.USER32(?,00000233,?,00000000), ref: 0048CB41

Strings

@GUI_DRAGID, xrefs: 0048CAB9
@GUI_DROPID, xrefs: 0048CA6E
@GUI_DRAGFILE, xrefs: 0048CAF0

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Send$Drag$Query$FileRectWindow$BeepClientFinishLongPointProcScreen_memmove_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2215142556-3440237614
Opcode ID: 94eb9f17866416fc7e10bf29e2b941fb84a0329db1260e751546af4c74d11337
Instruction ID: 9d54b60ae23129ec17e3264f3c4c669362dbaaf1ee08fbcc713ae4d442fb7e93
Opcode Fuzzy Hash: 94eb9f17866416fc7e10bf29e2b941fb84a0329db1260e751546af4c74d11337
Instruction Fuzzy Hash: B6617F71108301AFC701EF65DC85D9FBBF8EF88714F500A2EF591A21A1DB749A49CB6A

Uniqueness

Uniqueness Score: 100.00%

Function 0048BAB8, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 198windowlibraryUNIQUE

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0048BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00486D80,?), ref: 0048BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0048BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0048BC46
FreeLibrary.KERNEL32(?), ref: 0048BC89

Part of subcall function 00409997: __itow.LIBCMT ref: 004099C2
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9B1
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9DD
Part of subcall function 00409997: __i64tow.LIBCMT ref: 0043FA0F

LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0048BC7D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0048BC99
DestroyIcon.USER32(?), ref: 0048BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0048BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0048BCD1

Part of subcall function 0042313D: __wcsicmp_l.LIBCMT ref: 004231C6

Strings

.exe, xrefs: 0048BB04
.dll, xrefs: 0048BB27
.icl, xrefs: 0048BAE4

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend_wcscpy$DestroyExtractFree__i64tow__itow__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 4220660294-1154884017
Opcode ID: 6f4018506f42393adc083cbdf86df128419452e7279bc71467a7f069fee2e887
Instruction ID: 5a3b5a0298842a06514a7b2b5c33ff8de858cebeb355adee2c65811140294771
Opcode Fuzzy Hash: 6f4018506f42393adc083cbdf86df128419452e7279bc71467a7f069fee2e887
Instruction Fuzzy Hash: 3461EF71600219BEEB14EF64CC45BBF77A8EB08711F10492FF815D61C0DBB8A994DBA8

Uniqueness

Uniqueness Score: 100.00%

Function 0048BCED, Relevance: 22.6, APIs: 15, Instructions: 130filememorywindowCOMMON

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0048BD10
GetFileSize.KERNEL32(00000000,00000000), ref: 0048BD27
GlobalAlloc.KERNEL32(00000002,00000000), ref: 0048BD32
CloseHandle.KERNEL32(00000000), ref: 0048BD3F
GlobalLock.KERNEL32(00000000), ref: 0048BD48
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0048BD57
GlobalUnlock.KERNEL32(00000000), ref: 0048BD60
CloseHandle.KERNEL32(00000000), ref: 0048BD67
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0048BD78
#418.OLEAUT32(?,00000000,00000000,00492CAC,?), ref: 0048BD91
GlobalFree.KERNEL32(00000000), ref: 0048BDA1
GetObjectW.GDI32(?,00000018,000000FF), ref: 0048BDC5
CopyImage.USER32(?,00000000,?,?,00002000), ref: 0048BDF0
DeleteObject.GDI32(00000000), ref: 0048BE18
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0048BE2E

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$#418AllocCopyDeleteFreeImageLockMessageReadSendSizeStreamUnlock
String ID:
API String ID: 2779716855-0
Opcode ID: 2ef3c73d0ecf62ea383054c8459600fe69dcae0fa81eb6f10a909750517e530a
Instruction ID: 591bd05ee601cdb4eeeaba152367ddfaf644c5d0e7d28595dd03dcf49ad8e52e
Opcode Fuzzy Hash: 2ef3c73d0ecf62ea383054c8459600fe69dcae0fa81eb6f10a909750517e530a
Instruction Fuzzy Hash: 36413675600208BFDB21AF65DC88EAFBBB8FB89711F204869F905DB260D7359D05CB64

Uniqueness

Uniqueness Score: 2.12%

Function 00467FA4, Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 378COMMON

APIs

#8.OLEAUT32(00000000,00000000,?,?,?,?,?,?,0000002A,00000000,0048F910), ref: 00467FE9
#10.OLEAUT32(00000000,?,?,?,?,?,?,0000002A,00000000,0048F910), ref: 00467FF2
#9.OLEAUT32(00000000,?,?,?,?,?,0000002A,00000000,0048F910), ref: 00467FFE
#185.OLEAUT32(?,?,?,?,0000002A,00000000,0048F910), ref: 004680EC
#220.OLEAUT32(?,?,?,?,?,00000029,00000000,Default), ref: 00468148

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

#8.OLEAUT32(?,?,00000000,00000000), ref: 004681F9

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

#6.OLEAUT32(00000016,00000016), ref: 0046828D
#9.OLEAUT32(?), ref: 004682E7
#9.OLEAUT32(?), ref: 004682F6
#8.OLEAUT32(00000000,00000000,?,00000000,00000000), ref: 00468334

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Part of subcall function 00467804: #8.OLEAUT32(00000000,?,?,00000016,00000016,?,004799E9,?,?), ref: 00467844
Part of subcall function 00467804: #10.OLEAUT32(00000000,?,?,004799E9,?,?), ref: 0046784D
Part of subcall function 00467804: #9.OLEAUT32(00000000,?,004799E9,?,?), ref: 00467859

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00468116
Default, xrefs: 004681A9

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$#185#220Exception@8Throwstd::exception::exception
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 468446875-3931177956
Opcode ID: 0a78f8544e829205d4617bc1d2a12d163966e155d0a9664df5021d7ae6b6d03c
Instruction ID: 2682ed8c0086b85f7f7a5589b892ebf4bccd9fa06ddd6521cb48c12ef20c28d5
Opcode Fuzzy Hash: 0a78f8544e829205d4617bc1d2a12d163966e155d0a9664df5021d7ae6b6d03c
Instruction Fuzzy Hash: 30D1E330600515DBCB109F66C844B6AB7B4BF04704F158A6FE405AB2C1EF7DAC49EB6B

Uniqueness

Uniqueness Score: 1.97%

Function 0048C49C, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0048C4EC
GetFocus.USER32 ref: 0048C4FC
GetDlgCtrlID.USER32(00000000), ref: 0048C507

Part of subcall function 00487F4C: GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00487FBA

Part of subcall function 004025DB: GetWindowLongW.USER32(?,000000EB), ref: 004025EC

_memset.LIBCMT ref: 0048C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0048C65D
GetMenuItemCount.USER32(?), ref: 0048C67D
GetMenuItemID.USER32(?,00000000), ref: 0048C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0048C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0048C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0048C744

Part of subcall function 0048B60B: IsWindow.USER32(00BD7938), ref: 0048B6A5
Part of subcall function 0048B60B: IsWindowEnabled.USER32(00BD7938), ref: 0048B6B1
Part of subcall function 0048B60B: SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0048B795
Part of subcall function 0048B60B: SendMessageW.USER32(00BD7938,000000B0,?,?), ref: 0048B7CC
Part of subcall function 0048B60B: IsDlgButtonChecked.USER32(?,?), ref: 0048B809
Part of subcall function 0048B60B: GetWindowLongW.USER32(00BD7938,000000EC), ref: 0048B82B
Part of subcall function 0048B60B: SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0048B843

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

DefDlgProcW.USER32(?,00000111,?,?), ref: 0048C779

Strings

0, xrefs: 0048C62A

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ItemMenu$Window$InfoMessage$LongSend$ButtonCheckCheckedCountCtrlEnabledException@8FocusPostProcRadioThrow_memsetstd::exception::exception
String ID: 0
API String ID: 1009432489-4108050209
Opcode ID: 6e4babffeceb8185fb6d284ceddc02dc4617a901228f81de5884e36d82c1771c
Instruction ID: 044de7e4dd35a86088de80346c1f5ac2e8e2e031d82544e17b68ab28cbecaa44
Opcode Fuzzy Hash: 6e4babffeceb8185fb6d284ceddc02dc4617a901228f81de5884e36d82c1771c
Instruction Fuzzy Hash: A1818E70608311AFDB10EF15C984A6FBBE8FB88314F104D2EF995A3291D774D905CBAA

Uniqueness

Uniqueness Score: 2.28%

Function 00406BEC, Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

APIs

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00406D0D

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Part of subcall function 004059CD: _wcscpy.LIBCMT ref: 00405A05

Part of subcall function 0040702C: __wcsnicmp.LIBCMT ref: 0040709D

Part of subcall function 0042387D: _iswctype.LIBCMT ref: 00423885

Part of subcall function 00405DCF: CloseHandle.KERNEL32(?), ref: 00405DEF

SetCurrentDirectoryW.KERNEL32(?), ref: 00406E5A

Part of subcall function 0045FCB1: GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0043E6C9,00000010,?,Bad directive syntax error,0048F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0045FCD2
Part of subcall function 0045FCB1: LoadStringW.USER32(00000000,?,0043E6C9,00000010), ref: 0045FCD9
Part of subcall function 0045FCB1: _wprintf.LIBCMT ref: 0045FD0C
Part of subcall function 0045FCB1: MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0045FD9D

Part of subcall function 00420B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00406C6C,?,00008000), ref: 00420BB7

Part of subcall function 004048AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004048A1,?,?,?,004072BA,?,?,?,?,0040108C), ref: 004048CE

Part of subcall function 00405C4E: SetFilePointerEx.KERNEL32(?,?,00000001,00000000,00000000), ref: 00405CF6

Part of subcall function 00404FAA: FreeLibrary.KERNEL32(?,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404FDE

Part of subcall function 0040766F: _memmove.LIBCMT ref: 0040774A

_free.LIBCMT ref: 0043EBE2

Part of subcall function 0045FC4D: _memmove.LIBCMT ref: 0045FC88

Part of subcall function 0045FB6E: __wcsnicmp.LIBCMT ref: 0045FB81
Part of subcall function 0045FB6E: __wcsnicmp.LIBCMT ref: 0045FBA2
Part of subcall function 0045FB6E: __wcsnicmp.LIBCMT ref: 0045FBBC

Part of subcall function 00406999: _wcscmp.LIBCMT ref: 004069AC

Part of subcall function 0046F835: _memmove.LIBCMT ref: 0046F880

_free.LIBCMT ref: 0043EB9C

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

Part of subcall function 0045FB07: _wcscpy.LIBCMT ref: 0045FB48
Part of subcall function 0045FB07: _wcscat.LIBCMT ref: 0045FB51

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406A91
Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406AA9
Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406AC1
Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406AD9
Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406AF1
Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406B09
Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406B21
Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406B35
Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406B76
Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406B8A
Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406B9E
Part of subcall function 00406A3C: __wcsnicmp.LIBCMT ref: 00406BB2

Part of subcall function 00404F3D: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404F6F

Strings

AU3!, xrefs: 00406CC1
Unterminated string, xrefs: 0043EC0D
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0043E84A
Error opening the file, xrefs: 0043E866, 0043E8E1
EA06, xrefs: 0043E87B
>>>AUTOIT SCRIPT<<<, xrefs: 0043E8BF
Bad directive syntax error, xrefs: 0043EBC6

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: __wcsnicmp$_memmove$CurrentDirectory$FreeHandleLibraryLoad_free_wcscpy$CloseErrorException@8FileFullHeapLastMessageModuleNamePathPointerStringThrow_iswctype_wcscat_wcscmp_wprintfstd::exception::exception
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2446333622-1018226102
Opcode ID: 355b1d916c433aeffe1f2f205a05650c4ee4ade670bc33693f804ee041f9fd3d
Instruction ID: 1e1e50465060d2d049cdecd8729963b67a53d0d5fc41c37d224936f91734444f
Opcode Fuzzy Hash: 355b1d916c433aeffe1f2f205a05650c4ee4ade670bc33693f804ee041f9fd3d
Instruction Fuzzy Hash: DB0272705083419FC714EF25C8419AFBBE5AF98318F14492EF486A72A1DB38D949CB5B

Uniqueness

Uniqueness Score: 5.06%

Function 004045DF, Relevance: 19.7, APIs: 13, Instructions: 217windowCOMMON

APIs

_memset.LIBCMT ref: 004045F9
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 0043D750
GetMenuItemCount.USER32(004C6890), ref: 0043D7CD

Part of subcall function 004626F9: _memset.LIBCMT ref: 00462747
Part of subcall function 004626F9: GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00462792
Part of subcall function 004626F9: IsMenu.USER32(00000000), ref: 004627B2
Part of subcall function 004626F9: CreatePopupMenu.USER32 ref: 004627E6
Part of subcall function 004626F9: GetMenuItemCount.USER32(000000FF), ref: 00462844
Part of subcall function 004626F9: InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00462875

DeleteMenu.USER32(004C6890,00000005,00000000), ref: 0043D85D
DeleteMenu.USER32(004C6890,00000004,00000000), ref: 0043D865
DeleteMenu.USER32(004C6890,00000006,00000000), ref: 0043D86D
DeleteMenu.USER32(004C6890,00000003,00000000), ref: 0043D875
GetMenuItemCount.USER32(004C6890), ref: 0043D87D
SetMenuItemInfoW.USER32(004C6890,00000004,00000000,00000030), ref: 0043D8B7
GetCursorPos.USER32(?), ref: 0043D8C1
SetForegroundWindow.USER32(00000000), ref: 0043D8CA
TrackPopupMenuEx.USER32(004C6890,00000000,?,00000000,00000000,00000000), ref: 0043D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0043D8E9

Part of subcall function 0040410D: _memset.LIBCMT ref: 0040418D
Part of subcall function 0040410D: _wcscpy.LIBCMT ref: 004041E1
Part of subcall function 0040410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 004041F1
Part of subcall function 0040410D: LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0043D5EC

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Menu$Item$Delete$CountInfo_memset$Popup$CreateCursorForegroundIconInsertLoadMessageNotifyPostShell_StringTrackWindow_wcscpy
String ID:
API String ID: 3665929494-0
Opcode ID: e597ca9b44f071e22430df5e07161a6b1da801a0e098349f580a2e7d56667eca
Instruction ID: 2639a210842817a24e8eb206f5a4e9758f878a2c8cdeb628821b1e41afb81110
Opcode Fuzzy Hash: e597ca9b44f071e22430df5e07161a6b1da801a0e098349f580a2e7d56667eca
Instruction Fuzzy Hash: 14713970A40205BEEB209F15EC45FABBF65FF49368F200227F625662D1C7B96C10DB99

Uniqueness

Uniqueness Score: 2.48%

Function 0045E558, Relevance: 19.7, APIs: 10, Strings: 1, Instructions: 404COMMON

APIs

#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?), ref: 0045E9D0

Part of subcall function 0045F2CC: #10.OLEAUT32(?,?,?,?,?,0045E5CC,?,?,?,?,?,?,?,?,?,?), ref: 0045F2D9
Part of subcall function 0045F2CC: #12.OLEAUT32(?,?,00000000,?,?,?,0045E5CC,?,?,?,?,?,?,?,?), ref: 0045F322

#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E643

Part of subcall function 0045F583: #9.OLEAUT32(?,?,?,?,?,?,0045E5F6,?,?,?,?,?,?,?,?,?), ref: 0045F595

Part of subcall function 0045F279: #7.OLEAUT32(?,?,?,?,?,0045E61E,?,?,?,?,?,?,?,?,?), ref: 0045F286
Part of subcall function 0045F279: lstrcpyW.KERNEL32(00000000,?), ref: 0045F2B7

#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E621

Part of subcall function 0045F3DD: #8.OLEAUT32(?,?,?), ref: 0045F3F7
Part of subcall function 0045F3DD: #9.OLEAUT32(00000013,?,?), ref: 0045F469
Part of subcall function 0045F3DD: #9.OLEAUT32(00000000,?,?), ref: 0045F4C4
Part of subcall function 0045F3DD: _memmove.LIBCMT ref: 0045F4EE
Part of subcall function 0045F3DD: #9.OLEAUT32(?,?,?), ref: 0045F53B
Part of subcall function 0045F3DD: #12.OLEAUT32(?,?,00000000,00000013,?,?), ref: 0045F569

Part of subcall function 0045E187: #9.OLEAUT32(?,?,?,?,?,0045E6A4,?,?,?,?,?,?,?,?), ref: 0045E198

Part of subcall function 0045F0F4: CLSIDFromString.OLE32(?,00000000), ref: 0045F116
Part of subcall function 0045F0F4: #8.OLEAUT32(00000008,00000000,?,?), ref: 0045F127
Part of subcall function 0045F0F4: #9.OLEAUT32(00000008), ref: 0045F176

Part of subcall function 0045F20E: _memmove.LIBCMT ref: 0045F233

Part of subcall function 0045F1C7: #7.OLEAUT32(?,00000000,?,?,?,0045E71C,?,?,?,?,?,?,?,?,?,?), ref: 0045F1D4
Part of subcall function 0045F1C7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001,00000000,00000000,?,0045E71C,?,?,?,?,?,?), ref: 0045F1FF

Part of subcall function 0045F244: #8.OLEAUT32(00000000,00000000,?,?,0045E72B,?,?,?,?,?,?,?,?,?,?), ref: 0045F254
Part of subcall function 0045F244: #10.OLEAUT32(00000000,?,?,0045E72B,?,?,?,?,?,?,?,?,?,?), ref: 0045F25F

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?), ref: 0045E75F
#8.OLEAUT32(?,?,?,?,?,?,?,?,?,?), ref: 0045E7C2
#146.OLEAUT32(00000008,?,?,00000015,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E828
#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?), ref: 0045E83A
#10.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?), ref: 0045E8A6

Part of subcall function 0045F34A: #11.OLEAUT32(?,?,00000000,?,00000000,?,0045E915,?,?,?,?,?,?,?,?), ref: 0045F374
Part of subcall function 0045F34A: #9.OLEAUT32(?,?,0045E915,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045F38B
Part of subcall function 0045F34A: #9.OLEAUT32(?,00000000,?,00000000,?,0045E915,?,?,?,?,?,?,?,?,?,?), ref: 0045F3C1

#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E931
#9.OLEAUT32(?,?,?,?,?,?,?,?,?,?), ref: 0045E94A

Part of subcall function 0045DFDC: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,?,00000000), ref: 0045E01F
Part of subcall function 0045DFDC: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0045E045
Part of subcall function 0045DFDC: #2.OLEAUT32(00000000), ref: 0045E048
Part of subcall function 0045DFDC: #2.OLEAUT32(?,00000000,?,00000000), ref: 0045E066
Part of subcall function 0045DFDC: #6.OLEAUT32(?), ref: 0045E06F
Part of subcall function 0045DFDC: StringFromGUID2.OLE32(?,?,00000028), ref: 0045E094
Part of subcall function 0045DFDC: #2.OLEAUT32(?), ref: 0045E0A2

Strings

$@, xrefs: 0045E5A3

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ByteCharMultiWide$FromString_memmove$#146Exception@8Throwlstrcpystd::exception::exception
String ID: $@
API String ID: 1954046481-3337466569
Opcode ID: dd4399f0ae6af411d1303c1880c68a7317eae0cc99e5ad3642dcfdb93d537894
Instruction ID: 2367215a764623180a7b7ccf3c946de02fa337b23223ba35a6fad57feaa93611
Opcode Fuzzy Hash: dd4399f0ae6af411d1303c1880c68a7317eae0cc99e5ad3642dcfdb93d537894
Instruction Fuzzy Hash: E5E1EFB5504311ABD724DF1AC884A2BBBE4FF88755F40482EF985D7362C238E949CB5A

Uniqueness

Uniqueness Score: 7.75%

Function 0046A0B5, Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 157windowUNIQUE

APIs

LoadStringW.USER32(00000066,?,00000FFF,%I), ref: 0046A0FC

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 0046A11E
MessageBoxW.USER32(?,?,00011010,?), ref: 0046A27F

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Part of subcall function 00407E8C: _memmove.LIBCMT ref: 00407ED5

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

_wprintf.LIBCMT ref: 0046A246
_wprintf.LIBCMT ref: 0046A264

Part of subcall function 00423ECA: __stbuf.LIBCMT ref: 00423F1A
Part of subcall function 00423ECA: __ftbuf.LIBCMT ref: 00423F47

Strings

Error: , xrefs: 0046A20E
"%s" (%d) : ==> %s:, xrefs: 0046A25F
Line %d (File "%s"):, xrefs: 0046A171, 0046A18A
^ ERROR, xrefs: 0046A1E8
"%s" (%d) : ==> %s:%s%s, xrefs: 0046A241
%I, xrefs: 0046A0CB

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$LoadString_wprintf$Message__ftbuf__stbuf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR$%I
API String ID: 3548575722-1791166345
Opcode ID: 283c65b10acbc9e3ea08904c3a64b0f1d6e2d46486382073d7cdbef1976017cc
Instruction ID: 5eca713841166c9be329d5f9fa950bc6c7814f67f077d1cebb18d641bd9ae8df
Opcode Fuzzy Hash: 283c65b10acbc9e3ea08904c3a64b0f1d6e2d46486382073d7cdbef1976017cc
Instruction Fuzzy Hash: 70516171940509AACF15EBA1CD42EEEB779AF04304F1041AAF50572191EB396F58CFAA

Uniqueness

Uniqueness Score: 100.00%

Function 00469EA3, Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 151windowUNIQUE

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00469EEA

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00469F0B

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

_wprintf.LIBCMT ref: 0046A024
_wprintf.LIBCMT ref: 0046A042

Part of subcall function 00423ECA: __stbuf.LIBCMT ref: 00423F1A
Part of subcall function 00423ECA: __ftbuf.LIBCMT ref: 00423F47

MessageBoxW.USER32(?,?,00011010,?), ref: 0046A05D

Strings

Error: , xrefs: 00469FEC
Incorrect parameters to object property !, xrefs: 00469FC6
"%s" (%d) : ==> %s:, xrefs: 0046A03D
Line %d (File "%s"):, xrefs: 00469F5E, 00469F77
^ ERROR , xrefs: 00469FB9
"%s" (%d) : ==> %s:%s%s, xrefs: 0046A01F

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$LoadString_wprintf$Message__ftbuf__stbuf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 3548575722-3080491070
Opcode ID: 5da25fc7b66a9eb9b6242e597a6d6382651ec39f2b65f9cad663c5771dcfbff7
Instruction ID: 76274d9797fa1b0a96375c9153502d123c4c41548c028f67242602cb02bcdabd
Opcode Fuzzy Hash: 5da25fc7b66a9eb9b6242e597a6d6382651ec39f2b65f9cad663c5771dcfbff7
Instruction Fuzzy Hash: CE515371900609AADF15EBE1CD42EEEB779AF08304F10016BB50572191EB396F59CFAA

