Edit tour

Windows Analysis Report
PI No 20000814C.exe

Overview

General Information

Sample name:	PI No 20000814C.exe
Analysis ID:	1447909
MD5:	2c40af3164c197806fcf499a1e6a0b85
SHA1:	4bb49ffbbaa20503615a610b579a2c8dacb21fdd
SHA256:	e29923d4e3fa5b30614a263828db410b0ab5c452a4237c8ae33a21ffaaf73cc4
Tags:	exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Found potential string decryption / allocating functions

One or more processes crash

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

PI No 20000814C.exe (PID: 2336 cmdline: "C:\Users\user\Desktop\PI No 20000814C.exe" MD5: 2C40AF3164C197806FCF499A1E6A0B85)

WerFault.exe (PID: 6788 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 532 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PI No 20000814C.exe	ReversingLabs: Detection: 83%
Source: PI No 20000814C.exe	Virustotal: Detection: 44%			Perma Link

Machine Learning detection for sample

Source: PI No 20000814C.exe

Joe Sandbox ML: detected

Source: PI No 20000814C.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

System Summary

Binary is likely a compiled AutoIt script file

Source: PI No 20000814C.exe, 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_cd5e12e4-c
Source: PI No 20000814C.exe, 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1d421492-2
Source: PI No 20000814C.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_36205f92-4
Source: PI No 20000814C.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_bf092c20-0

Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E2E060	0_2_00E2E060
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00EA804A	0_2_00EA804A
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E34140	0_2_00E34140
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E42405	0_2_00E42405
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E56522	0_2_00E56522
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00EA0665	0_2_00EA0665
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E5267E	0_2_00E5267E
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E36843	0_2_00E36843
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E4283A	0_2_00E4283A
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E2E800	0_2_00E2E800
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E589DF	0_2_00E589DF
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00EA0AE2	0_2_00EA0AE2
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E56A94	0_2_00E56A94
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E7EB07	0_2_00E7EB07
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E88B13	0_2_00E88B13
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E4CD61	0_2_00E4CD61
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E57006	0_2_00E57006
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E33190	0_2_00E33190
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E3710E	0_2_00E3710E
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E21287	0_2_00E21287
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E433C7	0_2_00E433C7
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E4F419	0_2_00E4F419
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E416C4	0_2_00E416C4
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E35680	0_2_00E35680
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E358C0	0_2_00E358C0
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E478D3	0_2_00E478D3
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E4DBB5	0_2_00E4DBB5
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E41BB8	0_2_00E41BB8
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E59D05	0_2_00E59D05
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E2FE40	0_2_00E2FE40
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E4BFE6	0_2_00E4BFE6
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E41FD0	0_2_00E41FD0

Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: String function: 00E48B40 appears 42 times
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: String function: 00E29BF8 appears 35 times
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: String function: 00E29A20 appears 34 times

Source: C:\Users\user\Desktop\PI No 20000814C.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 532

Source: PI No 20000814C.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2336

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\1c1557c6-06f6-4845-aeb6-5f246b84e61c

Jump to behavior

Source: PI No 20000814C.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PI No 20000814C.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PI No 20000814C.exe	ReversingLabs: Detection: 83%
Source: PI No 20000814C.exe	Virustotal: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\PI No 20000814C.exe "C:\Users\user\Desktop\PI No 20000814C.exe"
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 532

Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: wsock32.dll	Jump to behavior

Source: PI No 20000814C.exe

Static file information: File size 1173504 > 1048576

Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E2C588 push eax; retn 0040h		0_2_00E2C599
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E48B85 push ecx; ret		0_2_00E48B98

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\PI No 20000814C.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\PI No 20000814C.exe

Code function: 0_2_00E4800A ___security_init_cookie,LdrInitializeThunk,

0_2_00E4800A

Source: PI No 20000814C.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\PI No 20000814C.exe