Uniqueness

Uniqueness Score: 100.00%

Function 0048772A, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

Part of subcall function 0048BCED: CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0048BD10
Part of subcall function 0048BCED: GetFileSize.KERNEL32(00000000,00000000), ref: 0048BD27
Part of subcall function 0048BCED: GlobalAlloc.KERNEL32(00000002,00000000), ref: 0048BD32
Part of subcall function 0048BCED: CloseHandle.KERNEL32(00000000), ref: 0048BD3F
Part of subcall function 0048BCED: GlobalLock.KERNEL32(00000000), ref: 0048BD48
Part of subcall function 0048BCED: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0048BD57
Part of subcall function 0048BCED: GlobalUnlock.KERNEL32(00000000), ref: 0048BD60
Part of subcall function 0048BCED: CloseHandle.KERNEL32(00000000), ref: 0048BD67
Part of subcall function 0048BCED: CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0048BD78
Part of subcall function 0048BCED: #418.OLEAUT32(?,00000000,00000000,00492CAC,?), ref: 0048BD91
Part of subcall function 0048BCED: GlobalFree.KERNEL32(00000000), ref: 0048BDA1
Part of subcall function 0048BCED: GetObjectW.GDI32(?,00000018,000000FF), ref: 0048BDC5
Part of subcall function 0048BCED: CopyImage.USER32(?,00000000,?,?,00002000), ref: 0048BDF0
Part of subcall function 0048BCED: DeleteObject.GDI32(00000000), ref: 0048BE18
Part of subcall function 0048BCED: SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0048BE2E

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000), ref: 004877CD
CreateCompatibleDC.GDI32(00000000), ref: 004877D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 004877E7
SelectObject.GDI32(00000000,00000000), ref: 004877EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 004877FA
DeleteDC.GDI32(00000000), ref: 00487803
GetWindowLongW.USER32(?,000000EC), ref: 0048780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00487821
DestroyWindow.USER32(?), ref: 0048782D

Strings

static, xrefs: 00487765
athan, xrefs: 00487813

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$Global$CreateObject$FileMessageSend$CloseDeleteHandle$#418AllocAttributesCompatibleCopyDestroyFreeImageLayeredLockLongMovePixelReadSelectShowSizeStockStreamUnlock
String ID: athan$static
API String ID: 406645659-3227529370
Opcode ID: 80c3bdd7a0d63ebeaa4556a6b8c79307fca78e479194d2b0b8ea9a7529ca2377
Instruction ID: 789ec3a4cb580d3187b1e0f25c444e25d791e636f2d83489152635d906d596f6
Opcode Fuzzy Hash: 80c3bdd7a0d63ebeaa4556a6b8c79307fca78e479194d2b0b8ea9a7529ca2377
Instruction Fuzzy Hash: DD316E31105115AFDF11AF64DC08FDF3B69EF49324F210A29FA15A61A0D739E815DBA8

Uniqueness

Uniqueness Score: 2.12%

Function 004648F3, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73UNIQUE

APIs

#115.WSOCK32(00000101,?), ref: 0046490E
#57.WSOCK32(?,00000100), ref: 00464928
#52.WSOCK32(?), ref: 00464935
_wcscpy.LIBCMT ref: 0046495D
_memmove.LIBCMT ref: 00464970
#11.WSOCK32(?), ref: 0046497B
_strcat.LIBCMT ref: 00464989

Part of subcall function 0046573E: _strlen.LIBCMT ref: 00465756
Part of subcall function 0046573E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,?,00000000,?,00000000,?,00466870), ref: 00465769
Part of subcall function 0046573E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,?,00466870), ref: 0046579D

_wcscpy.LIBCMT ref: 004649A0
#116.WSOCK32 ref: 004649AE
_wcscpy.LIBCMT ref: 004649BC

Strings

0.0.0.0, xrefs: 00464957

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _wcscpy$ByteCharMultiWide$#115#116_memmove_strcat_strlen
String ID: 0.0.0.0
API String ID: 860691916-3771769585
Opcode ID: ebd3510c7347cce57e77ad78f705b66a6a72045763e94f2935d5d1112d065572
Instruction ID: a415c47feca9f18ccc9aca6889e14e15c95de93dcf3fd0710918b8717f4bba87
Opcode Fuzzy Hash: ebd3510c7347cce57e77ad78f705b66a6a72045763e94f2935d5d1112d065572
Instruction Fuzzy Hash: FE110571A04124ABDB20AB34AD06EDF77ACDF40714F1001BBF40492191FFB89AC9976A

Uniqueness

Uniqueness Score: 100.00%

Function 0040201B, Relevance: 18.2, APIs: 12, Instructions: 170windowtimeCOMMON

APIs

Part of subcall function 00401B41: InvalidateRect.USER32(?,00000000,00000001), ref: 00401B9A

DestroyWindow.USER32(?), ref: 004020D3
KillTimer.USER32(-00000001), ref: 0040216E
DestroyAcceleratorTable.USER32(00000000), ref: 0043BEF6
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,004016CB,00000000,?), ref: 0043BF27
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,004016CB,00000000,?), ref: 0043BF3E
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,004016CB,00000000), ref: 0043BF5A
DeleteObject.GDI32(00000000), ref: 0043BF6C
DestroyIcon.USER32(?), ref: 0043BF7E
DeleteObject.GDI32(00000000), ref: 0043BF90
DestroyWindow.USER32(00000000), ref: 0043BFA2
DestroyIcon.USER32(00000000,?,00000000,?,?,?,?,004016CB,00000000,?), ref: 0043BFB4
DestroyIcon.USER32(00000000,?,00000000,?,?,?,?,004016CB,00000000,?), ref: 0043BFC2

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Destroy$IconImageList_$DeleteObjectWindow$AcceleratorInvalidateKillRectTableTimer
String ID:
API String ID: 2960459417-0
Opcode ID: 78cac20c66e0e6767138dba4ab7aa47be9ee332057a729cfcb45c06255a83930
Instruction ID: 62d4407ef01395a22b5ebf1233624f5b0999fc02156c59d6ff76a6043205edb2
Opcode Fuzzy Hash: 78cac20c66e0e6767138dba4ab7aa47be9ee332057a729cfcb45c06255a83930
Instruction Fuzzy Hash: 55616B34101610DFD725AF14CE48B2A77F1FF44315F11993EE642A6AE0C7B9A881DF99

Uniqueness

Uniqueness Score: 0.27%

Function 004021A5, Relevance: 18.1, APIs: 12, Instructions: 132COMMON

APIs

Part of subcall function 004025DB: GetWindowLongW.USER32(?,000000EB), ref: 004025EC

GetSysColor.USER32(0000000F), ref: 004021D3
GetSysColor.USER32(00000008), ref: 00402231
SetTextColor.GDI32(?,000000FF), ref: 0040223B
SetBkMode.GDI32(?,00000001), ref: 00402250
GetStockObject.GDI32(00000005), ref: 00402258
GetWindowDC.USER32(?), ref: 0043C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0043C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0043C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0043C112
GetPixel.GDI32(00000000,?,?), ref: 0043C132
ReleaseDC.USER32(?,00000000), ref: 0043C13D
SetBkColor.GDI32(?,00000000), ref: 0043C159

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ColorPixel$Window$BrushCreateLongModeObjectReleaseSolidStockText
String ID:
API String ID: 2304791953-0
Opcode ID: cdac9cb2508351c8145c21bbd88bb5245f40cba3cfb8a0d4cbe4db6e4b3f4d31
Instruction ID: 47503e6e8c25a14c6d04473920290e3c3a9e3a2f6008e0ea463bb1cae73e411f
Opcode Fuzzy Hash: cdac9cb2508351c8145c21bbd88bb5245f40cba3cfb8a0d4cbe4db6e4b3f4d31
Instruction Fuzzy Hash: FD41D731000140AFDF215FA8DC8CBBA3765EB46331F1446BAFD65AA2E2C7758C86DB59

Uniqueness

Uniqueness Score: 0.24%

Function 004873C1, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

APIs

_memset.LIBCMT ref: 004873D9
CreateMenu.USER32 ref: 004873F4
SetMenu.USER32(?,00000000), ref: 00487403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00487490
IsMenu.USER32(?), ref: 004874A6
CreatePopupMenu.USER32 ref: 004874B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004874DD
DrawMenuBar.USER32 ref: 004874E5

Strings

F, xrefs: 004874D1
0, xrefs: 004873CF

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: c25b011170b029855e58234153c04d5ad6438b2c3f951a4d7e3730a877261e10
Instruction ID: 469fb1be4590f9541f2c80e88f17ef0f5a107e94f682755a56fb5537772b2935
Opcode Fuzzy Hash: c25b011170b029855e58234153c04d5ad6438b2c3f951a4d7e3730a877261e10
Instruction Fuzzy Hash: 08415874A01205EFDB10EF64D898E9EBBB9FF49300F24482AED55A7361D734A914CF68

Uniqueness

Uniqueness Score: 4.65%

Function 00427040, Relevance: 16.8, APIs: 11, Instructions: 258COMMON

APIs

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

_memset.LIBCMT ref: 0042707B

Part of subcall function 00433F0C: __lock.LIBCMT ref: 00433F23
Part of subcall function 00433F0C: __tzset_nolock.LIBCMT ref: 00433F36

__gmtime64_s.LIBCMT ref: 00427114
__gmtime64_s.LIBCMT ref: 0042714A
__gmtime64_s.LIBCMT ref: 00427167

Part of subcall function 00433CE1: _memset.LIBCMT ref: 00433D11
Part of subcall function 00433CE1: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433D64
Part of subcall function 00433CE1: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433E60
Part of subcall function 00433CE1: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433EB5
Part of subcall function 00433CE1: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433ECF
Part of subcall function 00433CE1: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433EF0

Part of subcall function 00433F5C: __lock.LIBCMT ref: 00433F6E
Part of subcall function 00433F5C: __isindst_nolock.LIBCMT ref: 00433F7B

__allrem.LIBCMT ref: 004271BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004271D9
__allrem.LIBCMT ref: 004271F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042720E
__allrem.LIBCMT ref: 00427225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00427243
__invoke_watson.LIBCMT ref: 004272B4

Part of subcall function 00429006: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00429008
Part of subcall function 00429006: __call_reportfault.LIBCMT ref: 00429021

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem__gmtime64_s$__lock_memset$FeaturePresentProcessor__call_reportfault__getptd_noexit__invoke_watson__isindst_nolock__tzset_nolock
String ID:
API String ID: 3881391381-0
Opcode ID: f449d8c0ffc7a299f8ac5c355c84109bbbb1ac945fd94324ebc384d93c6e9658
Instruction ID: 3a5766166ad995f9d080cadeea3a970d97efeda9365c881e9167125cd7ba6949
Opcode Fuzzy Hash: f449d8c0ffc7a299f8ac5c355c84109bbbb1ac945fd94324ebc384d93c6e9658
Instruction Fuzzy Hash: F3711972B04726EBD7149E79DC82B6BB3A4AF14324F54426FF514E6381E778E9008B98

Uniqueness

Uniqueness Score: 2.28%

Function 00462A16, Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

APIs

_memset.LIBCMT ref: 00462A31
GetMenuItemInfoW.USER32(004C6890,000000FF,00000000,00000030), ref: 00462A92
SetMenuItemInfoW.USER32(004C6890,00000004,00000000,00000030), ref: 00462AC8

Part of subcall function 0040410D: _memset.LIBCMT ref: 0040418D
Part of subcall function 0040410D: _wcscpy.LIBCMT ref: 004041E1
Part of subcall function 0040410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 004041F1
Part of subcall function 0040410D: LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0043D5EC

Sleep.KERNEL32(000001F4), ref: 00462ADA
GetMenuItemCount.USER32(?), ref: 00462B1E
GetMenuItemID.USER32(?,00000000), ref: 00462B3A
GetMenuItemID.USER32(?,-00000001), ref: 00462B64
GetMenuItemID.USER32(?,?), ref: 00462BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00462BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00462C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00462C24

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ItemMenu$Info$_memset$CheckCountIconLoadNotifyRadioShell_SleepString_wcscpy
String ID:
API String ID: 1765048189-0
Opcode ID: 0db34e4f82c13017aa7dadbfd465409a1cb67985b1d4a80d7e657ddb00fdb038
Instruction ID: 18a65889ef34665f5b2b5336e4e6eed4a99801a903535dc72d9624464193ca63
Opcode Fuzzy Hash: 0db34e4f82c13017aa7dadbfd465409a1cb67985b1d4a80d7e657ddb00fdb038
Instruction Fuzzy Hash: 6461D4B0900649BFDB21CF54CE88DBF7BB8EB41704F14446EE841A7251E7B9AD05DB2A

Uniqueness

Uniqueness Score: 2.20%

Function 00487192, Relevance: 16.7, APIs: 11, Instructions: 185windowCOMMON

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00487214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00487217
GetWindowLongW.USER32(?,000000F0), ref: 0048723B
_memset.LIBCMT ref: 0048724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0048725E

Part of subcall function 0048AF23: _wcspbrk.LIBCMT ref: 0048AF30
Part of subcall function 0048AF23: _wcsncpy.LIBCMT ref: 0048AF64

SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 004872D6
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00487320
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 0048733F
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 0048735A
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 0048736E
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 0048738B

Part of subcall function 0048B57F: GetWindowRect.USER32(?,?), ref: 0048B59E
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5B6
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5DA
Part of subcall function 0048B57F: InvalidateRect.USER32(?,?,?), ref: 0048B5F5

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend$ClientRectScreenWindow$InvalidateLong_memset_wcsncpy_wcspbrk
String ID:
API String ID: 3849892166-0
Opcode ID: 1f254a2dd634fbf8d682cb823299d5faa4870696f922a999c8bea393425f8b4a
Instruction ID: 98a04bc020cc1dfb4f2f33dd24e3f33540f585986abfb0e63cd4152109fcc849
Opcode Fuzzy Hash: 1f254a2dd634fbf8d682cb823299d5faa4870696f922a999c8bea393425f8b4a
Instruction Fuzzy Hash: 57618E75900208AFDB10EFA4CC91EEE77F8AF09704F24456AFA14A73A1C774A945DB64

Uniqueness

Uniqueness Score: 2.04%

Function 0045710E, Relevance: 16.6, APIs: 11, Instructions: 123COMMON

APIs

#41.OLEAUT32(0000000C,?,?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4), ref: 00457135
#37.OLEAUT32(?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4,?,00000016), ref: 0045718E
#8.OLEAUT32(?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4,?,00000016), ref: 004571A0
#23.OLEAUT32(?,?,?,?,?,?,?,?,00456EC6), ref: 004571C0
#9.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 00457264

Part of subcall function 00409E9C: #9.OLEAUT32(?,?,?,?,?,00469D81,?,00000001,-004C5E88,?,00455CCE,?,?,?,0040FAE1,00000000), ref: 0043FE11

Part of subcall function 004570DC: #9.OLEAUT32(?,00000000,?,00000016,00479753,?,00000016,?,00000016), ref: 00457101

#10.OLEAUT32(?,?,00000002,?,?,?,?,?,?,?,00456EC6), ref: 00457213
#24.OLEAUT32(?,00000002,?,?,?,?,?,?,?,00456EC6), ref: 00457227
#9.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 0045723C
#39.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 00457249
#38.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 00457252
#38.OLEAUT32(?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4,?,00000016), ref: 0045726F

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23c1a385547e4fe92da69b3c9963987276d6a870cfb840cf5260315eec4c18b
Instruction ID: ee6ff97d49ab8f9c2dd167b55ca35aa0841007d9f21f2d6d7be11d351e1905ac
Opcode Fuzzy Hash: b23c1a385547e4fe92da69b3c9963987276d6a870cfb840cf5260315eec4c18b
Instruction Fuzzy Hash: 61416031A00119AFCB00DFA9D8449AEBBB9FF18755F00847EF955E7362CB34A949CB94

Uniqueness

Uniqueness Score: 2.04%

Function 00479428, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 263UNIQUE

APIs

_memset.LIBCMT ref: 0047947C
#8.OLEAUT32(?), ref: 0047954D
#8.OLEAUT32(?,?,?,?), ref: 0047964E
#9.OLEAUT32(?), ref: 00479658

Part of subcall function 00467804: #8.OLEAUT32(00000000,?,?,00000016,00000016,?,004799E9,?,?), ref: 00467844
Part of subcall function 00467804: #10.OLEAUT32(00000000,?,?,004799E9,?,?), ref: 0046784D
Part of subcall function 00467804: #9.OLEAUT32(00000000,?,004799E9,?,?), ref: 00467859

#9.OLEAUT32(?,?), ref: 004796B5

Part of subcall function 004796DB: GetLastError.KERNEL32(?,00000000,?,0048FB84,?,00000016,?,00000016), ref: 004798A5
Part of subcall function 004796DB: #8.OLEAUT32(?,?,?,?), ref: 00479999
Part of subcall function 004796DB: #9.OLEAUT32(?,0048FB84,00000000,?,?,?,?,?), ref: 00479A43

Strings

get__NewEnum, xrefs: 00479454
Null Object assignment in FOR..IN loop, xrefs: 004794DD, 0047960B, 004796C3
Incorrect Object type in FOR..IN loop, xrefs: 00479631
_NewEnum, xrefs: 00479436

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ErrorLast_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 533350023-1765764032
Opcode ID: c876955a294aa8d86eb8db64ea30777345f3c0a1fb8a500add95116d5b305f7c
Instruction ID: fcebb0c40d61f867c18811628665e3ff882c4d71f35d8502a0dec60dd81a9e36
Opcode Fuzzy Hash: c876955a294aa8d86eb8db64ea30777345f3c0a1fb8a500add95116d5b305f7c
Instruction Fuzzy Hash: 2791AD71A00215ABCF24DFA5C844FEFBBB8EF45714F10851AE519AB280D778AD05CFA8

Uniqueness

Uniqueness Score: 100.00%

Function 0048D74C, Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 257windowCOMMON

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

GetSystemMetrics.USER32(0000000F), ref: 0048D78A
GetSystemMetrics.USER32(0000000F), ref: 0048D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000), ref: 0048D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0048DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0048DA24
ShowWindow.USER32(00000003,00000000), ref: 0048DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 0048DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 0048DA8B

Strings

, xrefs: 0048D997

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-3916222277
Opcode ID: eb70e67288782093014809172296cca956549343a8f45a5b87efe570699ce815
Instruction ID: eb940e76658434b7ad8eeabe1703afeb33935e81992f953b53c46158808d9c3e
Opcode Fuzzy Hash: eb70e67288782093014809172296cca956549343a8f45a5b87efe570699ce815
Instruction Fuzzy Hash: C9B19B71901215EBDF18EF68C9857BE7BB1FF48700F18847AEC48AB295D738A950CB58

Uniqueness

Uniqueness Score: 12.89%

Function 004162F2, Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 143UNIQUE

APIs

_memset.LIBCMT ref: 004163A8
_memmove.LIBCMT ref: 00416446
_memset.LIBCMT ref: 0041646A

Strings

ERCP, xrefs: 00416313
internal error: opcode not recognized, xrefs: 0041647D
argument is not a compiled regular expression, xrefs: 00451160
argument not compiled in 16 bit mode, xrefs: 00451150
internal error: missing capturing bracket, xrefs: 00451158
failed to get memory, xrefs: 00416488

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP$argument is not a compiled regular expression$argument not compiled in 16 bit mode$failed to get memory$internal error: missing capturing bracket$internal error: opcode not recognized
API String ID: 2532777613-264027815
Opcode ID: 5050f1d5a739bef3a8333c6a539d66c1edae72094ea9907375e2dc5b1e6d177f
Instruction ID: 5033df5f12e9d93d71518abbe4fce8200a660ff7c3ad8cb2f73575c85904d8e6
Opcode Fuzzy Hash: 5050f1d5a739bef3a8333c6a539d66c1edae72094ea9907375e2dc5b1e6d177f
Instruction Fuzzy Hash: 9551C0719007199BCB24CF65C881BEBBBF4EF08314F20856FE94AC6251E778D985CB58

Uniqueness

Uniqueness Score: 100.00%

Function 0045FCB1, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 75windowUNIQUE

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0043E6C9,00000010,?,Bad directive syntax error,0048F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0045FCD2
LoadStringW.USER32(00000000,?,0043E6C9,00000010), ref: 0045FCD9

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

_wprintf.LIBCMT ref: 0045FD0C

Part of subcall function 00423ECA: __stbuf.LIBCMT ref: 00423F1A
Part of subcall function 00423ECA: __ftbuf.LIBCMT ref: 00423F47

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0045FD9D

Strings

., xrefs: 0045FD83
Line %d (File "%s"):, xrefs: 0045FD43
Error: , xrefs: 0045FD6B
%s (%d) : ==> %s.: %s %s, xrefs: 0045FD07
Line %d:, xrefs: 0045FD28

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$HandleLoadMessageModuleString__ftbuf__stbuf_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1008278035-4153970271
Opcode ID: 2711c1099e1e3cfdeec11ef3c532a81f9540f66b70c73c00a421ef3ad6350e31
Instruction ID: 81f1730f4d526a642bfcee5cc6fe39c4b389179dc46090657c4ca9c9ceb2fa3a
Opcode Fuzzy Hash: 2711c1099e1e3cfdeec11ef3c532a81f9540f66b70c73c00a421ef3ad6350e31
Instruction Fuzzy Hash: 5121503290021EABCF12EFA0CC46EEE7735BF18705F04046BF505660E2D679AA5CDB99

Uniqueness

Uniqueness Score: 100.00%

Function 00467C1A, Relevance: 15.3, APIs: 10, Instructions: 292UNIQUE

APIs

#77.OLEAUT32(00000000,?,00000002,?,00000000,00000000,?,?,?,?,?,0046782E,?,?,00000016,00000016), ref: 00467CF6
#23.OLEAUT32(?,?,?,?,?,?,?,0046782E,?,?), ref: 00467D21

Part of subcall function 0046794E: _memset.LIBCMT ref: 00467983

_memmove.LIBCMT ref: 00467D3D
#24.OLEAUT32(?,?,?,?,?,?,?,?,?,0046782E,?,?), ref: 00467D46
#23.OLEAUT32(00000000,?,?,?,?,?,?,0046782E,?,?,00000016,00000016), ref: 00467D7B
_memmove.LIBCMT ref: 00467DD7
#23.OLEAUT32(00000000,?,00000002,?,00000000,00000000,?,?,?,?,?,0046782E,?,?,00000016,00000016), ref: 00467E1A
#23.OLEAUT32(00000000,?,00000002,?,00000000,00000000,?,?,?,?,?,0046782E,?,?,00000016,00000016), ref: 00467E8F
#23.OLEAUT32(00000000,0046782E,00000002,?,00000000,00000000,?,?,?,?,?,0046782E,?,?,00000016,00000016), ref: 00467F06
#24.OLEAUT32(00000000,?,?,?,?,?,0046782E,?,?), ref: 00467F63

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Part of subcall function 00467804: #8.OLEAUT32(00000000,?,?,00000016,00000016,?,004799E9,?,?), ref: 00467844
Part of subcall function 00467804: #10.OLEAUT32(00000000,?,?,004799E9,?,?), ref: 0046784D
Part of subcall function 00467804: #9.OLEAUT32(00000000,?,004799E9,?,?), ref: 00467859

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 111500385-0
Opcode ID: 987899574f0da1b615fe03902764485af2dd16721cb896bd8fb240e969628c57
Instruction ID: 84cb7d45f9d8793474644a93194044f32f7eba6a2b7a870eb07e14d75927cafd
Opcode Fuzzy Hash: 987899574f0da1b615fe03902764485af2dd16721cb896bd8fb240e969628c57
Instruction Fuzzy Hash: F2B19071A0421A9FDB10DF94C484BBEB7B4FF08329F24446AE500E7391E7799D45CB9A

Uniqueness

Uniqueness Score: 100.00%

Function 0043BFF2, Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

APIs

GetSysColor.USER32(00000008), ref: 00402231
SetTextColor.GDI32(?,000000FF), ref: 0040223B
SetBkMode.GDI32(?,00000001), ref: 00402250
GetStockObject.GDI32(00000005), ref: 00402258
GetClientRect.USER32(?), ref: 0043C00B
SendMessageW.USER32(?,00001328,00000000,?), ref: 0043C022
GetWindowDC.USER32(?), ref: 0043C02E
GetPixel.GDI32(00000000,?,?), ref: 0043C03D
ReleaseDC.USER32(?,00000000), ref: 0043C04F
GetSysColor.USER32(00000005), ref: 0043C06D
GetWindowDC.USER32(?), ref: 0043C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0043C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0043C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0043C112
GetPixel.GDI32(00000000,?,?), ref: 0043C132
ReleaseDC.USER32(?,00000000), ref: 0043C13D
SetBkColor.GDI32(?,00000000), ref: 0043C159

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pixel$Color$ReleaseWindow$BrushClientCreateMessageModeObjectRectSendSolidStockText
String ID:
API String ID: 2620996928-0
Opcode ID: 1bf2c63732afe56eb40a90f078efa9d7f02239ddb0671fcfb63c7c23008006c8
Instruction ID: 802d89892a32490a02705165823103a0381fc92a3b0e4948cdb48aeb982ddee2
Opcode Fuzzy Hash: 1bf2c63732afe56eb40a90f078efa9d7f02239ddb0671fcfb63c7c23008006c8
Instruction Fuzzy Hash: E2218C31100200EFDB216FA4EC4CBAE7B71EB08321F10467AFA25A51E2CB310956EF15

Uniqueness

Uniqueness Score: 0.27%

Function 0040FBBD, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0040FC06
OleUninitialize.OLE32 ref: 0040FCA5

Part of subcall function 004161FE: VirtualFreeEx.KERNEL32(?,?,00000000,00008000,?,00000000,0040FCE7,?), ref: 0045113C
Part of subcall function 004161FE: CloseHandle.KERNEL32(?), ref: 00451145

UnregisterHotKey.USER32(?), ref: 0040FDFC
DestroyWindow.USER32(?), ref: 00444A00
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00444A92

Part of subcall function 00405DCF: CloseHandle.KERNEL32(?), ref: 00405DEF

FindClose.KERNEL32(?), ref: 00444A2C
FreeLibrary.KERNEL32(?), ref: 00444A65

Strings

close all, xrefs: 0040FC01

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CloseFree$HandleVirtual$DestroyFindLibrarySendStringUninitializeUnregisterWindow
String ID: close all
API String ID: 1721425543-3243417748
Opcode ID: 2d6be8239382604261f8dbc7b07cd937b76970d41e9ba2928ba090010e962106
Instruction ID: f79c305bce8c495b879b6b3d36d440b666e908b3516d9d6565214aadf1190029
Opcode Fuzzy Hash: 2d6be8239382604261f8dbc7b07cd937b76970d41e9ba2928ba090010e962106
Instruction Fuzzy Hash: 2BA160307012128FDB29EF15C495B6AF764BF44704F5442BEE80A7B692DB38AD1ACF58

Uniqueness

Uniqueness Score: 0.83%

Function 00402E26, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 187windowCOMMON

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00402EAE

Part of subcall function 00488AC0: InvalidateRect.USER32(?,00000000,00000001), ref: 00488B4D
Part of subcall function 00488AC0: SendMessageW.USER32(?,00001024,00000000,?), ref: 00488B9C
Part of subcall function 00488AC0: GetWindowLongW.USER32(?,000000F0), ref: 00488BC6
Part of subcall function 00488AC0: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00488BD3

Part of subcall function 004888B4: InvalidateRect.USER32(?,00000000,00000001), ref: 0048896E
Part of subcall function 004888B4: SendMessageW.USER32(?,00002001,00000000,00000000), ref: 004889A4
Part of subcall function 004888B4: ShowWindow.USER32(?,00000000), ref: 004889ED
Part of subcall function 004888B4: ShowWindow.USER32(?,00000005), ref: 004889F3
Part of subcall function 004888B4: SetFocus.USER32 ref: 004889F7
Part of subcall function 004888B4: GetWindowLongW.USER32(?,000000F0), ref: 00488A35
Part of subcall function 004888B4: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00488A42
Part of subcall function 004888B4: SendMessageW.USER32(?,00001001,00000000,?), ref: 00488A86
Part of subcall function 004888B4: SendMessageW.USER32(?,00001026,00000000,?), ref: 00488A93

Part of subcall function 00401DB3: GetClientRect.USER32(?,?), ref: 00401DDC
Part of subcall function 00401DB3: GetWindowRect.USER32(?,?), ref: 00401E1D
Part of subcall function 00401DB3: ScreenToClient.USER32(?,?), ref: 00401E45
Part of subcall function 00401DB3: GetClientRect.USER32(?,?), ref: 00401F74
Part of subcall function 00401DB3: GetWindowRect.USER32(?,?), ref: 00401F8D
Part of subcall function 00401DB3: GetSystemMetrics.USER32(0000000F), ref: 0043BD81

Part of subcall function 00486442: DeleteObject.GDI32(00000000), ref: 0048645A
Part of subcall function 00486442: GetDC.USER32(00000000), ref: 00486462
Part of subcall function 00486442: GetDeviceCaps.GDI32(00000000,0000005A), ref: 0048646D
Part of subcall function 00486442: ReleaseDC.USER32(00000000,00000000), ref: 00486479
Part of subcall function 00486442: CreateFontW.GDI32(?,00000000,00000000,00000000,?,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 004864B5
Part of subcall function 00486442: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004864C6
Part of subcall function 00486442: MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00486500
Part of subcall function 00486442: SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00486520

GetDC.USER32 ref: 0043CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0043CF95
SelectObject.GDI32(00000000,00000000), ref: 0043CFA3

Part of subcall function 00464A71: _wcstok.LIBCMT ref: 00464AD4
Part of subcall function 00464A71: GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00464AF1
Part of subcall function 00464A71: _wcstok.LIBCMT ref: 00464B04

SelectObject.GDI32(00000000,00000000), ref: 0043CFB8
ReleaseDC.USER32(?,00000000), ref: 0043CFC0
MoveWindow.USER32(?,?,?,?,?,?), ref: 0043D04B

Strings

U, xrefs: 0043CF20

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$MessageSend$Rect$Long$ClientObject$InvalidateMoveReleaseSelectShow_wcstok$CapsCreateDeleteDeviceExtentFocusFontMetricsPoint32ScreenSystemText
String ID: U
API String ID: 3989468521-3372436214
Opcode ID: 0969c50ed03cbcb6b15ab821441fe7f6d053487c1f74c0115cd5092b0ee42946
Instruction ID: 503d644826a268ec800efc68b7bbea7fbba9df6d5383aa92877d77a3c614af5d
Opcode Fuzzy Hash: 0969c50ed03cbcb6b15ab821441fe7f6d053487c1f74c0115cd5092b0ee42946
Instruction Fuzzy Hash: B471E130900205DFCF259F64C884AAB3BB6FF48318F14427BED556A2E6C7398842DB69

Uniqueness

Uniqueness Score: 0.25%

Function 0048C27C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowUNIQUE

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

Part of subcall function 00402344: GetCursorPos.USER32(?), ref: 00402357
Part of subcall function 00402344: ScreenToClient.USER32(004C67B0,?), ref: 00402374
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000001), ref: 00402399
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000002), ref: 004023A7
Part of subcall function 00402344: GetWindowLongW.USER32(?,000000F0), ref: 0043C23A

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?), ref: 0048C2E4
ImageList_EndDrag.COMCTL32 ref: 0048C2EA
ReleaseCapture.USER32 ref: 0048C2F0

Part of subcall function 0048ADF1: ClientToScreen.USER32(?,?), ref: 0048AE1A
Part of subcall function 0048ADF1: GetWindowRect.USER32(?,?), ref: 0048AE90
Part of subcall function 0048ADF1: PtInRect.USER32(?,?,?), ref: 0048AEA0
Part of subcall function 0048ADF1: MessageBeep.USER32(00000000), ref: 0048AF11

Part of subcall function 0048804A: SendMessageW.USER32(?,00000188,00000000,00000000), ref: 004880E0
Part of subcall function 0048804A: SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 004880FF
Part of subcall function 0048804A: SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00488123
Part of subcall function 0048804A: SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00488134
Part of subcall function 0048804A: SendMessageW.USER32(?,00000149,00000000,00000000), ref: 00488153
Part of subcall function 0048804A: SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00488186
Part of subcall function 0048804A: SendMessageW.USER32(?,0000133C,00000000,?), ref: 004881AC
Part of subcall function 0048804A: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004881E7
Part of subcall function 0048804A: SendMessageW.USER32(?,0000113E,00000000,00000004), ref: 0048822E
Part of subcall function 0048804A: SendMessageW.USER32(?,0000113E,00000000,00000004), ref: 00488256
Part of subcall function 0048804A: IsMenu.USER32(?), ref: 0048826F
Part of subcall function 0048804A: GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004882CA
Part of subcall function 0048804A: GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004882F8
Part of subcall function 0048804A: GetWindowLongW.USER32(?,000000F0), ref: 0048836C
Part of subcall function 0048804A: SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 004883BB
Part of subcall function 0048804A: SendMessageW.USER32(?,00001001,00000000,?), ref: 00488456
Part of subcall function 0048804A: wsprintfW.USER32 ref: 0048847E
Part of subcall function 0048804A: SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 004884A0
Part of subcall function 0048804A: GetWindowTextW.USER32(?,00000000,00000001), ref: 004884C8
Part of subcall function 0048804A: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 004884EA
Part of subcall function 0048804A: SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0048850A
Part of subcall function 0048804A: GetWindowTextW.USER32(?,00000000,00000001), ref: 00488531
Part of subcall function 0048804A: GetWindowLongW.USER32(?,000000EC), ref: 004885AB
Part of subcall function 0048804A: _memset.LIBCMT ref: 004885BD
Part of subcall function 0048804A: SendMessageW.USER32(?,00001053,000000FF,?), ref: 004885EC
Part of subcall function 0048804A: SendMessageW.USER32(?,0000104B,00000000,?), ref: 00488625
Part of subcall function 0048804A: SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 00488676
Part of subcall function 0048804A: CharNextW.USER32(00000000), ref: 004886B1
Part of subcall function 0048804A: SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 004886E1
Part of subcall function 0048804A: SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 004886FC
Part of subcall function 0048804A: _memset.LIBCMT ref: 00488709
Part of subcall function 0048804A: SendMessageW.USER32(?,0000104B,00000000,?), ref: 0048872A
Part of subcall function 0048804A: SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0048873F

SetWindowTextW.USER32(?,00000000), ref: 0048C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0048C3AD

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

DefDlgProcW.USER32(?,00000202,?), ref: 0048C48F

Strings

@GUI_DROPID, xrefs: 0048C3E1
@GUI_DRAGFILE, xrefs: 0048C424

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Message$Send$Window$Long$MenuText$AsyncClientDragImageInfoItemList_RectScreenState_memset$BeepCaptureCharCursorLeaveNextProcRelease_memmovewsprintf
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 3004859125-2107944366
Opcode ID: 117dcdd94416484c18a05dca1cad4d1878e10aaafb5c61bd83af7fa7027f6da8
Instruction ID: dc367e10a39d425f30cb391b84f58576d3d09b44280b1156dac04409bcc5156d
Opcode Fuzzy Hash: 117dcdd94416484c18a05dca1cad4d1878e10aaafb5c61bd83af7fa7027f6da8
Instruction Fuzzy Hash: 7451A170204304AFD700EF24C895F6E77E5FB88314F00892EF555972E1DB78A948DB6A

Uniqueness

Uniqueness Score: 100.00%

Function 00409997, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 146COMMON

APIs

__itow.LIBCMT ref: 004099C2

Part of subcall function 00423700: _xtow@16.LIBCMT ref: 00423721

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

_wcscpy.LIBCMT ref: 0043F9B1
_wcscpy.LIBCMT ref: 0043F9DD
__i64tow.LIBCMT ref: 0043FA0F

Part of subcall function 004236D0: @x64tow@20.LIBCMT ref: 004236F6

Strings

False, xrefs: 0043F9D7
%.15g, xrefs: 00409A06
0x%p, xrefs: 0043F9F1
True, xrefs: 0043F9D0

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _wcscpy$@x64tow@20Exception@8Throw__i64tow__itow_memmove_xtow@16std::exception::exception
String ID: %.15g$0x%p$False$True
API String ID: 1760017398-2263619337
Opcode ID: c38d9b48d0b7250c6676f86ab8e62d6128b56f7fb310e640c55886818ba1baeb
Instruction ID: cdd8dc89b9c74c658104cf0a760322e4f13a95bb5b846f9aebd24ca3b9163d03
Opcode Fuzzy Hash: c38d9b48d0b7250c6676f86ab8e62d6128b56f7fb310e640c55886818ba1baeb
Instruction Fuzzy Hash: DE41D5B1A04219AADB24DF35D841F7773E8EF48304F20447FE549E63D2EA799D428B1A

Uniqueness

Uniqueness Score: 0.18%

Function 00486FEF, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 144windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00487093
SendMessageW.USER32(?,00001036,00000000,?), ref: 004870A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004870C1

Part of subcall function 0048AF23: _wcspbrk.LIBCMT ref: 0048AF30
Part of subcall function 0048AF23: _wcsncpy.LIBCMT ref: 0048AF64

_wcscat.LIBCMT ref: 0048711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00487133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00487161

Strings

SysListView32, xrefs: 00487065
-----, xrefs: 00487114

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectShowStock_wcscat_wcsncpy_wcspbrk
String ID: -----$SysListView32
API String ID: 241103563-3975388722
Opcode ID: 9b1a26a8c0c70ab52fe23d707f0f6cb833f8e13d4260bc8a5faa59c67bdc6ff6
Instruction ID: 4fbf2f6a0a360f59c4a706c2668b2d14797c234da93993d2b1a3b4800614f543
Opcode Fuzzy Hash: 9b1a26a8c0c70ab52fe23d707f0f6cb833f8e13d4260bc8a5faa59c67bdc6ff6
Instruction Fuzzy Hash: 0F41C471A04308AFDB21AF64CC95BEF77A8EF08354F20082BF544E7292D679DD848B58

Uniqueness

Uniqueness Score: 2.48%

Function 004888B4, Relevance: 13.7, APIs: 9, Instructions: 170windowCOMMON

APIs

Part of subcall function 0048A71E: DeleteObject.GDI32(00000000), ref: 0048A757

InvalidateRect.USER32(?,00000000,00000001), ref: 0048896E
SendMessageW.USER32(?,00002001,00000000,00000000), ref: 004889A4
ShowWindow.USER32(?,00000000), ref: 004889ED
ShowWindow.USER32(?,00000005), ref: 004889F3
SetFocus.USER32 ref: 004889F7
GetWindowLongW.USER32(?,000000F0), ref: 00488A35
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00488A42
SendMessageW.USER32(?,00001001,00000000,?), ref: 00488A86
SendMessageW.USER32(?,00001026,00000000,?), ref: 00488A93

Part of subcall function 0048B57F: GetWindowRect.USER32(?,?), ref: 0048B59E
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5B6
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5DA
Part of subcall function 0048B57F: InvalidateRect.USER32(?,?,?), ref: 0048B5F5

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$MessageRectSend$ClientInvalidateLongScreenShow$BrushCreateDeleteFocusObjectSolid
String ID:
API String ID: 3433424984-0
Opcode ID: 9ee29c6a714b648f10e23144f1ce0a6863bdfe809778bfe024b975fa15a7e1a7
Instruction ID: c6b024f5472ab695e497d5b95dd9337e811c75869fcd45f43dd79c229618c00e
Opcode Fuzzy Hash: 9ee29c6a714b648f10e23144f1ce0a6863bdfe809778bfe024b975fa15a7e1a7
Instruction Fuzzy Hash: 9651A430600208BADF34BF25CC89B6E7B65BF05314FA0492FF515E62E1DF79A9809B59

Uniqueness

Uniqueness Score: 0.14%

Function 00402B72, Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

APIs

InvalidateRect.USER32(00000000,00000000,00000001), ref: 0043C626

Part of subcall function 0048A71E: DeleteObject.GDI32(00000000), ref: 0048A757

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0043C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0043C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0043C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0043C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0043C5C0
DestroyCursor.USER32(00000000), ref: 0043C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0043C5EC
DestroyCursor.USER32(?), ref: 0043C5FB

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CursorDestroyExtractIconImageLoadMessageSend$BrushCreateDeleteInvalidateLongObjectRectSolidWindow_memmove
String ID:
API String ID: 3268869388-0
Opcode ID: 81afcbf08828746e37249aa2d7169ad2f55defdc0271cb54902766973fdc60bd
Instruction ID: ed5008150b57a45f5131e2346d738f4917d6b36040872bb3e781a27093426637
Opcode Fuzzy Hash: 81afcbf08828746e37249aa2d7169ad2f55defdc0271cb54902766973fdc60bd
Instruction Fuzzy Hash: B3516D74600205AFDB24DF25CD89FAA37B5EB58710F10452EF902A72D0DBB8ED91DB68

Uniqueness

Uniqueness Score: 0.83%

Function 00479E38, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352UNIQUE

APIs

#9.OLEAUT32(?,?,00000000,00000000), ref: 0047A1C0

Part of subcall function 004570DC: #9.OLEAUT32(?,00000000,?,00000016,00479753,?,00000016,?,00000016), ref: 00457101

Part of subcall function 00457096: #8.OLEAUT32(00000004,00000004,00479F87,0000002A,?,00000016), ref: 0045709A

#9.OLEAUT32(-00000010,0000002A,?,00000016), ref: 0047A000
#2.OLEAUT32(0048F910), ref: 0047A023
#8.OLEAUT32(?,0000002A,?,00000016), ref: 0047A078
_memset.LIBCMT ref: 0047A085

Part of subcall function 00467804: #8.OLEAUT32(00000000,?,?,00000016,00000016,?,004799E9,?,?), ref: 00467844
Part of subcall function 00467804: #10.OLEAUT32(00000000,?,?,004799E9,?,?), ref: 0046784D
Part of subcall function 00467804: #9.OLEAUT32(00000000,?,004799E9,?,?), ref: 00467859

Part of subcall function 004576C5: #6.OLEAUT32(?), ref: 00457818
Part of subcall function 004576C5: lstrcmpiW.KERNEL32(?,?), ref: 004578F2
Part of subcall function 004576C5: SysFreeString.OLEAUT32(?), ref: 004578FF
Part of subcall function 004576C5: SysFreeString.OLEAUT32(?), ref: 0045791F

Part of subcall function 004796DB: GetLastError.KERNEL32(?,00000000,?,0048FB84,?,00000016,?,00000016), ref: 004798A5
Part of subcall function 004796DB: #8.OLEAUT32(?,?,?,?), ref: 00479999
Part of subcall function 004796DB: #9.OLEAUT32(?,0048FB84,00000000,?,?,?,?,?), ref: 00479A43

Strings

Not an Object type, xrefs: 00479E90
NULL Pointer assignment, xrefs: 00479EB9, 0047A1DD

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: FreeString$ErrorLast_memsetlstrcmpi
String ID: NULL Pointer assignment$Not an Object type
API String ID: 1596996103-572801152
Opcode ID: 0707723bdbe81558296e901379cfcb5167d55349716ceae756385836d7a8d264
Instruction ID: d1c791fb0e6f22c0c68d958e545617c08fe4ee677592400c8048375e82c93b3c
Opcode Fuzzy Hash: 0707723bdbe81558296e901379cfcb5167d55349716ceae756385836d7a8d264
Instruction Fuzzy Hash: E1C1A071A0020A9FDF10CF68C884BEEB7B5FB88314F54846AE909EB381E7789D55CB55

Uniqueness

Uniqueness Score: 100.00%

Function 00463226, Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

APIs

Part of subcall function 0042313D: __wcsicmp_l.LIBCMT ref: 004231C6

LoadIconW.USER32(00000000,00007F03), ref: 004632C5
ExtractIconExW.SHELL32(?,004C6A2C,00000000,004C6A30,00000001), ref: 004632DA

Strings

question, xrefs: 0046327E
blank, xrefs: 00463247
warning, xrefs: 004632AE
stop, xrefs: 00463296
info, xrefs: 00463266

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Icon$ExtractLoad__wcsicmp_l
String ID: blank$info$question$stop$warning
API String ID: 3534929142-404129466
Opcode ID: d886dfcc7b9600bb694fe280844c03d1f8326af8c4b092221694f6b45d5f8357
Instruction ID: bd39f8208ce013f69ee2957a59db9678c91d00ade58264490e67fb22ecbd3877
Opcode Fuzzy Hash: d886dfcc7b9600bb694fe280844c03d1f8326af8c4b092221694f6b45d5f8357
Instruction Fuzzy Hash: F41138313083967AA7015E55EC62DABB3ACDF19766F2000ABF40056281F67D5B1106BF

Uniqueness

Uniqueness Score: 0.23%

Function 00464534, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowUNIQUE

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0046454E
LoadStringW.USER32(00000000), ref: 00464555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0046456B
LoadStringW.USER32(00000000), ref: 00464572
_wprintf.LIBCMT ref: 00464598

Part of subcall function 00423ECA: __stbuf.LIBCMT ref: 00423F1A
Part of subcall function 00423ECA: __ftbuf.LIBCMT ref: 00423F47

MessageBoxW.USER32(00000000,?,?,00011010), ref: 004645B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00464593

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: HandleLoadModuleString$Message__ftbuf__stbuf_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 504489916-3128320259
Opcode ID: e4756bb536cb20b9c27427d85844968495559994f5e01966d8a5248d7e98c329
Instruction ID: 26d6b9379a34e5b6735d9e290e406bfe10dd0a5cb8e1345d55a1fd9b07754018
Opcode Fuzzy Hash: e4756bb536cb20b9c27427d85844968495559994f5e01966d8a5248d7e98c329
Instruction Fuzzy Hash: 2F0167F2500208BFE750A790DD89EEB776CEB08301F5009BABB45E2051E6789E894B79

Uniqueness

Uniqueness Score: 100.00%

Function 004203A2, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45keyboardUNIQUE

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 004203D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 004203DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 004203E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 004203F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 004203F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00420401

Strings

Lj w, xrefs: 004203A4

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Virtual
String ID: Lj w
API String ID: 4278518827-3995317842
Opcode ID: 0892b48b5c633f5601cc9ff2b3f9abbce8860175636cc0ddc78c40c876bf933f
Instruction ID: d0aff5fa41d626ddf17322be72bdae961d38541aa35c503e85926df042f77401
Opcode Fuzzy Hash: 0892b48b5c633f5601cc9ff2b3f9abbce8860175636cc0ddc78c40c876bf933f
Instruction Fuzzy Hash: 8701A7B0A42B5A7DE3009F6A8C84B53FEA8FF05394F00411BA15C47A42C7F5AC64CBE9