Code function: 0_2_00E4886B cpuid

0_2_00E4886B

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	11 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PI No 20000814C.exe	83%	ReversingLabs	Win32.Trojan.ShellcodeCrypter
PI No 20000814C.exe	45%	Virustotal		Browse
PI No 20000814C.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447909
Start date and time:	2024-05-27 12:18:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PI No 20000814C.exe
Detection:	MAL
Classification:	mal56.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 57
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
06:19:42	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PI No 20000814C._a57618b41515ff9a6eee1ffe6c8e07652c9a3_194af5ac_d6ddeb29-df61-48d3-b221-d18d1e03fe73\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8515013932329505
Encrypted:	false
SSDEEP:	192:QCNNUUGyWyG0BU/QjedqzuiFHZ24IO8W:3NNUlyWytBU/QjhzuiFHY4IO8W
MD5:	F3A90B5C66C7EDFB6AA7E4CDF25ABDE9
SHA1:	7D6AA22D9DBF1126347E245E08AC2DDB0A1D88F1
SHA-256:	5A1544DD7DED2C3698A6A90CE54C0C4A3EE9157D24B233F17FF37CC3DF98BCC7
SHA-512:	F9120A9A25B5FF2B86973B1D4717C7C085D71F39EB43BC472C96AA48239ADB438100FB8E5734185A6BC02964DF131D0DFDBF366DAC89A37650C7D0FA60C05470
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.2.7.8.7.7.7.0.1.8.1.0.1.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.1.2.7.8.7.7.7.6.1.1.8.4.7.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.6.d.d.e.b.2.9.-.d.f.6.1.-.4.8.d.3.-.b.2.2.1.-.d.1.8.d.1.e.0.3.f.e.7.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.f.a.7.1.2.0.-.f.8.c.f.-.4.d.7.9.-.b.e.d.6.-.0.d.a.7.8.c.a.c.7.0.5.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.I. .N.o. .2.0.0.0.0.8.1.4.C...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.2.0.-.0.0.0.1.-.0.0.1.4.-.d.a.d.5.-.0.c.6.0.1.f.b.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.4.2.7.e.c.d.d.a.6.0.f.9.8.f.3.e.1.f.c.b.4.1.0.f.1.2.f.4.8.f.3.0.0.0.0.0.9.0.8.!.0.0.0.0.4.b.b.4.9.f.f.b.b.a.a.2.0.5.0.3.6.1.5.a.6.1.0.b.5.7.9.a.2.c.8.d.a.c.b.2.1.f.d.d.!.P.I. .N.o. .2.0.0.0.0.8.1.4.C...e.x.e...