Uniqueness

Uniqueness Score: 100.00%

Function 004674D2, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 33synchronizationthreadUNIQUE

APIs

InterlockedExchange.KERNEL32(?,?), ref: 004674E5
EnterCriticalSection.KERNEL32(?,?,0043D343), ref: 004674F6
TerminateThread.KERNEL32(?,000001F6,?,0043D343), ref: 00467503
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00467510

Part of subcall function 00466ED7: CloseHandle.KERNEL32(?), ref: 00466EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00467523
LeaveCriticalSection.KERNEL32(?,?,0043D343), ref: 0046752A

Strings

%I, xrefs: 004674D2, 004674DE

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID: %I
API String ID: 3495660284-63094095
Opcode ID: 007701f69a9d5ed9de85b122c5e4605bf6e21b132c868c5f449004ca5f003f85
Instruction ID: 9734b5ccd6540a82fb48e8287cb809d44fcf662c2da7f217d7ce71899fdcd72b
Opcode Fuzzy Hash: 007701f69a9d5ed9de85b122c5e4605bf6e21b132c868c5f449004ca5f003f85
Instruction Fuzzy Hash: 9EF0823A140A12EBDB111B64FC8C9EF773AFF45312B5009BAF203914B0EB7A5815CB59

Uniqueness

Uniqueness Score: 100.00%

Function 00402A5B, Relevance: 12.1, APIs: 8, Instructions: 129COMMON

APIs

ShowWindow.USER32(FFFFFFFF,?), ref: 00402ACF
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00402B17

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

Part of subcall function 0048B958: ShowWindow.USER32(004C67B0,00000000), ref: 0048B9CC
Part of subcall function 0048B958: EnableWindow.USER32(00000000,00000000), ref: 0048B9F0
Part of subcall function 0048B958: ShowWindow.USER32(004C67B0,00000000), ref: 0048BA50
Part of subcall function 0048B958: ShowWindow.USER32(00000000,00000004), ref: 0048BA62
Part of subcall function 0048B958: EnableWindow.USER32(00000000,00000001), ref: 0048BA86
Part of subcall function 0048B958: SendMessageW.USER32(?,0000130C,?,00000000), ref: 0048BAA9

ShowWindow.USER32(FFFFFFFF,00000006), ref: 0043C46A
LockWindowUpdate.USER32(00000000), ref: 0043C492
InvalidateRect.USER32(00000000,00000000,00000001), ref: 0043C49E
LockWindowUpdate.USER32(FFFFFFFF), ref: 0043C4AE
EnableWindow.USER32(FFFFFFFF,00000001), ref: 0043C4BF
ShowWindow.USER32(FFFFFFFF,?), ref: 0043C4D6

Part of subcall function 00404A35: GetForegroundWindow.USER32 ref: 00404A3D
Part of subcall function 00404A35: FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0043DA8E
Part of subcall function 00404A35: IsIconic.USER32(?), ref: 0043DA97
Part of subcall function 00404A35: ShowWindow.USER32(?,00000009), ref: 0043DAA4
Part of subcall function 00404A35: SetForegroundWindow.USER32(?), ref: 0043DAAE
Part of subcall function 00404A35: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0043DAC4
Part of subcall function 00404A35: GetCurrentThreadId.KERNEL32 ref: 0043DACB
Part of subcall function 00404A35: GetWindowThreadProcessId.USER32(?,00000000), ref: 0043DAD7
Part of subcall function 00404A35: AttachThreadInput.USER32(?,00000000,00000001), ref: 0043DAE8
Part of subcall function 00404A35: AttachThreadInput.USER32(?,00000000,00000001), ref: 0043DAF0
Part of subcall function 00404A35: AttachThreadInput.USER32(00000000,?,00000001), ref: 0043DAF8
Part of subcall function 00404A35: SetForegroundWindow.USER32(?), ref: 0043DAFB
Part of subcall function 00404A35: MapVirtualKeyW.USER32(00000012,00000000), ref: 0043DB10
Part of subcall function 00404A35: keybd_event.USER32(00000012,00000000), ref: 0043DB1B
Part of subcall function 00404A35: MapVirtualKeyW.USER32(00000012,00000000), ref: 0043DB25
Part of subcall function 00404A35: keybd_event.USER32(00000012,00000000), ref: 0043DB2A
Part of subcall function 00404A35: MapVirtualKeyW.USER32(00000012,00000000), ref: 0043DB33
Part of subcall function 00404A35: keybd_event.USER32(00000012,00000000), ref: 0043DB38
Part of subcall function 00404A35: MapVirtualKeyW.USER32(00000012,00000000), ref: 0043DB42
Part of subcall function 00404A35: keybd_event.USER32(00000012,00000000), ref: 0043DB47
Part of subcall function 00404A35: SetForegroundWindow.USER32(?), ref: 0043DB4A
Part of subcall function 00404A35: AttachThreadInput.USER32(?,?,00000000), ref: 0043DB71
Part of subcall function 00404A35: AttachThreadInput.USER32(?,00000000,00000000), ref: 0043DB79
Part of subcall function 00404A35: AttachThreadInput.USER32(00000000,?,00000000), ref: 0043DB81

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$Thread$Show$AttachInput$ForegroundVirtualkeybd_event$Enable$LockProcessUpdate$CurrentFindIconicInvalidateLongMessageRectSend
String ID:
API String ID: 3989600621-0
Opcode ID: bc4373d98514daa640d36f0e0be472c50093ea83126dee7f945f78502fdb4aa5
Instruction ID: 8b6c8ed304f0763f3ef54d0254f4868818f2511668e6adff05f7a0ccbdd179e1
Opcode Fuzzy Hash: bc4373d98514daa640d36f0e0be472c50093ea83126dee7f945f78502fdb4aa5
Instruction Fuzzy Hash: 7E41DC307046809ADB754B288EDC67B7B91AB95314F14883FE046B66E0CABDA846DB1D

Uniqueness

Uniqueness Score: 0.43%

Function 00486442, Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

APIs

DeleteObject.GDI32(00000000), ref: 0048645A
GetDC.USER32(00000000), ref: 00486462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0048646D
ReleaseDC.USER32(00000000,00000000), ref: 00486479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 004864B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004864C6
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00486500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00486520

Part of subcall function 0048B57F: GetWindowRect.USER32(?,?), ref: 0048B59E
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5B6
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5DA
Part of subcall function 0048B57F: InvalidateRect.USER32(?,?,?), ref: 0048B5F5

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ClientMessageRectScreenSendWindow$CapsCreateDeleteDeviceFontInvalidateMoveObjectRelease
String ID:
API String ID: 3380433687-0
Opcode ID: 8b88619763fd6254d6488ec5cab92517c73cd71dc51d716d7c88cefd0b034ed1
Instruction ID: 5c1cc6793609d5e6e0acb9b007d1b286434c541ad31a2caf87ecf1e2a9c9b5d4
Opcode Fuzzy Hash: 8b88619763fd6254d6488ec5cab92517c73cd71dc51d716d7c88cefd0b034ed1
Instruction Fuzzy Hash: D4319F72201214BFEB109F50DC4AFEB3FA9EF09765F040069FE08AA295D6759C41CB68

Uniqueness

Uniqueness Score: 0.16%

Function 00423469, Relevance: 12.1, APIs: 8, Instructions: 91UNIQUELIBRARYCODE

APIs

__lock.LIBCMT ref: 00423477

Part of subcall function 00429E4B: __mtinitlocknum.LIBCMT ref: 00429E5D
Part of subcall function 00429E4B: EnterCriticalSection.KERNEL32(?,?,0042345E,00000008,00422E99,004BBB50,0000000C,00422F8B,?,?,00401014,0043B7A9), ref: 00429E76

RtlDecodePointer.NTDLL(004BBB70), ref: 004234B6
RtlDecodePointer.NTDLL ref: 004234C7
EncodePointer.KERNEL32(00000000,?,00423310,000000FF,?,00429E6E,00000011,?,?,0042345E,00000008,00422E99,004BBB50,0000000C,00422F8B,?), ref: 004234E0
RtlDecodePointer.NTDLL(-00000004), ref: 004234F0
EncodePointer.KERNEL32(00000000,?,00423310,000000FF,?,00429E6E,00000011,?,?,0042345E,00000008,00422E99,004BBB50,0000000C,00422F8B,?), ref: 004234F6
RtlDecodePointer.NTDLL ref: 0042350C
RtlDecodePointer.NTDLL ref: 00423517

Part of subcall function 00429FB5: LeaveCriticalSection.KERNEL32(?,00429D1B,0000000D,00429CD6), ref: 00429FC2

Part of subcall function 004232DF: ___crtCorExitProcess.LIBCMT ref: 004232E5
Part of subcall function 004232DF: ExitProcess.KERNEL32 ref: 004232EE

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pointer$Decode$CriticalEncodeExitProcessSection$EnterLeave___crt__lock__mtinitlocknum
String ID:
API String ID: 3532926286-0
Opcode ID: 3eb54479496a14f96af1a539c1c71f4a2dd7fdd1fba2ad2f8c082ffa494553fc
Instruction ID: 8c72c2951835608107e4db8e866895b11fbebaeedbe16d100f1f63f8c378f011
Opcode Fuzzy Hash: 3eb54479496a14f96af1a539c1c71f4a2dd7fdd1fba2ad2f8c082ffa494553fc
Instruction Fuzzy Hash: 20317231A04329AEDF50AF65E84579D7AB1BB48315F94447FE408A6291DFBD0A84CB1C

Uniqueness

Uniqueness Score: 100.00%

Function 00401424, Relevance: 10.7, APIs: 7, Instructions: 219COMMON

APIs

Part of subcall function 004012F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0040134D
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040135C
Part of subcall function 004012F3: BeginPath.GDI32(?), ref: 00401373
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040139C
Part of subcall function 004012F3: DeleteObject.GDI32(00000000), ref: 0043B8B6

Part of subcall function 004013B0: EndPath.GDI32(?), ref: 004013BF
Part of subcall function 004013B0: StrokeAndFillPath.GDI32(?), ref: 004013DB
Part of subcall function 004013B0: SelectObject.GDI32(?,00000000), ref: 004013EE
Part of subcall function 004013B0: DeleteObject.GDI32 ref: 00401401
Part of subcall function 004013B0: StrokePath.GDI32(?), ref: 0040141C

MoveToEx.GDI32(?,000000FE,?,00000000), ref: 0043B8CD
AngleArc.GDI32(?,000000FE,?,?,-00000010,-00000010), ref: 0043B90E
LineTo.GDI32(?,000000FE,?), ref: 0043B919
CloseFigure.GDI32(?), ref: 0043B920
Ellipse.GDI32(?,000000FE,?,?,00000000), ref: 0043B967
Rectangle.GDI32(?,000000FE,?,00000000,00000000), ref: 0043B9C2
SetPixel.GDI32(?,000000FE,?,?), ref: 0043B9FE

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Object$Path$Select$DeleteStroke$AngleBeginCloseCreateEllipseFigureFillLineMovePixelRectangle
String ID:
API String ID: 304495578-0
Opcode ID: f0a8001532de9112e9a68fc3d0de63e40e79399ac015fb4f5a0f866fb1fca3e0
Instruction ID: 504086b8ac0d12f7a80c9a28070c24604f60f8592932f63d6c8978218f7d0df9
Opcode Fuzzy Hash: f0a8001532de9112e9a68fc3d0de63e40e79399ac015fb4f5a0f866fb1fca3e0
Instruction Fuzzy Hash: CF718170900109EFCB04DF94CC84EBFBB74FF85314F10816AF915AA2A1C738AA11CBA9

Uniqueness

Uniqueness Score: 0.14%

Function 0048B60B, Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

APIs

IsWindow.USER32(00BD7938), ref: 0048B6A5
IsWindowEnabled.USER32(00BD7938), ref: 0048B6B1

Part of subcall function 00402344: GetCursorPos.USER32(?), ref: 00402357
Part of subcall function 00402344: ScreenToClient.USER32(004C67B0,?), ref: 00402374
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000001), ref: 00402399
Part of subcall function 00402344: GetAsyncKeyState.USER32(00000002), ref: 004023A7
Part of subcall function 00402344: GetWindowLongW.USER32(?,000000F0), ref: 0043C23A

SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0048B795
SendMessageW.USER32(00BD7938,000000B0,?,?), ref: 0048B7CC
IsDlgButtonChecked.USER32(?,?), ref: 0048B809
GetWindowLongW.USER32(00BD7938,000000EC), ref: 0048B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0048B843

Part of subcall function 0048B958: ShowWindow.USER32(004C67B0,00000000), ref: 0048B9CC
Part of subcall function 0048B958: EnableWindow.USER32(00000000,00000000), ref: 0048B9F0
Part of subcall function 0048B958: ShowWindow.USER32(004C67B0,00000000), ref: 0048BA50
Part of subcall function 0048B958: ShowWindow.USER32(00000000,00000004), ref: 0048BA62
Part of subcall function 0048B958: EnableWindow.USER32(00000000,00000001), ref: 0048BA86
Part of subcall function 0048B958: SendMessageW.USER32(?,0000130C,?,00000000), ref: 0048BAA9

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$MessageSend$Show$AsyncEnableLongState$ButtonCheckedClientCursorEnabledScreen
String ID:
API String ID: 393453039-0
Opcode ID: 84af26136d8c29eb5394fcac6202117ecf921a8f23c00558381dcf7e1411423a
Instruction ID: a7d0881697c90ebb8ac62a69b5506f8dd5c31139f9226510073890e22dad6404
Opcode Fuzzy Hash: 84af26136d8c29eb5394fcac6202117ecf921a8f23c00558381dcf7e1411423a
Instruction Fuzzy Hash: 3A719034600304AFDB20AF64C894FAE7BB9FF49300F15486EE945A7361D739A841DB9D

Uniqueness

Uniqueness Score: 0.43%

Function 0046589F, Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

APIs

GetLocalTime.KERNEL32(?,00000200,?), ref: 004658AC
_wcsncpy.LIBCMT ref: 004658E1
_wcsncpy.LIBCMT ref: 00465913
_wcsncpy.LIBCMT ref: 00465946
_wcsncpy.LIBCMT ref: 00465988
_wcsncpy.LIBCMT ref: 004659C2
_wcsncpy.LIBCMT ref: 004659F1

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 7a73a9d8b045da8df5336bb66c02e39a5d5c0cabf30c4969930a264d4c6a1f2d
Instruction ID: 239261fae8d9192360add67fc14eaad88e6f5f5f9fe45dd7678ebb12787c5eaa
Opcode Fuzzy Hash: 7a73a9d8b045da8df5336bb66c02e39a5d5c0cabf30c4969930a264d4c6a1f2d
Instruction Fuzzy Hash: 514193A5D2012476CB10EBB598869CFB3A89F45710F90885BE518E3111F638E754C7AE

Uniqueness

Uniqueness Score: 0.47%

Function 00487500, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

APIs

_memset.LIBCMT ref: 00487519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004875C0
IsMenu.USER32(?), ref: 004875D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00487620
DrawMenuBar.USER32 ref: 00487633

Strings

0, xrefs: 0048750D

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: edeaa6d0161f0f44574b9eae0ef1f6fd71eb3f1ff2b29b23cea93bbffdc13975
Instruction ID: 244ebd32b8f97b81259969125f729c00c6f494ffb7d64cbbbf547a27778ec249
Opcode Fuzzy Hash: edeaa6d0161f0f44574b9eae0ef1f6fd71eb3f1ff2b29b23cea93bbffdc13975
Instruction Fuzzy Hash: 29414775A05608EFDB10EF58D894E9EBBB8FB04320F14882AE915A7390D734ED51CFA4

Uniqueness

Uniqueness Score: 2.20%

Function 0045DFDC, Relevance: 10.6, APIs: 7, Instructions: 96COMMON

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,?,00000000), ref: 0045E01F

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0045E045
#2.OLEAUT32(00000000), ref: 0045E048
#2.OLEAUT32(?,00000000,?,00000000), ref: 0045E066
#6.OLEAUT32(?), ref: 0045E06F
StringFromGUID2.OLE32(?,?,00000028), ref: 0045E094
#2.OLEAUT32(?), ref: 0045E0A2

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ByteCharMultiWide$Exception@8FromStringThrowstd::exception::exception
String ID:
API String ID: 3545288400-0
Opcode ID: af460b2bfc03720ca398b6ffa2b4e5f1af1e65bd73a91500510b5d50cf2b39cb
Instruction ID: 76de9d1de624e2530b4d2fb0faa612057c709ef15b4b14118b0da445987e5ca9
Opcode Fuzzy Hash: af460b2bfc03720ca398b6ffa2b4e5f1af1e65bd73a91500510b5d50cf2b39cb
Instruction Fuzzy Hash: 0121D33260022DAF9B109FA9DC48DBF73ECEF08761B14843AFD14DB291D6B49D498768

Uniqueness

Uniqueness Score: 0.93%

Function 0045E0B5, Relevance: 10.6, APIs: 7, Instructions: 91COMMON

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,00000008), ref: 0045E0FA

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0045E120
#2.OLEAUT32(00000000), ref: 0045E123
#2.OLEAUT32(?,?,00000008), ref: 0045E144
#6.OLEAUT32(?), ref: 0045E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 0045E167
#2.OLEAUT32(?), ref: 0045E175

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ByteCharMultiWide$Exception@8FromStringThrowstd::exception::exception
String ID:
API String ID: 3545288400-0
Opcode ID: 59cdd7dab105c60b17e77c3d1b717de4bc98b19c03b579669a9f6d2ca5b990ba
Instruction ID: 67c9d3dc381654df01c0c22ef12326e1a14a94d41d6a64db7bb41e680024eb02
Opcode Fuzzy Hash: 59cdd7dab105c60b17e77c3d1b717de4bc98b19c03b579669a9f6d2ca5b990ba
Instruction Fuzzy Hash: E721D671200518BF9B14AFA9DC88CAB73ECEB09761B10813AFD54CB2A1DB74DD458B68

Uniqueness

Uniqueness Score: 0.93%

Function 0045FB6E, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

APIs

__wcsnicmp.LIBCMT ref: 0045FB81

Part of subcall function 00423A0B: __wcsnicmp_l.LIBCMT ref: 00423AB4

__wcsnicmp.LIBCMT ref: 0045FBA2
__wcsnicmp.LIBCMT ref: 0045FBBC

Part of subcall function 0041FEC6: _wcscpy.LIBCMT ref: 0041FEE9

Strings

#OnAutoItStartRegister, xrefs: 0045FBB6
#requireadmin, xrefs: 0045FB9C
#notrayicon, xrefs: 0045FB79

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: __wcsnicmp$__wcsnicmp_l_wcscpy
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 194375947-2734436370
Opcode ID: 0e925c03f4af0fe31e00a2424debd37a6ffe6a5a1180d0815f1f539b658e43cf
Instruction ID: 566f03899e7f3434533f03e94b1724d4296a521f6068b5759495cbded75bf72e
Opcode Fuzzy Hash: 0e925c03f4af0fe31e00a2424debd37a6ffe6a5a1180d0815f1f539b658e43cf
Instruction Fuzzy Hash: 17214B32200264A6D231A621ED12FA77398AF51305F50403BFD8587683E75CAD8E929F

Uniqueness

Uniqueness Score: 2.48%

Function 0048783C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 004878A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 004878AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 004878B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 004878C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 004878D4

Strings

Msctls_Progress32, xrefs: 00487872

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectShowStock
String ID: Msctls_Progress32
API String ID: 269107984-3636473452
Opcode ID: f7bc9240e14bc4aef0fe5bbffa24766386ea0ca3a5f7e24fad0349575530a0aa
Instruction ID: 92253c4dff29aad24290472b4db2c2572747c1f81b0a32cfc704e08449bf8f20
Opcode Fuzzy Hash: f7bc9240e14bc4aef0fe5bbffa24766386ea0ca3a5f7e24fad0349575530a0aa
Instruction Fuzzy Hash: 281104B2540219BFEF15AF60CC85EEB7F6DEF08798F114115FA04A2090CB769C21DBA4

Uniqueness

Uniqueness Score: 0.15%

Function 00429D26, Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

APIs

__init_pointers.LIBCMT ref: 00429D26

Part of subcall function 004233C7: RtlEncodePointer.NTDLL(00000000), ref: 004233CA
Part of subcall function 004233C7: __initp_misc_winsig.LIBCMT ref: 004233E5
Part of subcall function 004233C7: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0042A0E0
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0042A0F4
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0042A107
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0042A11A
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0042A12D
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0042A140
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0042A153
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0042A166
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0042A179
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0042A18C
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0042A19F
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0042A1B2
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0042A1C5
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0042A1D8
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0042A1EB
Part of subcall function 004233C7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0042A1FE

__mtinitlocks.LIBCMT ref: 00429D2B
__mtterm.LIBCMT ref: 00429D34

Part of subcall function 00429D9C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00429D39,00427F0D,004BBD38,00000014), ref: 00429E96
Part of subcall function 00429D9C: _free.LIBCMT ref: 00429E9D
Part of subcall function 00429D9C: DeleteCriticalSection.KERNEL32(0BL,?,?,00429D39,00427F0D,004BBD38,00000014), ref: 00429EBF

__calloc_crt.LIBCMT ref: 00429D59

Part of subcall function 00428A15: __calloc_impl.LIBCMT ref: 00428A24

__mtterm.LIBCMT ref: 00429D93

Part of subcall function 0042A026: TlsSetValue.KERNEL32(?,?,?,00429C40,00000000,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62), ref: 0042A040

__initptd.LIBCMT ref: 00429D7B

Part of subcall function 00429C73: __lock.LIBCMT ref: 00429CB7
Part of subcall function 00429C73: __lock.LIBCMT ref: 00429CD8
Part of subcall function 00429C73: ___addlocaleref.LIBCMT ref: 00429CF6

GetCurrentThreadId.KERNEL32(00427F0D,004BBD38,00000014), ref: 00429D82

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection__lock__mtterm$CurrentEncodeHandleModulePointerThreadValue___addlocaleref__calloc_crt__calloc_impl__init_pointers__initp_misc_winsig__initptd__mtinitlocks_free
String ID:
API String ID: 335892217-0
Opcode ID: 0032ce98d80b6da20572b252ff7a2ec3726a0071997436604a018428a97a3cd4
Instruction ID: 3a4ad7869198ffd9109903b6ff0dd43e1d919ab51d7ec4b7e1e30be07ee80a48
Opcode Fuzzy Hash: 0032ce98d80b6da20572b252ff7a2ec3726a0071997436604a018428a97a3cd4
Instruction Fuzzy Hash: EEF06D727297316AF6347B7ABC0668A2694DF01738FA04A2FF458D51E2EF1C8C41559C

Uniqueness

Uniqueness Score: 1.97%

Function 004241CA, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderUNIQUE

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize), ref: 004241E3
GetProcAddress.KERNEL32(00000000), ref: 004241EA
EncodePointer.KERNEL32(00000000), ref: 004241F6
DecodePointer.KERNEL32(00000001), ref: 00424213

Strings

RoInitialize, xrefs: 004241D2
combase.dll, xrefs: 004241DE

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 5bccab6494b523de4f89304bf15fd68300b1f9e2fdfa0f03ecf7e752e13a8ef8
Instruction ID: 554aba7e706935eef98d5f48fecafe8f14f9d0301701379c1545929dc36dfa4f
Opcode Fuzzy Hash: 5bccab6494b523de4f89304bf15fd68300b1f9e2fdfa0f03ecf7e752e13a8ef8
Instruction Fuzzy Hash: 8EE09AB0690300AEEF911F70ED4DF083A95ABA0B02F644839B851D10A0DBF940A89B0C

Uniqueness

Uniqueness Score: 100.00%

Function 0042429E, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderUNIQUELIBRARYCODE

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,004241B8), ref: 004242B8
GetProcAddress.KERNEL32(00000000), ref: 004242BF
EncodePointer.KERNEL32(00000000), ref: 004242CA
DecodePointer.KERNEL32(004241B8), ref: 004242E5

Strings

combase.dll, xrefs: 004242B3
RoUninitialize, xrefs: 004242A7

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 38a029e66ea7d27f7a9163d1d7d860f5c65e6d37c153c2e42146312fef8db417
Instruction ID: 15b1a5aa7e18a967cd8893ea7d93c869ab9a07ceb3ae99f86fd7b01cca389b21
Opcode Fuzzy Hash: 38a029e66ea7d27f7a9163d1d7d860f5c65e6d37c153c2e42146312fef8db417
Instruction Fuzzy Hash: 71E04F78681300EFDB409B21FE0CF493AA4F750742F140539F041D11A0CFB84644CB1C

Uniqueness

Uniqueness Score: 100.00%

Function 00401DB3, Relevance: 9.3, APIs: 6, Instructions: 254COMMON

APIs

GetClientRect.USER32(?,?), ref: 00401DDC
GetWindowRect.USER32(?,?), ref: 00401E1D
ScreenToClient.USER32(?,?), ref: 00401E45
GetClientRect.USER32(?,?), ref: 00401F74
GetWindowRect.USER32(?,?), ref: 00401F8D
GetSystemMetrics.USER32(0000000F), ref: 0043BD81

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Rect$Client$Window$MetricsScreenSystem
String ID:
API String ID: 3220332590-0
Opcode ID: d137a9c50dddbd1c864f695680de21518bce5053a59fcecd0cad3697e154db73
Instruction ID: ed51bef88b18f13e8c67287d0da0124a028b815528b7051244985eeafb7c58ca
Opcode Fuzzy Hash: d137a9c50dddbd1c864f695680de21518bce5053a59fcecd0cad3697e154db73
Instruction Fuzzy Hash: 6BB14E7990024ADBDF10CFA8C5807EEB7B1FF08310F14952AED59AB361DB34A951CB99

Uniqueness

Uniqueness Score: 0.15%

Function 0046675A, Relevance: 9.2, APIs: 6, Instructions: 205COMMON

APIs

Part of subcall function 00465B29: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,?,004667E1,00000000,00000000), ref: 00465B55
Part of subcall function 00465B29: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,004667E1,00000000,00000000,00000000,?), ref: 00465B7C

_memmove.LIBCMT ref: 004667E8

Part of subcall function 004079AB: _memmove.LIBCMT ref: 004079F9

_memmove.LIBCMT ref: 0046685B

Part of subcall function 0046573E: _strlen.LIBCMT ref: 00465756
Part of subcall function 0046573E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,?,00000000,?,00000000,?,00466870), ref: 00465769
Part of subcall function 0046573E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,?,00466870), ref: 0046579D

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 004668AD

Part of subcall function 00409997: __itow.LIBCMT ref: 004099C2
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9B1
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9DD
Part of subcall function 00409997: __i64tow.LIBCMT ref: 0043FA0F

_memmove.LIBCMT ref: 00466942
_memmove.LIBCMT ref: 0046695B
_memmove.LIBCMT ref: 00466977

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$ByteCharMultiWide$_wcscpy$Exception@8Throw__i64tow__itow_strlenstd::exception::exception
String ID:
API String ID: 305090657-0
Opcode ID: 322fe69d82f4268864c5f2193f02a8dbd5e3296036215b5cbfbf802dc769ace7
Instruction ID: 6f91ede795408b0bfae053ebd451bddb5c2729c6fb0f0f0f08a4ed72ad27e223
Opcode Fuzzy Hash: 322fe69d82f4268864c5f2193f02a8dbd5e3296036215b5cbfbf802dc769ace7
Instruction Fuzzy Hash: C9619F7060025A9BDF11EF66C881EFE37A4AF0430CF45452EF8556B2D2EB38AD05CB5A

Uniqueness

Uniqueness Score: 0.36%

Function 0045F3DD, Relevance: 9.2, APIs: 6, Instructions: 159UNIQUE

APIs

#8.OLEAUT32(?,?,?), ref: 0045F3F7
#9.OLEAUT32(00000013,?,?), ref: 0045F469
#9.OLEAUT32(00000000,?,?), ref: 0045F4C4
_memmove.LIBCMT ref: 0045F4EE
#9.OLEAUT32(?,?,?), ref: 0045F53B
#12.OLEAUT32(?,?,00000000,00000013,?,?), ref: 0045F569

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: e0e4c2a5e8745864faa56e5889f7aed8dc9d36647b4b934b0d9476528ef57ffe
Instruction ID: 2e2eaad49763833bbcfc7c68f572f088d5f8d2798b4c1c5c41ffca29e6c5e6c5
Opcode Fuzzy Hash: e0e4c2a5e8745864faa56e5889f7aed8dc9d36647b4b934b0d9476528ef57ffe
Instruction Fuzzy Hash: E6517BB5A00209EFCB10CF58D880AAAB7B8FF4C354B15856AED59DB301E734E915CFA5

Uniqueness

Uniqueness Score: 100.00%

Function 004626F9, Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

APIs

_memset.LIBCMT ref: 00462747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00462792
IsMenu.USER32(00000000), ref: 004627B2
CreatePopupMenu.USER32 ref: 004627E6

Part of subcall function 00462C42: _memset.LIBCMT ref: 00462CAF
Part of subcall function 00462C42: GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00462CCB
Part of subcall function 00462C42: DeleteMenu.USER32(?,00000007,00000000), ref: 00462D11
Part of subcall function 00462C42: DeleteMenu.USER32(?,00000000,00000000), ref: 00462D5A

GetMenuItemCount.USER32(000000FF), ref: 00462844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00462875

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Menu$Item$DeleteInfo_memset$CountCreateInsertPopup
String ID:
API String ID: 1721661707-0
Opcode ID: 26be2bb6517104d0e06652614555473398c1a5c4668b3e74760e83b0a7226d5a
Instruction ID: ae907cd3f2aa1f5fb6f168798142b7ed047680f4cd9d897be70698fd7a4ddbb7
Opcode Fuzzy Hash: 26be2bb6517104d0e06652614555473398c1a5c4668b3e74760e83b0a7226d5a
Instruction Fuzzy Hash: FD51B270A00705FFDF14DF68CE88AAEBBF4AF44314F10462EE4119B291E7B88904CB56

Uniqueness

Uniqueness Score: 2.20%

Function 00401765, Relevance: 9.1, APIs: 6, Instructions: 113COMMON

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

BeginPaint.USER32(?,?), ref: 0040179A
GetWindowRect.USER32(?,?), ref: 004017FE
ScreenToClient.USER32(?,?), ref: 0040181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0040182C
EndPaint.USER32(?,?), ref: 00401876

Part of subcall function 004012F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0040134D
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040135C
Part of subcall function 004012F3: BeginPath.GDI32(?), ref: 00401373
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040139C
Part of subcall function 004012F3: DeleteObject.GDI32(00000000), ref: 0043B8B6

Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0043BACB

Part of subcall function 004013B0: EndPath.GDI32(?), ref: 004013BF
Part of subcall function 004013B0: StrokeAndFillPath.GDI32(?), ref: 004013DB
Part of subcall function 004013B0: SelectObject.GDI32(?,00000000), ref: 004013EE
Part of subcall function 004013B0: DeleteObject.GDI32 ref: 00401401
Part of subcall function 004013B0: StrokePath.GDI32(?), ref: 0040141C

Part of subcall function 00401424: MoveToEx.GDI32(?,000000FE,?,00000000), ref: 0043B8CD
Part of subcall function 00401424: AngleArc.GDI32(?,000000FE,?,?,-00000010,-00000010), ref: 0043B90E
Part of subcall function 00401424: LineTo.GDI32(?,000000FE,?), ref: 0043B919
Part of subcall function 00401424: CloseFigure.GDI32(?), ref: 0043B920
Part of subcall function 00401424: Ellipse.GDI32(?,000000FE,?,?,00000000), ref: 0043B967
Part of subcall function 00401424: Rectangle.GDI32(?,000000FE,?,00000000,00000000), ref: 0043B9C2
Part of subcall function 00401424: SetPixel.GDI32(?,000000FE,?,?), ref: 0043B9FE

Part of subcall function 0040152E: BeginPath.GDI32(00000000), ref: 0040154C
Part of subcall function 0040152E: PolyDraw.GDI32(00000000,00000002,?,?), ref: 004015C3
Part of subcall function 0040152E: PolyDraw.GDI32(00000000,00000002,00000810,?), ref: 00401602

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ObjectPath$BeginSelect$DeleteDrawPaintPolyRectangleStrokeWindow$AngleClientCloseCreateEllipseFigureFillLineLongMovePixelRectScreenViewport
String ID:
API String ID: 248873171-0
Opcode ID: 56be482601004f4b1705778519a4c5320a5bfaca86b85f6e7b93d582801014dc
Instruction ID: f496b0d24a919446a821901bb08c967343d20a2d6e91284dadc4af8012d8984c
Opcode Fuzzy Hash: 56be482601004f4b1705778519a4c5320a5bfaca86b85f6e7b93d582801014dc
Instruction Fuzzy Hash: F8418C71100200AFD710EF25C884FAA7BE8EB49724F044A3EFA94962F1C7359946DB6A

Uniqueness

Uniqueness Score: 0.16%

Function 0048B958, Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

APIs

ShowWindow.USER32(004C67B0,00000000), ref: 0048B9CC
EnableWindow.USER32(00000000,00000000), ref: 0048B9F0
ShowWindow.USER32(004C67B0,00000000), ref: 0048BA50
ShowWindow.USER32(00000000,00000004), ref: 0048BA62
EnableWindow.USER32(00000000,00000001), ref: 0048BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0048BAA9

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 7ca0fe6c9807323bcc0ac8ff00a913c3fb6576fd02a22b3a16232a66ac7b93cd
Instruction ID: 4bbfffa5aca34bc284a6f875752b5b7a56a0dd7a11c68d007de5de2d50af2dcc
Opcode Fuzzy Hash: 7ca0fe6c9807323bcc0ac8ff00a913c3fb6576fd02a22b3a16232a66ac7b93cd
Instruction Fuzzy Hash: 6E416470600241EFDB25DF14C489B9A7BE0FF05314F1846BAEE589F3A2C735A84ADB95

Uniqueness

Uniqueness Score: 0.15%

Function 0045BC53, Relevance: 9.1, APIs: 6, Instructions: 51COMMON

APIs

Part of subcall function 00457631: CLSIDFromProgID.OLE32 ref: 0045766F
Part of subcall function 00457631: ProgIDFromCLSID.OLE32(?,00000000), ref: 0045768A
Part of subcall function 00457631: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0045758C,80070057,?,?), ref: 00457698
Part of subcall function 00457631: CoTaskMemFree.OLE32(00000000), ref: 004576A8
Part of subcall function 00457631: CLSIDFromString.OLE32(?,?), ref: 004576B4

GetDC.USER32(00000000), ref: 0045BC78
GetDeviceCaps.GDI32(00000000,00000058), ref: 0045BC89
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0045BC90
ReleaseDC.USER32(00000000,00000000), ref: 0045BC98
MulDiv.KERNEL32(000009EC,0045B928,00000000), ref: 0045BCAF
MulDiv.KERNEL32(000009EC,016A52EC,?), ref: 0045BCC1

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: From$CapsDeviceProg$FreeReleaseStringTasklstrcmpi
String ID:
API String ID: 2627017686-0
Opcode ID: 27d5f6c0d5386ce97d9d35851ba942d0fe3d4e9262dd3fedd2d873a9d9f17fda
Instruction ID: 7f9c1bc2a87cc2331d83c7cbd88c6f2eb8871b90a119ce95a65b068cf2fd8a08
Opcode Fuzzy Hash: 27d5f6c0d5386ce97d9d35851ba942d0fe3d4e9262dd3fedd2d873a9d9f17fda
Instruction Fuzzy Hash: CD018871E407097BDB105FB55C49E5EBFA8DB44761F10407AFE04A7391DA308C15CB94

Uniqueness

Uniqueness Score: 0.12%

Function 0048C19A, Relevance: 9.0, APIs: 6, Instructions: 50COMMON

APIs

Part of subcall function 004012F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0040134D
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040135C
Part of subcall function 004012F3: BeginPath.GDI32(?), ref: 00401373
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040139C
Part of subcall function 004012F3: DeleteObject.GDI32(00000000), ref: 0043B8B6

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0048C1C4
LineTo.GDI32(00000000,00000003,?), ref: 0048C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0048C1E6
LineTo.GDI32(00000000,00000000,?), ref: 0048C1F6
EndPath.GDI32(00000000), ref: 0048C206
StrokePath.GDI32(00000000), ref: 0048C216

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
String ID:
API String ID: 372113273-0
Opcode ID: 50c0785a0f867adaeafbee75c91b230cbac4e515806904eb16af30bcadf3702c
Instruction ID: 89b87adcafcd02c20156ebc744166949cd87f219d271a2b64e3a0db778f8eb43
Opcode Fuzzy Hash: 50c0785a0f867adaeafbee75c91b230cbac4e515806904eb16af30bcadf3702c
Instruction Fuzzy Hash: E5111B7640010CBFDB11AF90DC88EAA7FADEB04394F048476BE185A1A1C7719E55DBA4

Uniqueness

Uniqueness Score: 0.15%

Function 00462C42, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

APIs

_memset.LIBCMT ref: 00462CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00462CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00462D11
DeleteMenu.USER32(?,00000000,00000000), ref: 00462D5A

Part of subcall function 00407E8C: _memmove.LIBCMT ref: 00407ED5

Strings

0, xrefs: 00462CA4

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memmove_memset
String ID: 0
API String ID: 2152430080-4108050209
Opcode ID: f198ced482b16800fe01b2f039e7944b992b1629c250c68e53310c846a39f2ef
Instruction ID: 0ba1456fd131f45ac79e83895ae1ccd7d82afcfcc3e6ebc7136bcd4d9a7bd99d
Opcode Fuzzy Hash: f198ced482b16800fe01b2f039e7944b992b1629c250c68e53310c846a39f2ef
Instruction Fuzzy Hash: F8419130204702AFD720DF25C944B5BB7E4AF85324F14462EF96597291E7B8E904CBAB

Uniqueness

Uniqueness Score: 1.85%

Function 0040410D, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowUNIQUE

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0043D5EC

Part of subcall function 00407D2C: _memmove.LIBCMT ref: 00407D66

_memset.LIBCMT ref: 0040418D

Part of subcall function 0040463E: _wcsncpy.LIBCMT ref: 00404652

_wcscpy.LIBCMT ref: 004041E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 004041F1

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

Strings

Line: , xrefs: 0043D615

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$IconLoadNotifyShell_String_memset_wcscpy_wcsncpy
String ID: Line:
API String ID: 3448885215-1585850449
Opcode ID: 4dabcb287aa0014f2b865201e2cf0eafda2d30f8a4c5563cc53a3e2912b2ce29
Instruction ID: 58a74a7614972f0f445e6137c0dd90b430b5bf5ec00f8e3566b7ff54c1cdf52a
Opcode Fuzzy Hash: 4dabcb287aa0014f2b865201e2cf0eafda2d30f8a4c5563cc53a3e2912b2ce29
Instruction Fuzzy Hash: 8B31C171408304AAD761EB60DC45FDB73E8AF44304F10497FB184A21D1EB78A649C79F

Uniqueness

Uniqueness Score: 100.00%

Function 00486656, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowlibraryCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 004866D0
LoadLibraryW.KERNEL32(?), ref: 004866D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 004866EC
DestroyWindow.USER32(?), ref: 004866F4

Strings

SysAnimate32, xrefs: 004866AB

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSendWindow$CreateDestroyLibraryLoadObjectShowStock
String ID: SysAnimate32
API String ID: 2125232845-1011021900
Opcode ID: 6ff0cea8df7c8dbd966367875cc0fa59ce0a78d58aa6e2900808d1d81c72dfb1
Instruction ID: 107bb2381c9b110c9a3b8e0dc5be6575e68445ddc2201bb672f8ab0b69eab8f0
Opcode Fuzzy Hash: 6ff0cea8df7c8dbd966367875cc0fa59ce0a78d58aa6e2900808d1d81c72dfb1
Instruction Fuzzy Hash: 6E21D471100205BFEF506F64EC80EBF37ADEF55328F114A2AF910A2290E779CC419769

Uniqueness

Uniqueness Score: 0.15%

Function 00401D35, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53windowCOMMON

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
GetStockObject.GDI32(00000011), ref: 00401D87
SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
ShowWindow.USER32(00000000,00000000), ref: 0043BD22

Strings

athan, xrefs: 00401D44

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$CreateMessageObjectSendShowStock
String ID: athan
API String ID: 1358664141-369431050
Opcode ID: 6ef78ac23a4bd727a3300ca9299958f8ec95875dc6640e3e56f2f55486011c29
Instruction ID: bcc18056a9f9bf7612c1f1802b6de8f9928d6a82d4ed00d2f4876380ead3997e
Opcode Fuzzy Hash: 6ef78ac23a4bd727a3300ca9299958f8ec95875dc6640e3e56f2f55486011c29
Instruction Fuzzy Hash: 0D11A172501108BFEF018F90DC44EEB7B69FF48354F440126FA0462160C739EC60DBA4

Uniqueness

Uniqueness Score: 2.04%

Function 004241C9, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderUNIQUELIBRARYCODE

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize), ref: 004241E3
GetProcAddress.KERNEL32(00000000), ref: 004241EA
EncodePointer.KERNEL32(00000000), ref: 004241F6
DecodePointer.KERNEL32(00000001), ref: 00424213

Strings

RoInitialize, xrefs: 004241D2
combase.dll, xrefs: 004241DE

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: dd13c08ab37e80bf1927b8ff06d098bbfda6e910d72f62f948d3123e59d291c0
Instruction ID: 4a732e24270c1dda5bee5a6c288e9bc2dfac411a4ff9226b3ae07dfd94810194
Opcode Fuzzy Hash: dd13c08ab37e80bf1927b8ff06d098bbfda6e910d72f62f948d3123e59d291c0
Instruction Fuzzy Hash: 5EE01770391300AAEF612BB1ED0DF193994ABA0B43FA08979B551E40E0DBE944999B1C

Uniqueness

Uniqueness Score: 100.00%

Function 0042564D, Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

APIs

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

_memset.LIBCMT ref: 004256AB
_memcpy_s.LIBCMT ref: 0042571D

Part of subcall function 00430F18: _memmove.LIBCMT ref: 00430F51
Part of subcall function 00430F18: _memset.LIBCMT ref: 00430F63

__read_nolock.LIBCMT ref: 0042577B

Part of subcall function 004310AB: __malloc_crt.LIBCMT ref: 00431194
Part of subcall function 004310AB: __lseeki64_nolock.LIBCMT ref: 004311C5
Part of subcall function 004310AB: GetConsoleMode.KERNEL32(00000080,?), ref: 004312A7
Part of subcall function 004310AB: ReadConsoleW.KERNEL32(0048FB24,?,004385D3,?,00000000), ref: 004312D3
Part of subcall function 004310AB: GetLastError.KERNEL32(?,?,?,?,?,0048FB24,00000001,00000000,?,?,?,?,?,?,004385D3,0048FB24), ref: 004312DD
Part of subcall function 004310AB: __dosmaperr.LIBCMT ref: 004312E4
Part of subcall function 004310AB: ReadFile.KERNEL32(0048FB24,?,004385D3,?,00000000), ref: 00431317
Part of subcall function 004310AB: ReadFile.KERNEL32(?,?,00000001,?,00000000), ref: 004313DD
Part of subcall function 004310AB: GetLastError.KERNEL32(?,0048FB24,00000001,00000000,?,?,?,?,?,?,004385D3,0048FB24,00000080,00000003), ref: 004313E7
Part of subcall function 004310AB: __lseeki64_nolock.LIBCMT ref: 00431452
Part of subcall function 004310AB: __lseeki64_nolock.LIBCMT ref: 00431561
Part of subcall function 004310AB: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,004385D3,004385D2,0048FB24,?,?,?,?,?,?,0048FB24,00000001,00000000), ref: 00431580
Part of subcall function 004310AB: _free.LIBCMT ref: 004315B3
Part of subcall function 004310AB: ReadFile.KERNEL32(00000080,00000080,00000002,?,00000000), ref: 004316E6
Part of subcall function 004310AB: GetLastError.KERNEL32(?,0048FB24,00000001,00000000), ref: 004316F0
Part of subcall function 004310AB: __lseeki64_nolock.LIBCMT ref: 0043178A
Part of subcall function 004310AB: GetLastError.KERNEL32(?,0048FB24,00000001,00000000,?,?,?,?,?,?,004385D3,0048FB24,00000080,00000003), ref: 004317E3

__filbuf.LIBCMT ref: 0042579E

Part of subcall function 00430DF7: __getbuf.LIBCMT ref: 00430E47
Part of subcall function 00430DF7: __read.LIBCMT ref: 00430E62

_memset.LIBCMT ref: 004257E2

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ErrorLastRead__lseeki64_nolock$File_memset$Console$ByteCharModeMultiWide__dosmaperr__filbuf__getbuf__getptd_noexit__malloc_crt__read__read_nolock_free_memcpy_s_memmove
String ID:
API String ID: 1189629394-0
Opcode ID: 81411999657e3e763d812df863fa8787a6ab3c9ff8487da223325fcefd1e7ca8
Instruction ID: 8f486d84be92ee44d8014861303fa160b6b430e9f344387c801a4323594451c0
Opcode Fuzzy Hash: 81411999657e3e763d812df863fa8787a6ab3c9ff8487da223325fcefd1e7ca8
Instruction Fuzzy Hash: B951D930B00B25DBDB248F79E88466F77B1AF40324FA4832FF829962D0D7789D518B49

Uniqueness

Uniqueness Score: 3.75%

Function 00402344, Relevance: 7.6, APIs: 5, Instructions: 112keyboardCOMMON

APIs

GetCursorPos.USER32(?), ref: 00402357
ScreenToClient.USER32(004C67B0,?), ref: 00402374
GetAsyncKeyState.USER32(00000001), ref: 00402399
GetAsyncKeyState.USER32(00000002), ref: 004023A7
GetWindowLongW.USER32(?,000000F0), ref: 0043C23A

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: AsyncState$ClientCursorLongScreenWindow
String ID:
API String ID: 3539004672-0
Opcode ID: 669a1d0f0a37f564f98ec4bcb4af65858afb5dfd9ac0662bba3cfdd4afaff2d9
Instruction ID: 29238042452bc89b72d7561f0c30562a95ff63530a210d1cf57cdef7deabd6e5
Opcode Fuzzy Hash: 669a1d0f0a37f564f98ec4bcb4af65858afb5dfd9ac0662bba3cfdd4afaff2d9
Instruction Fuzzy Hash: 44418E31904119FBDF159F69C888AEEBB74FB09324F20436BF828A22D0C7785954DF99