C:\ProgramData\Microsoft\Windows\WER\Temp\WERACA6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon May 27 10:19:37 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42812
Entropy (8bit):	1.8432475282672873
Encrypted:	false
SSDEEP:	192:HimdI88COOYUjHqqm7/7nccbYITGkvvS:Cmd/8CJPHq97jccbYITR
MD5:	060B7BD08336F805AD6BDD02E9C837E5
SHA1:	E1FBD133638557B6EC98C968B3554921A7B32FFB
SHA-256:	4862DC013417ED351738BCD3BD1DFAC0A6A87821B29EAA604B65AF9BBFD78DA0
SHA-512:	DEB7451D60872666A455EBD34A6256B1FF3E45CB1C14F890EE5E865384F0BAD91F81CD2DF4165F83B3A7A44EDB41F7D83D571B57E607401613AB4BC6AEF3BCC3
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......9^Tf........................\...............l'..........T.......8...........T...........P..........................................................................................................eJ......\|.......GenuineIntel............T....... ...8^Tf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD53.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.6947909396653387
Encrypted:	false
SSDEEP:	192:R6l7wVeJZel6R6YSvSU9kte1gmfEpCprq89bDSsfbtBm:R6lXJ86R6YaSU9kmgmfEp0DRfbi
MD5:	AC3935353B6735432F5F84B922DA40A2
SHA1:	BA1F4E2E6773BED81BF383BDAF15BCAA192D0D4A
SHA-256:	2F319EE01FFE977128002CE42BFCFF449ED6BF63BE2C5D61DC910A4B720E791E
SHA-512:	3EDB74AFFF235080AC6EC50865DAE48AF9F43B9A35ABB94185780A510A9223C34229982269FD7E7819625B0DA61B2D4370439C31F836E98AA32CF794C86DE441
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.3.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD73.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4614
Entropy (8bit):	4.4541264696171705
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9adWpW8VYGYm8M4JwYmFa+q8UTpXLAad:uIjfHI7cs7VqJwSlpXLAad
MD5:	82315993FCC354665C6BC83CFF579D31
SHA1:	B5B4461D95BF8E8AFC88F8AC72422CFB870DFEC3
SHA-256:	3C6E3A07D9C3299E8F49370E766E189E189D034E3DE209E0D5703FBD8349630E
SHA-512:	5C0CC86A41CD1229AEA360FEA0D0E37FD319861B82AEAB646D410624CD1EC49C696297A8F080F0552FC2E6B52B3B78CB5A7A3446898130EFC2B00756DBD82E73
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="341362" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372140455986441
Encrypted:	false
SSDEEP:	6144:YFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNkiLK:gV1QyWWI/glMM6kF72qK
MD5:	FCBC04893C838357C177EA96D64182A4
SHA1:	8335089D95FD2629BB3C84DA9421BF7A42CA2218
SHA-256:	95953EE3BFF041FB075CF95A31ED3612288913D945FC08A90DDDF3337169CA56
SHA-512:	F689BDAD48E59BB74B34F1574047404371629C7C14D317A5E2EBED63230FF765900D4ACC6D07671D301168A8017162444D1D6B9C7F7BCCFF8F3699B7DEEEE489
Malicious:	false
Reputation:	low
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmV.m`.................................................................................................................................................................................................................................................................................................................................................E{T........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.975374924293833
TrID:	Win32 Executable (generic) a (10002005/4) 99.70% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PI No 20000814C.exe
File size:	1'173'504 bytes
MD5:	2c40af3164c197806fcf499a1e6a0b85
SHA1:	4bb49ffbbaa20503615a610b579a2c8dacb21fdd
SHA256:	e29923d4e3fa5b30614a263828db410b0ab5c452a4237c8ae33a21ffaaf73cc4
SHA512:	2d4446f612390f59cc8464468033052f0c17d1abe0cd0527eb550509b70de60d8c343b1abb7981b9bee9864b53ea90606afdd578371ce42677f9a7ffb1c4dfc1
SSDEEP:	24576:GAHnh+eWsN3skA4RV1Hom2KXcmtcFv/wgbv6okJQNC:hh+ZkldoPKsacFnwAv7
TLSH:	DB45BE0273D6C036FFAB92739F6AE20156B97D254133852F13982D79BD701B2273E662
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x664EA1CE [Thu May 23 01:54:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	bd3825b6e0410966f0c31f64b6c7644a

Entrypoint Preview

Instruction
call 00007F7620FA599Dh
jmp 00007F7620F98754h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F7620F988DAh
cmp edi, eax
jc 00007F7620F98C3Eh
bt dword ptr [004C41FCh], 01h
jnc 00007F7620F988D9h
rep movsb
jmp 00007F7620F98BECh
cmp ecx, 00000080h
jc 00007F7620F98AA4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F7620F988E0h
bt dword ptr [004BF324h], 01h
jc 00007F7620F98DB0h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F7620F98A7Dh
test edi, 00000003h
jne 00007F7620F98A8Eh
test esi, 00000003h
jne 00007F7620F98A6Dh
bt edi, 02h
jnc 00007F7620F988DFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F7620F988E3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F7620F98935h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x541f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	cffa6f225a55a507d8464581bdbb27d5	False	0.3176709366840731	data	5.680734504290733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x541f8	0x54200	3c16cc1a414aca2de77f0c9cb0ebbe97	False	0.9223973811292719	data	7.880587929666203	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11d000	0x7134	0x7200	8a46a4bc77a3f321996ff4079f834054	False	0.0017475328947368421	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x4b490	data			1.0003275307424895
RT_GROUP_ICON	0x11bc48	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x11bcc0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x11bcd4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x11bce8	0x14	data	English	Great Britain	1.25
RT_VERSION	0x11bcfc	0x10c	data	English	Great Britain	0.6007462686567164
RT_MANIFEST	0x11be08	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 12:19:57.762661934 CEST	53	56679	1.1.1.1	192.168.2.8