Uniqueness

Uniqueness Score: 0.15%

Function 00437D18, Relevance: 7.6, APIs: 5, Instructions: 97UNIQUE

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00437D3F
_memset.LIBCMT ref: 00437D6A

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,?,00000000,?,?), ref: 00437DC7
GetLastError.KERNEL32(?,?,00000000,?,?), ref: 00437DE3
_memset.LIBCMT ref: 00437DF9

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Locale_memset$ByteCharErrorLastMultiUpdateUpdate::_Wide__getptd_noexit
String ID:
API String ID: 2656132383-0
Opcode ID: f7145d940963119eb4f3d3996d8c164b153efdf4daa21afa6075cccfb0881fbb
Instruction ID: 7f5ea619eb6b50689dbdfc7df0438fc3b478966e5d337f657cdc4e691c036bc5
Opcode Fuzzy Hash: f7145d940963119eb4f3d3996d8c164b153efdf4daa21afa6075cccfb0881fbb
Instruction Fuzzy Hash: 9F31D3B1604261AECB319F55D845ABF3B64AF5A724F00116FF8944A391DB3C8D00CBA9

Uniqueness

Uniqueness Score: 100.00%

Function 0042BBB7, Relevance: 7.6, APIs: 5, Instructions: 89UNIQUE

APIs

_write_string.LIBCMT ref: 0042BBCC
_write_multi_char.LIBCMT ref: 0042BBF0
_write_string.LIBCMT ref: 0042BCD3
_write_multi_char.LIBCMT ref: 0042BCFC
_free.LIBCMT ref: 0042BD0F

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

Part of subcall function 00436415: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043644B
Part of subcall function 00436415: __isleadbyte_l.LIBCMT ref: 00436479
Part of subcall function 00436415: MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,00000000,00000000,?,?,?), ref: 004364A7
Part of subcall function 00436415: MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,00000000,00000000,?,?,?), ref: 004364DD

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ByteCharLocaleMultiWide_write_multi_char_write_string$ErrorFreeHeapLastUpdateUpdate::___isleadbyte_l_free
String ID:
API String ID: 4012235191-0
Opcode ID: 43fcaa2311595ee26eb0551792b4987f89219f237874e847750a236ea191ab6b
Instruction ID: d95ab6f4c365c9705e0be0c3272b6b49070594f36854d8a2ef7646f9e92171a5
Opcode Fuzzy Hash: 43fcaa2311595ee26eb0551792b4987f89219f237874e847750a236ea191ab6b
Instruction Fuzzy Hash: 8731EAF1F101299ADF619B55DC41BEAB7B8EB08304F8444DEF708A2252E7359E948F9C

Uniqueness

Uniqueness Score: 100.00%

Function 0043196E, Relevance: 7.6, APIs: 5, Instructions: 69UNIQUELIBRARYCODE

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,?,00000001), ref: 004319A8
SetFilePointerEx.KERNEL32(00000000,?,?,?,?), ref: 004319BC
GetLastError.KERNEL32(?,?), ref: 004319C2
__dosmaperr.LIBCMT ref: 004319C9
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 004319E2

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: FilePointer$ErrorLast__dosmaperr__getptd_noexit
String ID:
API String ID: 3275556073-0
Opcode ID: 5020ea8c7c08a2c1d974e05f6122347255403b42e583d755c53856760baf4a0f
Instruction ID: 42343e62d8a757b4a28060c1c9b42eb39466e64cca7891ad5fd8ae8a4149cba5
Opcode Fuzzy Hash: 5020ea8c7c08a2c1d974e05f6122347255403b42e583d755c53856760baf4a0f
Instruction Fuzzy Hash: 65113D72611228BFDB115BA89C40FBE3778AF45724F50025BF520A71E1DB78D800C759

Uniqueness

Uniqueness Score: 100.00%

Function 004012F3, Relevance: 7.6, APIs: 5, Instructions: 67COMMON

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0040134D
SelectObject.GDI32(?,00000000), ref: 0040135C
BeginPath.GDI32(?), ref: 00401373

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

SelectObject.GDI32(?,00000000), ref: 0040139C
DeleteObject.GDI32(00000000), ref: 0043B8B6

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Object$CreateSelect$BeginBrushDeletePathSolid
String ID:
API String ID: 1512498296-0
Opcode ID: d4d4c8074a2dddb84468a25ad0c171745cbd4a4b28271cbc8231a5ff8f861484
Instruction ID: 01809ca1199762821c7ccc43aba1927c018ed3358b57c1522327ad2857708082
Opcode Fuzzy Hash: d4d4c8074a2dddb84468a25ad0c171745cbd4a4b28271cbc8231a5ff8f861484
Instruction Fuzzy Hash: 9B213070801304EFEB11AF65DC04B6A7BB8FB00321F55863BF810A62F0D7799995DBA9

Uniqueness

Uniqueness Score: 0.15%

Function 00457631, Relevance: 7.6, APIs: 5, Instructions: 60stringCOMMON

APIs

Part of subcall function 0045810E: RaiseException.KERNEL32(8007000E,?,00000000,00000000,?,00457651,-C0000018,00000001,?,0045758C,80070057,?,?,?,0045799D), ref: 0045811B

CLSIDFromProgID.OLE32 ref: 0045766F
ProgIDFromCLSID.OLE32(?,00000000), ref: 0045768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0045758C,80070057,?,?), ref: 00457698
CoTaskMemFree.OLE32(00000000), ref: 004576A8
CLSIDFromString.OLE32(?,?), ref: 004576B4

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: From$Prog$ExceptionFreeRaiseStringTasklstrcmpi
String ID:
API String ID: 450394209-0
Opcode ID: bc25b6519a94f10dbb251a0eebce8836490a121c9ede26846711f318317bd882
Instruction ID: 7358ad2804b9dc9911c054a84f83c2ad3ef792169d9fc978e4c4218005fc1a73
Opcode Fuzzy Hash: bc25b6519a94f10dbb251a0eebce8836490a121c9ede26846711f318317bd882
Instruction Fuzzy Hash: 4B11E572604618BBDB105F69EC04B9E7BACEB04762F144439FD08D2212E779DE4487A8

Uniqueness

Uniqueness Score: 0.24%

Function 004654E6, Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,%I,?), ref: 00465502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,%I,?), ref: 00465510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,%I,?), ref: 00465518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,%I,?), ref: 00465522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,%I,?), ref: 0046555E

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 72de52679d9368bff63ea29de6d144572b9e7e287c6a07ba23d639df65210cf3
Instruction ID: 904bb0919bfdc2718e962a82bb6b112c9c46cd464800c0dd09bb372580e459e7
Opcode Fuzzy Hash: 72de52679d9368bff63ea29de6d144572b9e7e287c6a07ba23d639df65210cf3
Instruction Fuzzy Hash: 1A016131D00A19EBCF00DFE8E84D6EDBB78FB09711F04046AE502F2154EB345954C7AA

Uniqueness

Uniqueness Score: 0.22%

Function 004013B0, Relevance: 7.5, APIs: 5, Instructions: 29COMMON

APIs

EndPath.GDI32(?), ref: 004013BF
StrokeAndFillPath.GDI32(?), ref: 004013DB
SelectObject.GDI32(?,00000000), ref: 004013EE
DeleteObject.GDI32 ref: 00401401
StrokePath.GDI32(?), ref: 0040141C

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 61c54fb263eb1c5a127bc7e68abcd113e5aa2c7f8e8059b9e487d898b006b3c2
Instruction ID: f812cb0b4e4429ed7f7e618ed03f07a0aa621b4c15f073e4694ef7f498b4602e
Opcode Fuzzy Hash: 61c54fb263eb1c5a127bc7e68abcd113e5aa2c7f8e8059b9e487d898b006b3c2
Instruction Fuzzy Hash: 67F01930001208EFDB516F26EC4CB593BA4AB41326F15C639E829941F1C7358999DF28

Uniqueness

Uniqueness Score: 0.17%

Function 0045B7B6, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comUNIQUE

APIs

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Part of subcall function 0045BC53: GetDC.USER32(00000000), ref: 0045BC78
Part of subcall function 0045BC53: GetDeviceCaps.GDI32(00000000,00000058), ref: 0045BC89
Part of subcall function 0045BC53: GetDeviceCaps.GDI32(00000000,0000005A), ref: 0045BC90
Part of subcall function 0045BC53: ReleaseDC.USER32(00000000,00000000), ref: 0045BC98
Part of subcall function 0045BC53: MulDiv.KERNEL32(000009EC,0045B928,00000000), ref: 0045BCAF
Part of subcall function 0045BC53: MulDiv.KERNEL32(000009EC,016A52EC,?), ref: 0045BCC1

OleSetContainedObject.OLE32(0000000C,00000001), ref: 0045B981

Part of subcall function 0045BCCD: OleSetContainedObject.OLE32(?,00000000), ref: 0045BD3F
Part of subcall function 0045BCCD: IsWindow.USER32(?), ref: 0045BD9C
Part of subcall function 0045BCCD: DestroyWindow.USER32(?), ref: 0045BDA9

Part of subcall function 004796DB: GetLastError.KERNEL32(?,00000000,?,0048FB84,?,00000016,?,00000016), ref: 004798A5
Part of subcall function 004796DB: #8.OLEAUT32(?,?,?,?), ref: 00479999
Part of subcall function 004796DB: #9.OLEAUT32(?,0048FB84,00000000,?,?,?,?,?), ref: 00479A43

Strings

Container, xrefs: 0045B8FE
AutoIt3GUI, xrefs: 0045B8F9
%I, xrefs: 0045BA24

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CapsContainedDeviceObjectWindow$DestroyErrorException@8LastReleaseThrowstd::exception::exception
String ID: AutoIt3GUI$Container$%I
API String ID: 2766584483-4251005282
Opcode ID: e3366d33717669e4b2da434cb254173371e57516a3ccaa73b24d99e73dbf7b2a
Instruction ID: fb3361167640a3393b05a66091946d0b3b2d9ad6d528c81b3883d5ecba530668
Opcode Fuzzy Hash: e3366d33717669e4b2da434cb254173371e57516a3ccaa73b24d99e73dbf7b2a
Instruction Fuzzy Hash: 66914B70600601AFDB24DF24C885B6ABBE8FF48711F24856EED49CB392DB74E845CB94

Uniqueness

Uniqueness Score: 100.00%

Function 0042524D, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

APIs

__startOneArgErrorHandling.LIBCMT ref: 004252DD
__powhlp.LIBCMT ref: 00425360

Part of subcall function 00430594: __d_inttype.LIBCMT ref: 00430675

Part of subcall function 00430357: __87except.LIBCMT ref: 0043037B

__startOneArgErrorHandling.LIBCMT ref: 004304CE

Strings

pow, xrefs: 004252B5, 004252D2

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ErrorHandling__start$__87except__d_inttype__powhlp
String ID: pow
API String ID: 2541061979-2276729525
Opcode ID: c0169014571c8a50f035cbb27ee8a623963b058b02fd8f6767b6d6d046ddd236
Instruction ID: af649323224186c0ce66bda7a16df25405c3c0d3a13ea4765fd3bccd6769ca7e
Opcode Fuzzy Hash: c0169014571c8a50f035cbb27ee8a623963b058b02fd8f6767b6d6d046ddd236
Instruction Fuzzy Hash: AC517C21B1C60197C710B724E92137F27949F14350FA0ABABE885823E6EE7C8DD4DA5E

Uniqueness

Uniqueness Score: 0.38%

Function 0042023B, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

APIs

VkKeyScanW.USER32(?), ref: 00455DD0

Part of subcall function 0042313D: __wcsicmp_l.LIBCMT ref: 004231C6

VkKeyScanW.USER32(?), ref: 00455D94

Strings

#, xrefs: 00420280
+, xrefs: 00420277

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Scan$__wcsicmp_l
String ID: #$+
API String ID: 18157523-2552117581
Opcode ID: c3f588f036a4ba9b4624d39f9a59db0ee5a6d78b8ef0bc49354610b206d9ee0f
Instruction ID: 37aff8002e02ada0918aa30981c6d68896c3d675e4df38188cf454e749cffd85
Opcode Fuzzy Hash: c3f588f036a4ba9b4624d39f9a59db0ee5a6d78b8ef0bc49354610b206d9ee0f
Instruction Fuzzy Hash: EB513232200215CBCB14DF28D4986FA7BB0EF55310F548067EC80AB3A2D7389C4ACB69

Uniqueness

Uniqueness Score: 0.24%

Function 00413297, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161UNIQUE

APIs

Part of subcall function 00407E8C: _memmove.LIBCMT ref: 00407ED5

Part of subcall function 00456665: _memmove.LIBCMT ref: 004566AF

Part of subcall function 0042594C: __FF_MSGBANNER.LIBCMT ref: 00425963
Part of subcall function 0042594C: __NMSG_WRITE.LIBCMT ref: 0042596A
Part of subcall function 0042594C: RtlAllocateHeap.NTDLL(00B90000,00000000,00000001,00000000,00000000,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28), ref: 0042598F

_memmove.LIBCMT ref: 004133D7

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

_memmove.LIBCMT ref: 00413470
_free.LIBCMT ref: 00413496

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

_memmove.LIBCMT ref: 00413549

Strings

OaA, xrefs: 00413482

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$Heap$AllocateErrorException@8FreeLastThrow_freestd::exception::exception
String ID: OaA
API String ID: 1824289774-4189730831
Opcode ID: 713b82e7cd0b98b42f3fde1d67b41e05993e2ef778193e917ca86ddc9c684193
Instruction ID: b445b8fa1597fd77ac91e8f36571279a65bd22c4855345799867881e3280ac98
Opcode Fuzzy Hash: 713b82e7cd0b98b42f3fde1d67b41e05993e2ef778193e917ca86ddc9c684193
Instruction Fuzzy Hash: 58518AB16083519FDB24CF29C440B6BBBE1BF85304F45496EE88987351DB39D941CB8A

Uniqueness

Uniqueness Score: 100.00%

Function 00487BB5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00487C4E
GetWindowLongW.USER32 ref: 00487C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00487C7B

Part of subcall function 00402327: PostMessageW.USER32(?,00000028,?,00000001), ref: 0043C1C3
Part of subcall function 00402327: PostMessageW.USER32(?,000000B1,?,?), ref: 0043C1E5

Strings

SysTreeView32, xrefs: 00487C20

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$Message$LongPost$CreateObjectSendShowStock
String ID: SysTreeView32
API String ID: 2301205191-1698111956
Opcode ID: 5703b4fad22214f619a8c8a93990bb24be334a18c808d745d027c9b0d436b63f
Instruction ID: 396bf68d4a42e6562a5606780666b8eb1b1202c22cd254422b80c8fe13e0d72b
Opcode Fuzzy Hash: 5703b4fad22214f619a8c8a93990bb24be334a18c808d745d027c9b0d436b63f
Instruction Fuzzy Hash: D631D231204205ABDB11AF34CC45BDB77A9FF44328F204B2AF875A32E0C739E8559B58

Uniqueness

Uniqueness Score: 0.18%

Function 00487648, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 004876D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 004876E4

Part of subcall function 0046589F: GetLocalTime.KERNEL32(?,00000200,?), ref: 004658AC
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 004658E1
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 00465913
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 00465946
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 00465988
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 004659C2
Part of subcall function 0046589F: _wcsncpy.LIBCMT ref: 004659F1

SendMessageW.USER32(?,00001002,00000000,?), ref: 00487708

Strings

SysMonthCal32, xrefs: 0048769B

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _wcsncpy$MessageSendWindow$CreateLocalObjectShowStockTime
String ID: SysMonthCal32
API String ID: 3258503128-1439706946
Opcode ID: 8df40860f00383b0d6c3c964195447c3cde1b00ce37527eab5e6f159fde48afd
Instruction ID: 1307edf48a77a6559d14c6dee31d15e92fea33bca7a193078042eb65218a36c2
Opcode Fuzzy Hash: 8df40860f00383b0d6c3c964195447c3cde1b00ce37527eab5e6f159fde48afd
Instruction Fuzzy Hash: B421AD32600218ABDF119E94CC52FEF3B69EF48764F210615FA156B1D0DAB9E8548BA4

Uniqueness

Uniqueness Score: 0.16%

Function 00487E02, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

Part of subcall function 00423F79: __wtof_l.LIBCMT ref: 00423F81

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00487EB9
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00487EC7
DestroyWindow.USER32(00000000), ref: 00487ECE

Strings

msctls_updown32, xrefs: 00487E33

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSendWindow$CreateDestroyObjectShowStock__wtof_l
String ID: msctls_updown32
API String ID: 3130516392-2298589950
Opcode ID: 4bf1fa20f404e7782d750a44167e3a69d9818834325eee9861cc63593fdc3cf7
Instruction ID: 1485368da0f86edf0b0b6d6e13098a0258c00c1e58360c3b6b4c0cf3e96c5d84
Opcode Fuzzy Hash: 4bf1fa20f404e7782d750a44167e3a69d9818834325eee9861cc63593fdc3cf7
Instruction Fuzzy Hash: 07216DB5604208AFDB10EF18DC91D7B37ADEF4A398B15486AF9109B391CB75EC118B78

Uniqueness

Uniqueness Score: 0.15%

Function 00486F1F, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00486FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00486FBA
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00486FDF

Strings

Listbox, xrefs: 00486F77

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSendWindow$CreateMoveObjectShowStock
String ID: Listbox
API String ID: 3566057971-2633736733
Opcode ID: 5b1aa1dd4bda49325bd9272afdb14f4a71a8921d49aef0d9818b46d4ce5469eb
Instruction ID: fd605c54c2ac3b50964ebfebf07f6eca260989f51fe9dc9a3e12500301207b21
Opcode Fuzzy Hash: 5b1aa1dd4bda49325bd9272afdb14f4a71a8921d49aef0d9818b46d4ce5469eb
Instruction Fuzzy Hash: 9A21F232610118BFDF51AF54DC84FAF37AAEF89754F128525FB049B290CA75DC1187A4

Uniqueness

Uniqueness Score: 0.17%

Function 00473CDD, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84UNIQUE

APIs

Part of subcall function 00407E0B: _memmove.LIBCMT ref: 0043F1BA

__snwprintf.LIBCMT ref: 00473D5A

Part of subcall function 00407F41: _memmove.LIBCMT ref: 00407F82

Strings

AUTOITCALLVARIABLE%d, xrefs: 00473D4C
%I, xrefs: 00473CE8
, $, xrefs: 00473D9A

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$__snwprintf
String ID: , $$AUTOITCALLVARIABLE%d$%I
API String ID: 1095647463-3751216540
Opcode ID: 73122cb26abe992498e4bf822292f764f54f11a9123fada09ab1a14b240aa1b0
Instruction ID: 991e62ca2d85527952959e0cb6d74c1b8c3b79d2a13ecd2fa9961f4cfe28b1de
Opcode Fuzzy Hash: 73122cb26abe992498e4bf822292f764f54f11a9123fada09ab1a14b240aa1b0
Instruction Fuzzy Hash: DE218671600219AACF10EF65CC81AED7764BF44704F5044AFF409A7281D738EE55DBAA

Uniqueness

Uniqueness Score: 100.00%

Function 0048797D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 004879E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 004879F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00487A03

Strings

msctls_trackbar32, xrefs: 004879B8

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectShowStock
String ID: msctls_trackbar32
API String ID: 269107984-1010561917
Opcode ID: f9de2675f9dbbe1aac8b53f7c0ec9e088f0411dbf2a2d6fcc0aa0f3bf777801e
Instruction ID: 0de93e4c80c6f3c9c16b6b4dc0969efecf6b6414ad0caf4bffc16717d87381f0
Opcode Fuzzy Hash: f9de2675f9dbbe1aac8b53f7c0ec9e088f0411dbf2a2d6fcc0aa0f3bf777801e
Instruction Fuzzy Hash: 9F113A72244208BEEF24AF60CC15FDF37ADEF89764F21491AFA01A61D0D675D811CB64

Uniqueness

Uniqueness Score: 0.15%

Function 00424D3F, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60UNIQUE

APIs

__lock.LIBCMT ref: 00424D49

Part of subcall function 00429E4B: __mtinitlocknum.LIBCMT ref: 00429E5D
Part of subcall function 00429E4B: EnterCriticalSection.KERNEL32(?,?,0042345E,00000008,00422E99,004BBB50,0000000C,00422F8B,?,?,00401014,0043B7A9), ref: 00429E76

Part of subcall function 00426E8D: __lock.LIBCMT ref: 00426E9C
Part of subcall function 00426E8D: EnterCriticalSection.KERNEL32(?,?,00423F0C,00000001,-00000020,004BBB90,0000000C,0046A269,"%s" (%d) : ==> %s:,?,?,?), ref: 00426EB5

__fflush_nolock.LIBCMT ref: 00424D9C
__fflush_nolock.LIBCMT ref: 00424DB8

Part of subcall function 00424C27: __flush.LIBCMT ref: 00424C3C
Part of subcall function 00424C27: __commit.LIBCMT ref: 00424C5B

Strings

@RL, xrefs: 00424D78, 00424D9B, 00424DB7

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CriticalEnterSection__fflush_nolock__lock$__commit__flush__mtinitlocknum
String ID: @RL
API String ID: 1390624775-2017224383
Opcode ID: 923140d8e0922b17943ebdf1c831f994aa8c217c156d5b3504315581c5dc9c21
Instruction ID: 251d2091940ea0a0d9e79db47615ebe748db69126ac2d1bf54aaf532e9e62895
Opcode Fuzzy Hash: 923140d8e0922b17943ebdf1c831f994aa8c217c156d5b3504315581c5dc9c21
Instruction Fuzzy Hash: EB11B735A202344AC710DF69E44569DB7A0EF85738FA5435FE860A72E2C77C8D418B4C

Uniqueness

Uniqueness Score: 100.00%

Function 0047C304, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderUNIQUE

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 0047C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW,?,00441D88,?), ref: 0047C324

Strings

kernel32.dll, xrefs: 0047C30D
GetSystemWow64DirectoryW, xrefs: 0047C31E

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 8f6b8fbc5ae0276c8692dd60ba773bbd6744e56ae64103a06af9cbd1890bf6c2
Instruction ID: 448837d343b809a7a747f76761528a7c57238ea74050f81ad14c4a4b07cc8ac9
Opcode Fuzzy Hash: 8f6b8fbc5ae0276c8692dd60ba773bbd6744e56ae64103a06af9cbd1890bf6c2
Instruction Fuzzy Hash: FFE08C70200303CFCB205F25C848B8B76D4EB08714B90C83FE899C2310E778D880CBA8

Uniqueness

Uniqueness Score: 100.00%

Function 00404C95, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderUNIQUE

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00404CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo,?,00000000), ref: 00404CB5

Strings

kernel32.dll, xrefs: 00404C9E
GetNativeSystemInfo, xrefs: 00404CAF

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: a73fa7ec54199ac5cd1cc7a5405e6f37b5fe8d156d6918c0c451661c08ead94f
Instruction ID: 04ac41d75f1c9d427c50c0ff68074fa7ac0788071283bd8ed0c5af36185ae805
Opcode Fuzzy Hash: a73fa7ec54199ac5cd1cc7a5405e6f37b5fe8d156d6918c0c451661c08ead94f
Instruction Fuzzy Hash: 77D01270510723CFD720AF31D91874A76D5AF45751F218C3F9885D6690D678D8C4C758