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PI No 20000814C.exePID: 2336, Parent PID: 4084

General

Target ID:	0
Start time:	06:19:36
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\PI No 20000814C.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PI No 20000814C.exe"
Imagebase:	0xe20000
File size:	1'173'504 bytes
MD5 hash:	2C40AF3164C197806FCF499A1E6A0B85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6788, Parent PID: 2336

General

Target ID:	4
Start time:	06:19:36
Start date:	27/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 532
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: PI No 20000814C.exePID: 2336, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	66.7%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00E4800A Relevance: 1.5, APIs: 1, Instructions: 2
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 00E4800A

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 26db91e6245672e8584d34beee5bc1048c98b81b04b6a077b02f066b5f7b6865
Instruction ID: 9ce5e3893aa71920788c6ff98fb0763e9fa94a15f359bc71ca6bf9cba9b59e87
Opcode Fuzzy Hash: 26db91e6245672e8584d34beee5bc1048c98b81b04b6a077b02f066b5f7b6865
Instruction Fuzzy Hash:

Non-executed Functions

Function 00E3710E Relevance: 69.8, APIs: 19, Strings: 18, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E375C2
_memset.LIBCMT ref: 00E376B1
_memmove.LIBCMT ref: 00E37C4B
_memmove.LIBCMT ref: 00E37E4F

Strings

+-p , xrefs: 00E723BC
n, xrefs: 00E37278
0, xrefs: 00E371F6
0wK, xrefs: 00E71F5B
{, xrefs: 00E371EC
q, xrefs: 00E37296
", xrefs: 00E732CF
p, xrefs: 00E3728C
R, xrefs: 00E3721E
', xrefs: 00E37228
o, xrefs: 00E37282
, xrefs: 00E37250
-p , xrefs: 00E723B3
s, xrefs: 00E372A0
@, xrefs: 00E7412F
9, xrefs: 00E3720A
), xrefs: 00E37200
<, xrefs: 00E37214

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memmove$_memset
String ID: $"$'$)$+-p $-p $0$0wK$9$<$@$R$n$o$p$q$s${
API String ID: 1357608183-613261138
Opcode ID: ce09b7ae3f1f3eb577794364a1e258ca6c0e99c45195fa8c790f52c04ac44792
Instruction ID: 4542dea9bbe5b476cf5e70e6c814bc8ca6db7d9ce5785e2240a2b3564e844fba
Opcode Fuzzy Hash: ce09b7ae3f1f3eb577794364a1e258ca6c0e99c45195fa8c790f52c04ac44792
Instruction Fuzzy Hash: 6B93A171A00215DFDB24CFA8C885BEDB7B1FF48314F25916AE959BB290E7709E81DB40

Function 00E34140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00E344ED
ERCP, xrefs: 00E3421F
VUUU, xrefs: 00E67B0C
VUUU, xrefs: 00E34520
VUUU, xrefs: 00E344DB

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 6000303c6950a329683c880c1145399cc16b7f655a195cb1113640f1e615aa68
Instruction ID: bdfb59f6bcab5eee8ed52f64d5e6d85d2b3ccba18087f04ad499df87fbb87dca
Opcode Fuzzy Hash: 6000303c6950a329683c880c1145399cc16b7f655a195cb1113640f1e615aa68
Instruction Fuzzy Hash: DEA28EB0E0421ACBDF24CF58D9447EDBBB1FB55358F14A5AAD855B7280D770AE81CB40