Uniqueness

Uniqueness Score: 100.00%

Function 00404D61, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderUNIQUE

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00404D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection,?,004C62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00404D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00404D7B
kernel32.dll, xrefs: 00404D6A

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: fc980e23cb8f5420eddcc0b614f2834b55be2bd1e6444ffbd0018dc10b9e249f
Instruction ID: 138340c1bb7cbddbf6dc8479dd470e83836704d62684dbb944a4f44490343f19
Opcode Fuzzy Hash: fc980e23cb8f5420eddcc0b614f2834b55be2bd1e6444ffbd0018dc10b9e249f
Instruction Fuzzy Hash: FED01770610713CFD720AF31D80875A76E8AF55762B218D3FD886E6690E678D8C4CB68

Uniqueness

Uniqueness Score: 100.00%

Function 00404D94, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderUNIQUE

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00404DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00404DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00404DAE
kernel32.dll, xrefs: 00404D9D

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 5f018ec53565a5f854ca009f39446564a5e562c2ecce425f19b837535b5d9e77
Instruction ID: c07e40ce446ef711e38c2592c227d3dcacdcaf999f73730374c34c972243728b
Opcode Fuzzy Hash: 5f018ec53565a5f854ca009f39446564a5e562c2ecce425f19b837535b5d9e77
Instruction Fuzzy Hash: FCD08270600312CFCB20AF30C808B8A72E4AF04350B208C3FD882E2290E778D8808BA8

Uniqueness

Uniqueness Score: 100.00%

Function 004576C5, Relevance: 6.3, APIs: 4, Instructions: 334stringUNIQUE

APIs

#6.OLEAUT32(?), ref: 00457818
lstrcmpiW.KERNEL32(?,?), ref: 004578F2
SysFreeString.OLEAUT32(?), ref: 004578FF
SysFreeString.OLEAUT32(?), ref: 0045791F

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: FreeString$lstrcmpi
String ID:
API String ID: 3563800057-0
Opcode ID: 243eb1bb77c329aa80634928938631c45a4dd5376c5b101ad48a1cfc64343361
Instruction ID: 84902a8fcdc76aa46939935bd970338d8b2f52d4cee566ed92c109812de06c3e
Opcode Fuzzy Hash: 243eb1bb77c329aa80634928938631c45a4dd5376c5b101ad48a1cfc64343361
Instruction Fuzzy Hash: E8C19E74A04216EFDB14CF94D884EAEB7B5FF48311B1085AAE805EB352D734ED85CB94

Uniqueness

Uniqueness Score: 100.00%

Function 00456DF3, Relevance: 6.2, APIs: 4, Instructions: 202COMMON

APIs

#8.OLEAUT32(?,00000016,?,00000001,?,?,?,?,?,?,?,?,?,004570F4,?,00000016), ref: 00456E04

Part of subcall function 00409997: __itow.LIBCMT ref: 004099C2
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9B1
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9DD
Part of subcall function 00409997: __i64tow.LIBCMT ref: 0043FA0F

Part of subcall function 0045710E: #41.OLEAUT32(0000000C,?,?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4), ref: 00457135
Part of subcall function 0045710E: #37.OLEAUT32(?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4,?,00000016), ref: 0045718E
Part of subcall function 0045710E: #8.OLEAUT32(?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4,?,00000016), ref: 004571A0
Part of subcall function 0045710E: #23.OLEAUT32(?,?,?,?,?,?,?,?,00456EC6), ref: 004571C0
Part of subcall function 0045710E: #10.OLEAUT32(?,?,00000002,?,?,?,?,?,?,?,00456EC6), ref: 00457213
Part of subcall function 0045710E: #24.OLEAUT32(?,00000002,?,?,?,?,?,?,?,00456EC6), ref: 00457227
Part of subcall function 0045710E: #9.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 0045723C
Part of subcall function 0045710E: #39.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 00457249
Part of subcall function 0045710E: #38.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 00457252
Part of subcall function 0045710E: #9.OLEAUT32(?,?,?,?,?,?,?,00456EC6), ref: 00457264
Part of subcall function 0045710E: #38.OLEAUT32(?,?,?,?,?,?,?,00456EC6,?,?,?,?,?,004570F4,?,00000016), ref: 0045726F

Part of subcall function 004570C0: #9.OLEAUT32(?,?,?,00456EFF,00000000,?,?,?,?,?,004570F4,?,00000016,00479753,?,00000016), ref: 004570C7
Part of subcall function 004570C0: #10.OLEAUT32(?,?,?,?,?,00456EFF,00000000,?,?,?,?,?,004570F4,?,00000016,00479753), ref: 004570D1

#9.OLEAUT32(?,00000000,?,?,?,?,?,004570F4,?,00000016,00479753,?,00000016,?,00000016), ref: 00456F03
#10.OLEAUT32(?,?,?,?,?,?,?,004570F4,?,00000016,00479753,?,00000016,?,00000016), ref: 00456EDC

Part of subcall function 00457280: #411.OLEAUT32(00000011,00000000,00000000,?,?,?,?,004570F4,?,00000016,00479753,?,00000016,?,00000016), ref: 00457294
Part of subcall function 00457280: _memmove.LIBCMT ref: 004572C7

#2.OLEAUT32(00000000,?,?,?,?,004570F4,?,00000016,00479753,?,00000016,?,00000016), ref: 00456EAD

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _wcscpy$#411Exception@8Throw__i64tow__itow_memmovestd::exception::exception
String ID:
API String ID: 3091166584-0
Opcode ID: c98d0e5605fb69cc7b0004eb2b62af69383f92385c78f36b8f80d39d728c9823
Instruction ID: 493451d42fa2cf72034c46684ab61465e33aa78788b401b925ba93198380c5c1
Opcode Fuzzy Hash: c98d0e5605fb69cc7b0004eb2b62af69383f92385c78f36b8f80d39d728c9823
Instruction Fuzzy Hash: EB510D316047019BDB209F66E881A2EB3E59F48715F60883FED46C72D3DB789849DB0D

Uniqueness

Uniqueness Score: 2.04%

Function 0042B05F, Relevance: 6.1, APIs: 4, Instructions: 127UNIQUE

APIs

__getbuf.LIBCMT ref: 0042B0F5

Part of subcall function 00436234: __malloc_crt.LIBCMT ref: 00436244

__write.LIBCMT ref: 0042B121
__lseeki64.LIBCMT ref: 0042B165

Part of subcall function 00431A15: ___lock_fhandle.LIBCMT ref: 00431A80
Part of subcall function 00431A15: __lseeki64_nolock.LIBCMT ref: 00431AA5

__write.LIBCMT ref: 0042B18A

Part of subcall function 0042DAC6: ___lock_fhandle.LIBCMT ref: 0042DB33
Part of subcall function 0042DAC6: __write_nolock.LIBCMT ref: 0042DB52

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: ___lock_fhandle__write$__getbuf__getptd_noexit__lseeki64__lseeki64_nolock__malloc_crt__write_nolock
String ID:
API String ID: 179495348-0
Opcode ID: 45ce835627bc0c9716da84b72a0cbf8f714e64de0b1503c5de1162c9c2ea980c
Instruction ID: 1f74650e41540eb26cca6949c29ac2c1ed8b1604598ed4861c77a303136e931c
Opcode Fuzzy Hash: 45ce835627bc0c9716da84b72a0cbf8f714e64de0b1503c5de1162c9c2ea980c
Instruction Fuzzy Hash: BB413371700A214BD3248F29E862A3B77E0DF453A0B54C21FE8BA873D1D73CE8008B99

Uniqueness

Uniqueness Score: 100.00%

Function 00488AC0, Relevance: 6.1, APIs: 4, Instructions: 109windowCOMMON

APIs

InvalidateRect.USER32(?,00000000,00000001), ref: 00488B4D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00488B9C
GetWindowLongW.USER32(?,000000F0), ref: 00488BC6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00488BD3

Part of subcall function 0048B57F: GetWindowRect.USER32(?,?), ref: 0048B59E
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5B6
Part of subcall function 0048B57F: ScreenToClient.USER32(?,?), ref: 0048B5DA
Part of subcall function 0048B57F: InvalidateRect.USER32(?,?,?), ref: 0048B5F5

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: RectWindow$ClientInvalidateLongScreen$MessageSend
String ID:
API String ID: 914510294-0
Opcode ID: 1812b031c17629b9ac9058f315acfc07962e7d9e9c168155413f69a060141664
Instruction ID: 6017366305c22272e93e48bc594278956003a9b2b994b7244c35f7a79524baaf
Opcode Fuzzy Hash: 1812b031c17629b9ac9058f315acfc07962e7d9e9c168155413f69a060141664
Instruction Fuzzy Hash: F1319074640204BEEB24BA58CC45FAE3764EB85310FA44D2BFA51D62A1DF38B9409B59

Uniqueness

Uniqueness Score: 0.24%

Function 0048ADF1, Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

APIs

ClientToScreen.USER32(?,?), ref: 0048AE1A
GetWindowRect.USER32(?,?), ref: 0048AE90
PtInRect.USER32(?,?,?), ref: 0048AEA0
MessageBeep.USER32(00000000), ref: 0048AF11

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 6a18ba18eb21849e9a78bd79b6f84d7a3cce87d2be61423b7a6c01e025f158a7
Instruction ID: 20aafe120d683b7536ec1c361d9cbfa3becb7b0e8fd9f7a68ee45a873ef900b5
Opcode Fuzzy Hash: 6a18ba18eb21849e9a78bd79b6f84d7a3cce87d2be61423b7a6c01e025f158a7
Instruction Fuzzy Hash: 72419A70A001099FEB11EF58C884A6D7BF1FF48340F1889BBEA049B351D7B4A812DF5A

Uniqueness

Uniqueness Score: 0.15%

Function 00436415, Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043644B
__isleadbyte_l.LIBCMT ref: 00436479

Part of subcall function 004237FB: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00423807

MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,00000000,00000000,?,?,?), ref: 004364A7
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,00000000,00000000,?,?,?), ref: 004364DD

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Locale$ByteCharMultiUpdateUpdate::_Wide$__getptd_noexit__isleadbyte_l
String ID:
API String ID: 3164516598-0
Opcode ID: f95d2081635511957ee21cbff85720af553d1923269aba5ee5c8224bed042a40
Instruction ID: 00bfbab79281597f36fe53e4f64e7450777474697505dafcb940073344e51601
Opcode Fuzzy Hash: f95d2081635511957ee21cbff85720af553d1923269aba5ee5c8224bed042a40
Instruction Fuzzy Hash: 4A31F030A00257BFDB218F65CC44BAB7BA9FF59310F16802AE8548B290D738E850DB9C

Uniqueness

Uniqueness Score: 0.46%

Function 0048C788, Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

GetCursorPos.USER32(?), ref: 0048C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0048C7D7

Part of subcall function 004025DB: GetWindowLongW.USER32(?,000000EB), ref: 004025EC

GetCursorPos.USER32(?), ref: 0048C824
DefDlgProcW.USER32(?,0000007B,?), ref: 0048C85E

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CursorLongWindow$MenuPopupProcTrack
String ID:
API String ID: 2780618515-0
Opcode ID: a5a98a92077e2aaa59aca06ed05bce2560aa70a0f09ba78dbcc783647833ee95
Instruction ID: 757619bd3f98b372d46f3818d8faf94b3fa09ae1c323e5c89f059bb0ed552e39
Opcode Fuzzy Hash: a5a98a92077e2aaa59aca06ed05bce2560aa70a0f09ba78dbcc783647833ee95
Instruction Fuzzy Hash: 00318F35600018AFCB15EF58C898EEF7BB6EB49311F04486AF9058B2A1C7359950DB68

Uniqueness

Uniqueness Score: 0.24%

Function 00420BD0, Relevance: 6.1, APIs: 4, Instructions: 79COMMON

APIs

__setmode.LIBCMT ref: 00420BF2

Part of subcall function 00424744: ___lock_fhandle.LIBCMT ref: 004247D9
Part of subcall function 00424744: __setmode_nolock.LIBCMT ref: 004247F6

Part of subcall function 00409997: __itow.LIBCMT ref: 004099C2
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9B1
Part of subcall function 00409997: _wcscpy.LIBCMT ref: 0043F9DD
Part of subcall function 00409997: __i64tow.LIBCMT ref: 0043FA0F

Part of subcall function 00405B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00467B20,?,?,00000000), ref: 00405B8C
Part of subcall function 00405B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00467B20,?,?,00000000,?,?), ref: 00405BB0

_fprintf.LIBCMT ref: 00420C29

Part of subcall function 00424B15: __lock_file.LIBCMT ref: 00424B5C
Part of subcall function 00424B15: __stbuf.LIBCMT ref: 00424BE1
Part of subcall function 00424B15: __output_l.LIBCMT ref: 00424BF1
Part of subcall function 00424B15: __ftbuf.LIBCMT ref: 00424BFD

OutputDebugStringW.KERNEL32(?), ref: 00456331

Part of subcall function 00424CDA: __lock_file.LIBCMT ref: 00424CFC
Part of subcall function 00424CDA: __fflush_nolock.LIBCMT ref: 00424D06

__setmode.LIBCMT ref: 00420C5E

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ByteCharMultiWide__lock_file__setmode_wcscpy$DebugOutputString___lock_fhandle__fflush_nolock__ftbuf__i64tow__itow__output_l__setmode_nolock__stbuf_fprintf
String ID:
API String ID: 2994725519-0
Opcode ID: e816074527dd0260311bb413413d9e4cbb1bb9f579dd752bf0b2a17323b24ee0
Instruction ID: 67bbc7bd6f20af13a6fc8561dd9091ed48981cac713344a594c0177f25e59198
Opcode Fuzzy Hash: e816074527dd0260311bb413413d9e4cbb1bb9f579dd752bf0b2a17323b24ee0
Instruction Fuzzy Hash: 2F1157B2B042146ACB0873B6BC429BE7B68DF85324F94012FF104672C2DE3C5D86479D

Uniqueness

Uniqueness Score: 2.48%

Function 00435332, Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMONLIBRARYCODE

APIs

_free.LIBCMT ref: 00435351

Part of subcall function 00422F95: HeapFree.KERNEL32(00000000,00000000), ref: 00422FA9
Part of subcall function 00422F95: GetLastError.KERNEL32(00000000,?,00429C64,00000000,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?), ref: 00422FBB

HeapReAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,?,00428AB6,?,?,00000000,00000000,?,00422F40,00000000,00000010), ref: 0043536F
GetLastError.KERNEL32(?,00428AB6,?,?,00000000,00000000,?,00422F40,00000000,00000010,?,?,?,?,?,00422EA5), ref: 004353CA

Part of subcall function 004235E1: DecodePointer.KERNEL32(?,004259CD,?,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62), ref: 004235EA

GetLastError.KERNEL32(?,00428AB6,?,?,00000000,00000000,?,00422F40,00000000,00000010,?,?,?,?,?,00422EA5), ref: 004353B2

Part of subcall function 00428D68: __getptd_noexit.LIBCMT ref: 00428D68

Part of subcall function 0042594C: __FF_MSGBANNER.LIBCMT ref: 00425963
Part of subcall function 0042594C: __NMSG_WRITE.LIBCMT ref: 0042596A
Part of subcall function 0042594C: RtlAllocateHeap.NTDLL(00B90000,00000000,00000001,00000000,00000000,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28), ref: 0042598F

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ErrorHeapLast$AllocAllocateDecodeFreePointer__getptd_noexit_free
String ID:
API String ID: 2334374242-0
Opcode ID: 2533e6da2a6b104497cc3abc21434257f2a231a412eed781c98fc61c91dc778f
Instruction ID: ca36ded951c5b74dcd14922bdbfcb28a3672708b69dba933c6c60362b96cb12c
Opcode Fuzzy Hash: 2533e6da2a6b104497cc3abc21434257f2a231a412eed781c98fc61c91dc778f
Instruction Fuzzy Hash: 7211C132605A25AECB212F71B84565E37A89F183B4F60182FFD049A290DABD8941879D

Uniqueness

Uniqueness Score: 1.55%

Function 00404531, Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

APIs

_memset.LIBCMT ref: 00404560

Part of subcall function 0040410D: _memset.LIBCMT ref: 0040418D
Part of subcall function 0040410D: _wcscpy.LIBCMT ref: 004041E1
Part of subcall function 0040410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 004041F1
Part of subcall function 0040410D: LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0043D5EC

KillTimer.USER32(?,00000001), ref: 004045B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 004045C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0043D6CE

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$KillLoadString_wcscpy
String ID:
API String ID: 1203397457-0
Opcode ID: 9017d92aafd25a15b7bd45833115f0549aca239c36473df683567b390838c4b6
Instruction ID: ee13d0e14117257c6e1bf6a2afa9c18cb2a9610526be340c73f4befcf8864d37
Opcode Fuzzy Hash: 9017d92aafd25a15b7bd45833115f0549aca239c36473df683567b390838c4b6
Instruction Fuzzy Hash: 14210AB0904784AFE7328B24DC45BE7BBEC9F45308F0000AFE79E66281C7781A858B59

Uniqueness

Uniqueness Score: 2.04%

Function 00401290, Relevance: 6.1, APIs: 4, Instructions: 59COMMON

APIs

Part of subcall function 00402612: GetWindowLongW.USER32(?,000000EB), ref: 00402623

DefDlgProcW.USER32(?,00000020,?), ref: 004012D8

Part of subcall function 0048A779: LoadCursorW.USER32(00000000,00007F00), ref: 0048A7F1
Part of subcall function 0048A779: SetCursor.USER32(00000000), ref: 0048A7F8

GetClientRect.USER32(?,?), ref: 0043B84B
GetCursorPos.USER32(?), ref: 0043B855
ScreenToClient.USER32(?,?), ref: 0043B860

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Cursor$Client$LoadLongProcRectScreenWindow
String ID:
API String ID: 3055988096-0
Opcode ID: 0ece2ee9bdbf1d33a90fc67de420260cd1354e737385e85e7b59386c5e1efca1
Instruction ID: 88478fa3ad29557ab13713681797212a94603c3b61ccda0d63648654153e7648
Opcode Fuzzy Hash: 0ece2ee9bdbf1d33a90fc67de420260cd1354e737385e85e7b59386c5e1efca1
Instruction Fuzzy Hash: 82112B39510019EBCB00EF94D8859AE77B8FB05300F1048AAF901F7291D734AA569BA9

Uniqueness

Uniqueness Score: 0.23%

Function 00437207, Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

APIs

__cftof_l.LIBCMT ref: 0043722B

Part of subcall function 00437912: __fltout2.LIBCMT ref: 0043793B
Part of subcall function 00437912: __fptostr.LIBCMT ref: 0043799D
Part of subcall function 00437912: __cftof2_l.LIBCMT ref: 004379BA

__cftog_l.LIBCMT ref: 00437251

Part of subcall function 004379D3: __fltout2.LIBCMT ref: 004379FC
Part of subcall function 004379D3: __fptostr.LIBCMT ref: 00437A5D
Part of subcall function 004379D3: __cftof2_l.LIBCMT ref: 00437A9E
Part of subcall function 004379D3: __cftoe2_l.LIBCMT ref: 00437AB9

__cftoa_l.LIBCMT ref: 0043726A

Part of subcall function 0043728D: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004372AD
Part of subcall function 0043728D: _mbstowcs_s.LIBCMT ref: 00437324
Part of subcall function 0043728D: _strrchr.LIBCMT ref: 0043735F
Part of subcall function 0043728D: _memset.LIBCMT ref: 004374F6
Part of subcall function 0043728D: __alldvrm.LIBCMT ref: 00437571
Part of subcall function 0043728D: __alldvrm.LIBCMT ref: 00437594
Part of subcall function 0043728D: __alldvrm.LIBCMT ref: 004375B7

__cftoe_l.LIBCMT ref: 00437283

Part of subcall function 00437758: __fltout2.LIBCMT ref: 00437785
Part of subcall function 00437758: __fptostr.LIBCMT ref: 004377ED
Part of subcall function 00437758: __cftoe2_l.LIBCMT ref: 0043780D

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: __alldvrm__fltout2__fptostr$Locale__cftoe2_l__cftof2_l$UpdateUpdate::___cftoa_l__cftoe_l__cftof_l__cftog_l_mbstowcs_s_memset_strrchr
String ID:
API String ID: 621885885-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 99b9b692cf18fd2280f287716e5b4489036060bef9d5190ceb0c0b5b499c977f
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 71016DB204418EBBCF225E84CC018EE3F22BF1D354F089656FE9858121C23AC9B1AB85

Uniqueness

Uniqueness Score: 0.60%

Function 0048B57F, Relevance: 6.0, APIs: 4, Instructions: 47COMMON

APIs

GetWindowRect.USER32(?,?), ref: 0048B59E
ScreenToClient.USER32(?,?), ref: 0048B5B6
ScreenToClient.USER32(?,?), ref: 0048B5DA
InvalidateRect.USER32(?,?,?), ref: 0048B5F5

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: e8173e98fc73e507b6a04d2f7e54522757b65c9b70d93ac78b94b59699abf8f9
Instruction ID: c1ec13a6a315efdf6b243f43d6614c5161e9ce39f19ad1524a172358c11b1c05
Opcode Fuzzy Hash: e8173e98fc73e507b6a04d2f7e54522757b65c9b70d93ac78b94b59699abf8f9
Instruction Fuzzy Hash: 261146B5D00209EFDB41DF99C444AEEFBB5FF18310F104566E914E3620D735AA558F94

Uniqueness

Uniqueness Score: 0.17%

Function 0048B8EF, Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

APIs

_memset.LIBCMT ref: 0048B8FE
_memset.LIBCMT ref: 0048B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,004C7F20,004C7F64), ref: 0048B93C
CloseHandle.KERNEL32 ref: 0048B94E

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 20938f2380c00bee8b77b7cffb68c01d981cfa171dd9b4496317a146dae37767
Instruction ID: 82d0d7306074909859a51e75144c9fe9cb012601897826516f2148835353e407
Opcode Fuzzy Hash: 20938f2380c00bee8b77b7cffb68c01d981cfa171dd9b4496317a146dae37767
Instruction Fuzzy Hash: DDF05EB26443107BE2506B61AC85FBB3A5CEB08358F00443AFB08D5296D77959008BBC

Uniqueness

Uniqueness Score: 2.28%

Function 0048C00C, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

APIs

Part of subcall function 004012F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0040134D
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040135C
Part of subcall function 004012F3: BeginPath.GDI32(?), ref: 00401373
Part of subcall function 004012F3: SelectObject.GDI32(?,00000000), ref: 0040139C
Part of subcall function 004012F3: DeleteObject.GDI32(00000000), ref: 0043B8B6

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0048C030
LineTo.GDI32(00000000,?,?), ref: 0048C03D
EndPath.GDI32(00000000), ref: 0048C04D
StrokePath.GDI32(00000000), ref: 0048C05B