Function 00E358C0 Relevance: 11.0, APIs: 7, Instructions: 532
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memmove.LIBCMT ref: 00E35A05
_memmove.LIBCMT ref: 00E35A55
_memmove.LIBCMT ref: 00E35ABB

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 8c54e5318c7b82e50e4f6995c3842c099c5acce867169d86dc37b7ebc633337e
Instruction ID: ea2c8053b210c2c4aacdce8d52816cd0e85bc5582829e3226813f5f30be065e6
Opcode Fuzzy Hash: 8c54e5318c7b82e50e4f6995c3842c099c5acce867169d86dc37b7ebc633337e
Instruction Fuzzy Hash: 83129971A00609EBDF14CFA4D985AEEB7F5FF48300F109669E44AB7291EB35AE11CB50

Function 00E35680 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E40FF6: std::exception::exception.LIBCMT ref: 00E4102C
Part of subcall function 00E40FF6: __CxxThrowException@8.LIBCMT ref: 00E41041

_memmove.LIBCMT ref: 00E7062F
_memmove.LIBCMT ref: 00E70744
_memmove.LIBCMT ref: 00E707EB

Strings

yZ, xrefs: 00E70881, 00E707FF

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: yZ
API String ID: 1300846289-3798167742
Opcode ID: 631f9aed64d9a7fd7f6562c39e6dd328e799f8293935057f32a6335396fa8f9c
Instruction ID: fa3989bb4d1ba0251ae0e7e291cff45d9de383d9f300e6b0579ea41d2c9c0417
Opcode Fuzzy Hash: 631f9aed64d9a7fd7f6562c39e6dd328e799f8293935057f32a6335396fa8f9c
Instruction Fuzzy Hash: E5029271E00205DBDF08DF64E9856AE7BF5EF44300F159069E80AEB395EB31D954CB91

Function 00E2FE40 Relevance: 8.0, APIs: 3, Strings: 1, Instructions: 1040COMMON

Download Yara Rule

Strings

prL, xrefs: 00E64DE3

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID: prL
API String ID: 0-3386091405
Opcode ID: 80962cfc756a024321c3b92fb81d030722e5def25ace007b9e52334b09d3a1b4
Instruction ID: b850428f7c9be1bcd5b95aa7f7bf360bd88eab7cd211af51ef9334213e010fe1
Opcode Fuzzy Hash: 80962cfc756a024321c3b92fb81d030722e5def25ace007b9e52334b09d3a1b4
Instruction Fuzzy Hash: 2B928BB06083418FD724DF14D494B6ABBE1BF84348F14A96DF88AAB352D771EC45CB92

Function 00E33190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 7b7e272801ecf397d6c386ec2184214c04e66e5c1f35d2d88a05e48c475c535a
Instruction ID: d8394cea254a70ef41882d9a82fb43368a9c183f33e4799533063f29314e8fcc
Opcode Fuzzy Hash: 7b7e272801ecf397d6c386ec2184214c04e66e5c1f35d2d88a05e48c475c535a
Instruction Fuzzy Hash: C522BF716083119FC724DF24D895BAFBBE4BF84718F10691DF496A7292DB30EA44CB92

Function 00E2E800 Relevance: 6.0, Strings: 4, Instructions: 1004COMMON

Download Yara Rule

Strings

DtL, xrefs: 00E2EC1A
DtL, xrefs: 00E2EC21
DtL, xrefs: 00E63F1F
DtL, xrefs: 00E63F58

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID: DtL$DtL$DtL$DtL
API String ID: 0-1429224841
Opcode ID: b591927936fd40fe1f8818c1f6c47d029dd27f6a6c6ebb23f079d12281cc2b61
Instruction ID: 5178ba44c5a5c25bd230ad7332572bdf3f28e8add4fd537783b80c85e6471d32
Opcode Fuzzy Hash: b591927936fd40fe1f8818c1f6c47d029dd27f6a6c6ebb23f079d12281cc2b61
Instruction Fuzzy Hash: 8F92AF74A04225CFCB24CF58E481AA9B7F1FF58314F64A06AE916BB351D774EC82CB91

Function 00EA804A Relevance: 3.6, APIs: 2, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e743540279b989762b0be880f497a9a485527e7fb9f2e54aa75e3d4436766430
Instruction ID: 153f5b25a86d9e4695c9714b1df112295683a737dbaf0bfff791cb9a624cdecc
Opcode Fuzzy Hash: e743540279b989762b0be880f497a9a485527e7fb9f2e54aa75e3d4436766430
Instruction Fuzzy Hash: 7D12D271500204ABEB258F24DD49FAE7BF4EF4A314F20652AF915FE2A1EF70A945CB10

Function 00E88B13 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00E88B25

Part of subcall function 00E4543A: __aulldiv.LIBCMT ref: 00E45463

Strings

0uL, xrefs: 00E88B1C

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __aulldiv__time64
String ID: 0uL
API String ID: 325419493-4127767690
Opcode ID: 2ef028f20e25bc989bd7b728d0492ec4ee56307afdf40b8adaedbc6f0df8c5ac
Instruction ID: d0907ab34467ff7dae24a801960e6b1740bbe7790741e0075bc2cf22c2b9a67e
Opcode Fuzzy Hash: 2ef028f20e25bc989bd7b728d0492ec4ee56307afdf40b8adaedbc6f0df8c5ac
Instruction Fuzzy Hash: 2921D2766255108BC329CF25D441A52B3E1EBA4311B689E6CD4E9CB2D0CA34B905CB94

Function 00E2E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd98f1285a0d30e5b816e9f47a8e1fb518d1f33f0c8d6b2417291535d7bb1c1
Instruction ID: 64a10c682626240294061d2220af8bc530208c7d2f15d054f6e5688a5c093755
Opcode Fuzzy Hash: 7cd98f1285a0d30e5b816e9f47a8e1fb518d1f33f0c8d6b2417291535d7bb1c1
Instruction Fuzzy Hash: 6622AC74A00235CFDB24DF64E481AAEB7F0FF08304F18A569E856BB351E774A985CB91

Function 00E7EB07 Relevance: 3.1, Strings: 2, Instructions: 561COMMON

Download Yara Rule

Strings

|, xrefs: 00E7EB49
(, xrefs: 00E7EB5F

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID: ($|
API String ID: 0-1631851259
Opcode ID: b256197e7111b9932fd89d5c9b443b4e488234a7e3d3d342d2717f0cd05e928a
Instruction ID: 4af555607920ed3c9f372c7d5efbe5a115c0a783a3027ee1e064377fee5d6b83
Opcode Fuzzy Hash: b256197e7111b9932fd89d5c9b443b4e488234a7e3d3d342d2717f0cd05e928a
Instruction Fuzzy Hash: 36323775A007059FD728CF29C4819AAB7F1FF48310B15D5AEE49AEB3A1D770E941CB40

Function 00E4F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7d9b8eee1d273b37d623b7cc6cd26b30c9621dfee01b7311cae72a06f2c816
Instruction ID: 605d236ae15f3e6efd05d3496e67611f1f1de1b7c9e714c8d75e6af57d74014f
Opcode Fuzzy Hash: fe7d9b8eee1d273b37d623b7cc6cd26b30c9621dfee01b7311cae72a06f2c816
Instruction Fuzzy Hash: 6D322522D69F014DD7239634E872335A288EFB77D8F15E737E819B59A6EB28D4834204