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
String ID:
API String ID: 2783949968-0
Opcode ID: b637bd8999dc2f02e3877b06716cb091b1b48c92cefa925fd8f557c2f1659822
Instruction ID: 674b4468024ad211d301666b20e3bfa7de505a3549e2e29f62cfbf593809ea28
Opcode Fuzzy Hash: b637bd8999dc2f02e3877b06716cb091b1b48c92cefa925fd8f557c2f1659822
Instruction Fuzzy Hash: BAF0BE31001219BBDB127F90AC09FCE3F58AF06310F148429FA11210E287794564DBAD

Uniqueness

Uniqueness Score: 0.15%

Function 00402218, Relevance: 6.0, APIs: 4, Instructions: 23COMMON

APIs

GetSysColor.USER32(00000008), ref: 00402231
SetTextColor.GDI32(?,000000FF), ref: 0040223B
SetBkMode.GDI32(?,00000001), ref: 00402250
GetStockObject.GDI32(00000005), ref: 00402258
GetWindowDC.USER32(?), ref: 0043C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0043C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0043C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0043C112
GetPixel.GDI32(00000000,?,?), ref: 0043C132
ReleaseDC.USER32(?,00000000), ref: 0043C13D
SetBkColor.GDI32(?,00000000), ref: 0043C159

Part of subcall function 004022D0: CreateSolidBrush.GDI32(?), ref: 0040230B

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Pixel$Color$BrushCreateModeObjectReleaseSolidStockTextWindow
String ID:
API String ID: 88331326-0
Opcode ID: 27b2581c254cdff319ff0ea5d8f2be35128cc34943b3abbe395981e759962590
Instruction ID: 007a7e945b926db1975f0eb4024d1954444be121fda63f18d3fd7a61cce91000
Opcode Fuzzy Hash: 27b2581c254cdff319ff0ea5d8f2be35128cc34943b3abbe395981e759962590
Instruction Fuzzy Hash: 58E03932100244EADB215FA8EC4D7DD3B20AB05332F10837AFAA9580E287764994DB15

Uniqueness

Uniqueness Score: 0.25%

Function 00442187, Relevance: 6.0, APIs: 4, Instructions: 20COMMON

APIs

GetDesktopWindow.USER32 ref: 00442187
GetDC.USER32(00000000), ref: 00442191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004421B1
ReleaseDC.USER32(?), ref: 004421D2

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 6ccce6c581eecdf91341cc96db6383502fda410d9a8940bdb714612b0f6538cf
Instruction ID: e80bcdaed25015b38fc075b9af120d0661f73bd954452babf2cca2976e4e6e99
Opcode Fuzzy Hash: 6ccce6c581eecdf91341cc96db6383502fda410d9a8940bdb714612b0f6538cf
Instruction Fuzzy Hash: 8BE01A75900204EFDB019FA0C808A9D7BF1EF5C350F108A3AF95AE7260DB7885569F49

Uniqueness

Uniqueness Score: 0.08%

Function 0044219B, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

APIs

GetDesktopWindow.USER32 ref: 0044219B
GetDC.USER32(00000000), ref: 004421A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004421B1
ReleaseDC.USER32(?), ref: 004421D2

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 56bdb0173f3b1fd63dc82c5c3953b40893d4d886f94812d9d464ad18ef1fe862
Instruction ID: 0585887194f83d5896a0f01572a955ee9a0ca529f388d05c95cdd3c21f880870
Opcode Fuzzy Hash: 56bdb0173f3b1fd63dc82c5c3953b40893d4d886f94812d9d464ad18ef1fe862
Instruction Fuzzy Hash: 98E01A75900204EFCB019FB0C80869D7BF1EF5C310F108939F95AA7260DB3895569F48

Uniqueness

Uniqueness Score: 0.08%

Function 00425FDC, Relevance: 6.0, APIs: 4, Instructions: 14threadCOMMON

APIs

__getptd_noexit.LIBCMT ref: 00425FDD

Part of subcall function 00429C04: GetLastError.KERNEL32(00000000,?,00428D6D,004259D3,00000000,?,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008), ref: 00429C06
Part of subcall function 00429C04: __calloc_crt.LIBCMT ref: 00429C27
Part of subcall function 00429C04: __initptd.LIBCMT ref: 00429C49
Part of subcall function 00429C04: GetCurrentThreadId.KERNEL32(?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?,?,?,0042345E,00000008,00422E99), ref: 00429C50
Part of subcall function 00429C04: _free.LIBCMT ref: 00429C5F
Part of subcall function 00429C04: SetLastError.KERNEL32(00000000,00428A73,?,?,?,00000000,?,00429F15,00000018,004BBE28,00000008,00429E62,?,?,?,0042345E), ref: 00429C68

CloseHandle.KERNEL32(?), ref: 00425FF1
__freeptd.LIBCMT ref: 00425FF8

Part of subcall function 00429BB6: __freefls@4.LIBCMT ref: 00429BE4

ExitThread.KERNEL32 ref: 00426000

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: ErrorLastThread$CloseCurrentExitHandle__calloc_crt__freefls@4__freeptd__getptd_noexit__initptd_free
String ID:
API String ID: 4115800976-0
Opcode ID: 73f3316d7a9bb026c18791f0f038f5fd20d10d45368c0215e46809877e6d453b
Instruction ID: e67f4098726512b4bbe0befa71defda7df7d7d7ce1afe63b2ae22e18cfc71986
Opcode Fuzzy Hash: 73f3316d7a9bb026c18791f0f038f5fd20d10d45368c0215e46809877e6d453b
Instruction Fuzzy Hash: DAD0A731102E3197C6312731BD0D61F76506F00725F45463EF869856E09F789C02874D

Uniqueness

Uniqueness Score: 2.71%

Function 00406431, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185UNIQUE

APIs

Part of subcall function 00405FD2: CharUpperBuffW.USER32(00000040,?), ref: 00406032

_memmove.LIBCMT ref: 0043E402

Part of subcall function 00407CB3: _memmove.LIBCMT ref: 00407D13

Part of subcall function 00407FAF: _memmove.LIBCMT ref: 00408003

CharUpperBuffW.USER32(?,00000000), ref: 004065A1

Part of subcall function 0040766F: _memmove.LIBCMT ref: 0040774A

Part of subcall function 00420FF6: std::exception::exception.LIBCMT ref: 0042102C
Part of subcall function 00420FF6: __CxxThrowException@8.LIBCMT ref: 00421041

Strings

=, xrefs: 0040664D

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove$BuffCharUpper$Exception@8Throwstd::exception::exception
String ID: =
API String ID: 1823382739-2322244508
Opcode ID: 484172fb48f354d1aa79a0e7482d4110529b6da5333c8d2966d3f2cb83907663
Instruction ID: a1c148b18c8c5cc82cb5cc51de2e37c9138689195c45808a8d74da9192abb7e6
Opcode Fuzzy Hash: 484172fb48f354d1aa79a0e7482d4110529b6da5333c8d2966d3f2cb83907663
Instruction Fuzzy Hash: 3C51BF71900109AACF14EB99D8819EEB7B4EF58304F11003BE503B72D1DA3D9D96CB5D

Uniqueness

Uniqueness Score: 100.00%

Function 00448A77, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148UNIQUE

APIs

_memmove.LIBCMT ref: 00448B1E
_memmove.LIBCMT ref: 00448B78

Strings

OaA, xrefs: 00448BF2, 0044E39A, 0044E3B6

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove
String ID: OaA
API String ID: 4104443479-4189730831
Opcode ID: eac606b9c50b6ed376460228ada23af1934c05934f650784fb345cb0aa555a59
Instruction ID: d3fee3364ca9afcf12c1e92d5c5d747a73912d83b3585dc8c9cc0e8530f715e4
Opcode Fuzzy Hash: eac606b9c50b6ed376460228ada23af1934c05934f650784fb345cb0aa555a59
Instruction Fuzzy Hash: 3C5170B0A00609DFDB24CF69C580AAEBBF1FF45304F14452EE85AE7350EB34A996CB55

Uniqueness

Uniqueness Score: 100.00%

Function 00412AB7, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

APIs

Sleep.KERNEL32(00000000), ref: 00412AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00412AE1

Strings

@, xrefs: 00412AD5

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: ccc279901a26315e7cd45af8417bbcff58d98a3fa6d1eabbbbfd4e000cf83f5c
Instruction ID: 198fa7249bf4a10115936ac5cec7f523fb376c2af7af020f0510a7a60b6fc721
Opcode Fuzzy Hash: ccc279901a26315e7cd45af8417bbcff58d98a3fa6d1eabbbbfd4e000cf83f5c
Instruction Fuzzy Hash: 28517A715187449BD320AF15DC85BAFBBE8FFC4314F42486DF2D9510A2DB749828CB2A

Uniqueness

Uniqueness Score: 0.17%

Function 004699BE, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138UNIQUE

APIs

Part of subcall function 0040506B: __fread_nolock.LIBCMT ref: 00405089

_wcscmp.LIBCMT ref: 00469AAE
_wcscmp.LIBCMT ref: 00469AC1

Part of subcall function 00405045: _fseek.LIBCMT ref: 0040505D

Strings

FILE, xrefs: 004699FA

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _wcscmp$__fread_nolock_fseek
String ID: FILE
API String ID: 2908099527-3121273764
Opcode ID: 913557f42899b454e3398d4417c7e449758ebc8e92cd5274a0a693f87ad72ef3
Instruction ID: e31db8beb822ec11b54c8bdfd4ea193dbe28da2a1d31aa862f0484787fe8da7c
Opcode Fuzzy Hash: 913557f42899b454e3398d4417c7e449758ebc8e92cd5274a0a693f87ad72ef3
Instruction Fuzzy Hash: 1A41B771A006197ADF209AA1DC45FEF77BDDF45714F00007FB904B7181D6B9AE058BA9

Uniqueness

Uniqueness Score: 100.00%

Function 00487CE0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98windowCOMMON

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00487DD0
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00487DE5

Strings

', xrefs: 00487D39

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: a6e7767beffef5c17608ec75d411db67b7e41de5914bc7f61dda87a7675c0521
Instruction ID: 2698cf77334325e716aa31ef88765766f59d91d88e26f649c61de40c6cf48412
Opcode Fuzzy Hash: a6e7767beffef5c17608ec75d411db67b7e41de5914bc7f61dda87a7675c0521
Instruction Fuzzy Hash: 61413774A052099FDB50DF68D890BEEBBF9FF09300F20046AE904AB381D734A941CFA4

Uniqueness

Uniqueness Score: 0.21%

Function 00486CD2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00486DC2

Part of subcall function 0048BAB8: LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0048BB6E
Part of subcall function 0048BAB8: LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00486D80,?), ref: 0048BBCA
Part of subcall function 0048BAB8: LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0048BC03
Part of subcall function 0048BAB8: LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0048BC46
Part of subcall function 0048BAB8: LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0048BC7D
Part of subcall function 0048BAB8: FreeLibrary.KERNEL32(?), ref: 0048BC89
Part of subcall function 0048BAB8: ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0048BC99
Part of subcall function 0048BAB8: DestroyIcon.USER32(?), ref: 0048BCA8
Part of subcall function 0048BAB8: SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0048BCC5
Part of subcall function 0048BAB8: SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0048BCD1

DestroyWindow.USER32(?), ref: 00486D86

Strings

static, xrefs: 00486D22

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Load$ImageWindow$MessageSend$DestroyIconLibrary$CreateExtractFreeMoveObjectShowStock
String ID: static
API String ID: 612111110-2160076837
Opcode ID: d8ddcff03faa2727741983a12372aa8f2857a4cfbe0cd994432ab84fde7901de
Instruction ID: ac4952246417f6e5eabf139c329a91c40342bfa59b822e976b0221753ab176b8
Opcode Fuzzy Hash: d8ddcff03faa2727741983a12372aa8f2857a4cfbe0cd994432ab84fde7901de
Instruction Fuzzy Hash: 22319271200204AEDB10AF64DC40BFF73A8FF48714F11892EF89597190DA35AC51DB68

Uniqueness

Uniqueness Score: 0.23%

Function 00486943, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004869D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004869DB

Strings

Combobox, xrefs: 0048699D

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectShowStock
String ID: Combobox
API String ID: 269107984-2096851135
Opcode ID: 9cfe375ed6e0b34d9a506390f0cd77aadc23eb3c644841765a6bbab8cb0b8bcc
Instruction ID: 83f828f06193a85efc0b0adebec9c430e4e02a922dab4690574673653ee6290d
Opcode Fuzzy Hash: 9cfe375ed6e0b34d9a506390f0cd77aadc23eb3c644841765a6bbab8cb0b8bcc
Instruction Fuzzy Hash: 9711B6B17002086FEF51AE14CC90EAF376FEB853A4F22452AF9589B3D0D6799C5187A4

Uniqueness

Uniqueness Score: 0.15%

Function 00486E76, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

GetWindowRect.USER32(00000000,?), ref: 00486EE0
GetSysColor.USER32(00000012), ref: 00486EFA

Strings

static, xrefs: 00486EBD

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendShowStock
String ID: static
API String ID: 4111186075-2160076837
Opcode ID: 0988098f70de8969d8020891a1298de10d45f0d883992417ee74d5f7d9c7d729
Instruction ID: 29a9b64aecc222300d436bcd3a63065e5534f5b76e47b581503888c6130dc53c
Opcode Fuzzy Hash: 0988098f70de8969d8020891a1298de10d45f0d883992417ee74d5f7d9c7d729
Instruction Fuzzy Hash: 39215C72610209AFDB05EFA8DC45EFE7BB8FB08314F014A29FD55D3250D638E8619B54

Uniqueness

Uniqueness Score: 0.24%

Function 00486B8F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

APIs

Part of subcall function 00401D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00401D73
Part of subcall function 00401D35: GetStockObject.GDI32(00000011), ref: 00401D87
Part of subcall function 00401D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00401D91
Part of subcall function 00401D35: ShowWindow.USER32(00000000,00000000), ref: 0043BD22

GetWindowTextLengthW.USER32(00000000), ref: 00486C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00486C20

Strings

edit, xrefs: 00486BF5

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Window$MessageSend$CreateLengthObjectShowStockText
String ID: edit
API String ID: 4181820857-2167791130
Opcode ID: f4542204d64810384e383f7295c835a29fb97bb368f4e801a5823a9eea2da0d5
Instruction ID: b0ee5d61ad9eb474c31c7c598f165b0da72494184ac180eda5d14d3501cef6af
Opcode Fuzzy Hash: f4542204d64810384e383f7295c835a29fb97bb368f4e801a5823a9eea2da0d5
Instruction Fuzzy Hash: 3B119D71501118ABEB506E649C41AAF3769EF04378F614B2AF960D72E0C739EC919B68

Uniqueness

Uniqueness Score: 0.15%

Function 0048E0E7, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52UNIQUE

APIs

_memmove.LIBCMT ref: 0048E129

Strings

.dll, xrefs: 0048E0EB, 0048E10D
OaA, xrefs: 0048E14B

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: _memmove
String ID: .dll$OaA
API String ID: 4104443479-4235742178
Opcode ID: d023c89e2568cbe47c7e9be05447d0614d03dd1bdc5753fbcacbf1ef5e56afe8
Instruction ID: 4a953e2e287933c67df9e601e5b7dd51d2cf1e1eb743514fd817fef83038cb5d
Opcode Fuzzy Hash: d023c89e2568cbe47c7e9be05447d0614d03dd1bdc5753fbcacbf1ef5e56afe8
Instruction Fuzzy Hash: 19018071204B019FD7209E2DDD8891AB7F9FB44304B504D3EE146C6B51E7B5F8048B48

Uniqueness

Uniqueness Score: 100.00%

Function 0046901B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

APIs

_memmove.LIBCMT ref: 00469036
__fread_nolock.LIBCMT ref: 0046904B

Strings

EA06, xrefs: 0046907D

Memory Dump Source

Source File: 00000004.00000001.1841235880.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.1840825548.00400000.00000002.sdmp
Associated: 00000004.00000001.1843462512.00564000.00000004.sdmp
Associated: 00000004.00000001.1843477428.00565000.00000002.sdmp
Associated: 00000004.00000001.1843494026.00575000.00000002.sdmp
Associated: 00000004.00000001.1843746294.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_TkAngEQurH.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 0ffa3d434e5b6a956c6ed572106e06fd0ca4870dbeab2ecb47157eb41c369f2b
Instruction ID: 69ed26fe311b0cc63e55e163675035c3f2ff08f97f20fd5c9232a639071a0922
Opcode Fuzzy Hash: 0ffa3d434e5b6a956c6ed572106e06fd0ca4870dbeab2ecb47157eb41c369f2b
Instruction Fuzzy Hash: 50014971904228AEDB28C6A8D816FFE7BFC8B11301F00419FF152D2181E4B8EA188B64

Uniqueness

Uniqueness Score: 2.71%

Function 00426DAE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45UNIQUE

APIs

__calloc_crt.LIBCMT ref: 00426DD0

Part of subcall function 00428A15: __calloc_impl.LIBCMT ref: 00428A24

__calloc_crt.LIBCMT ref: 00426DE9

Strings

@RL, xrefs: 00426E00

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: __calloc_crt$__calloc_impl
String ID: @RL
API String ID: 4112851154-2017224383
Opcode ID: f535812a5555e23c147d5a945646e9e24fea3464ae2e50450e7a75ea915a6a25
Instruction ID: bbd8b9fab33c61190424cec5909bf4a4914ceb41b768b9a47a746c2f3f0f3bb9
Opcode Fuzzy Hash: f535812a5555e23c147d5a945646e9e24fea3464ae2e50450e7a75ea915a6a25
Instruction Fuzzy Hash: 87F0C8713142269BF764EF29BC01BB66795EB00724B53807FE504CB2D0EB788841469C

Uniqueness

Uniqueness Score: 100.00%

Function 0043B511, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22UNIQUE

APIs

Part of subcall function 0043B564: _memset.LIBCMT ref: 0043B571

Part of subcall function 00420B84: InitializeCriticalSectionAndSpinCount.KERNEL32(004C5158,00000000,004C5144,0043B540,?,?,?,0040100A), ref: 00420B89
Part of subcall function 00420B84: GetLastError.KERNEL32(?,?,?,0040100A), ref: 004562E7

IsDebuggerPresent.KERNEL32(?,?,?,0040100A), ref: 0043B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0040100A), ref: 0043B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0043B54E

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 436010757-631824599
Opcode ID: cfdba6c3f5d1c47e0915195a6a61c30b6b4130fea4c9ebe93c9a57294c91e8a4
Instruction ID: bbad548b5aabf2add28ed68359945d9081cd17edac9c4c9c4009ad7997521b12
Opcode Fuzzy Hash: cfdba6c3f5d1c47e0915195a6a61c30b6b4130fea4c9ebe93c9a57294c91e8a4
Instruction Fuzzy Hash: 7EE06DB02003108BD720DF69E5047467BE0EB14748F00C97EE946C6251D7BCE448CBA9

Uniqueness

Uniqueness Score: 100.00%

Function 00441D5F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00441B9F

Part of subcall function 0047C304: LoadLibraryA.KERNEL32(kernel32.dll), ref: 0047C312
Part of subcall function 0047C304: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW,?,00441D88,?), ref: 0047C324

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00441D97

Strings

WIN_XPe, xrefs: 00441BB2

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: af0a56820825745426f4d03bb04c2b0f0d3c287a6387f6cce3cf7a492779281f
Instruction ID: c8091f0db7e28bb6b7c32348aacfe7bcbdcf0e89efc274199b4bea7c31e24fe9
Opcode Fuzzy Hash: af0a56820825745426f4d03bb04c2b0f0d3c287a6387f6cce3cf7a492779281f
Instruction Fuzzy Hash: D3F03970800049DFEB15DB91C988AECBBF8EB08300F5044ABE102B21A0E7386F85CF29

Uniqueness

Uniqueness Score: 0.31%

Function 00441B3E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

APIs

GetLocalTime.KERNEL32(?), ref: 00441B42

Strings

%.3d, xrefs: 00441B4D
WIN_XPe, xrefs: 00441BB2

Memory Dump Source

Source File: 00000004.00000002.1883528133.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1883521646.00400000.00000002.sdmp
Associated: 00000004.00000002.1883613144.00564000.00000004.sdmp
Associated: 00000004.00000002.1883620679.00565000.00000002.sdmp
Associated: 00000004.00000002.1883632813.00575000.00000002.sdmp
Associated: 00000004.00000002.1883692963.005FF000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_TkAngEQurH.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$WIN_XPe
API String ID: 481472006-2409531811
Opcode ID: c18ac069e1d6eb3ecd6810b2c64f4779c8ba0f418c5f4b219093c25649736dfb
Instruction ID: 41f1b97e473b991b9022892c38b55fdedc2d4ba70ca61e7e94cb44e346d53a61
Opcode Fuzzy Hash: c18ac069e1d6eb3ecd6810b2c64f4779c8ba0f418c5f4b219093c25649736dfb
Instruction Fuzzy Hash: 78D0EC71804158EADA449A9098449F9737CE708301F6005A3B506A2450F23DABD69B2F

Uniqueness

Uniqueness Score: 0.30%

Description:	The Graphical User Interfaces (GUI) is a common way to interact with an operating system. Adversaries may use a system's GUI during an operation, commonly through a remote interactive session such as Remote Desktop Protocol , instead of through a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), to search for information and execute files via mouse double-click events, the Windows Run command , or other potentially difficult to monitor interactions.
Tactics:	Execution
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR).
Tactics:	Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Per Apple’s documentation, startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items . This is technically a deprecated version (superseded by Launch Daemons), and thus the appropriate folder, `/Library/StartupItems` isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), `StartupParameters.plist` , reside in the top-level directory.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process Monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process Monitoring, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.
Tactics:	Defense Evasion
Data Sources:	API monitoring, Anti-virus, File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process Monitoring, Process command-line parameters, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries can use methods of capturing user input for obtaining credentials for Valid Accounts and information Collection that include keylogging and user input field interception.
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Kernel drivers, Process monitoring, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software running on systems within the network.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of local system or domain accounts.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries will likely attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries will likely look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.
Tactics:	Exfiltration
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls that have been improperly configured.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be whitelisted within a target environment. Remote access tools like VNC, Ammy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process Monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Use of a standard non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a common, standardized application layer protocol such as HTTP, HTTPS, SMTP, or DNS to avoid detection by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report TkAngEQurH.exe

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Signature Similarity

Similar Samples

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Screenshots

Thumbnails

Startup

Created / dropped Files

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Function 00403B4C, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowUNIQUE

Function 00404FE9, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
UNIQUE

Function 00404AFE, Relevance: 9.2, APIs: 6, Instructions: 223
COMMON

Function 00403015, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 75
windowregistryUNIQUE

Function 00403041, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 54
windowregistryUNIQUE

Function 004071EB, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 202
registryCOMMON

Function 00403633, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryUNIQUE

Function 00403A58, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 72
windowregistryCOMMON

Function 00403778, Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 00423469, Relevance: 12.1, APIs: 8, Instructions: 91
UNIQUELIBRARYCODE

Function 00422EC8, Relevance: 10.6, APIs: 7, Instructions: 75
UNIQUELIBRARYCODE

Function 004073E5, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 65
UNIQUE

Function 004039E7, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
COMMON

Function 004069CA, Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260
COMMON

Function 0040F8CF, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 168
comUNIQUE