Function 00E36843 Relevance: 2.1, Strings: 1, Instructions: 883COMMON

Download Yara Rule

Strings

PJJ, xrefs: 00E368B3

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID: PJJ
API String ID: 0-258144419
Opcode ID: 9f56f4a328962fb90a34fc3a88c96b69726f9e3444872868eefc29649ad329b2
Instruction ID: 7919c5b5664f10087a23cca87bd3a7c05bd247cc326c96b2e585b31ceedde495
Opcode Fuzzy Hash: 9f56f4a328962fb90a34fc3a88c96b69726f9e3444872868eefc29649ad329b2
Instruction Fuzzy Hash: 84726E75E003199BDB24DF68C8847EEBBB5EF48314F14D1AAE949BB290D7709D81CB90

Function 00E5267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a83e6c9a1e03463649304356993a4cc28f03311dd18012bd76db8a2bb8b356c
Instruction ID: 1c8d2f39c0ee17d11208007135f2460ae947f3667789b13f8c28f60681466d69
Opcode Fuzzy Hash: 9a83e6c9a1e03463649304356993a4cc28f03311dd18012bd76db8a2bb8b356c
Instruction Fuzzy Hash: B1B11020D2AF414DD72396398835336BB8CAFBB2C5F51D72BFC2670D22EB2185934185

Function 00EA0AE2 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77cc1679f561517273241e1fb6eacc63fdf5bf9e2291d1834d89783708c879a2
Instruction ID: df60b006a32688f5983ef0f165b7d00357928fa650b15e4fa965875389fc7c8d
Opcode Fuzzy Hash: 77cc1679f561517273241e1fb6eacc63fdf5bf9e2291d1834d89783708c879a2
Instruction Fuzzy Hash: 1F025B756006119FDB14EF24D885E2AB7E5FF89724F04A85DF889AB362CB31ED41CB81

Function 00EA0665 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 09822404d708ae0afe09a89739b70461fba6797690fd98337f155e6c13e89274
Instruction ID: 6786e473cf212f0e0a239bc37bc71c18119925b4fe483627e4157184d1515981
Opcode Fuzzy Hash: 09822404d708ae0afe09a89739b70461fba6797690fd98337f155e6c13e89274
Instruction Fuzzy Hash: FBE13C71604310AFCB14DF24C895E6ABBE4FF89714F04996DF88AEB262DB30E945CB51

Function 00E21287 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0acfed8c104553ee0f031015a52969b3383a7e3804369e691b3daa623c5a7133
Instruction ID: bf59096d0c32860f38532b2293c52df09e0aae97caa17850f0f5aaf4d2d80a90
Opcode Fuzzy Hash: 0acfed8c104553ee0f031015a52969b3383a7e3804369e691b3daa623c5a7133
Instruction Fuzzy Hash: 6EA1ADB0102464BED638AB287C45EFF35DCDBA634AB24395DF802F5192CB52DF0092B9

Function 00E42405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 367e1a44d2511216785d486e20588aa6cae9fff50e5563e5491ec653291f989b
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: E8C1A73220509309EF2D4639E43413EBAE16EA27B539A279DF4B3EB5C4FF10D569D620

Function 00E4283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 898cf59b9e80b1851a3c48d80f3ee41afacf428ff7e7a30441225613ed35567e
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 60C1A73220519309DF2D4639A43403EFBE16E927B539A279DF4B2EB5C4FF10D568E620

Function 00E41FD0 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 7ad04fc5366eab971c007b132a7b16ef2b67cc46906ed96d0f7454d040e5b94c
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 2CC1D9322050530AEF1D4639A43403EFAE16EA27B535A27ADF4B3EB5D4FF10D569D620

Function 00E41BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: aacceb637035f04313d4b4b668f24ea20c4d3794b0da57b2240bedd3bc6220ec
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 3FC1B43230515309EF2D463AA47403EBBE16EA27B535A27DDE4B2EB4C4FF10D5A99610

Function 00E26A3C Relevance: 18.3, APIs: 12, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wcsnicmp.LIBCMT ref: 00E26A91
__wcsnicmp.LIBCMT ref: 00E26AA9
__wcsnicmp.LIBCMT ref: 00E26AC1
__wcsnicmp.LIBCMT ref: 00E26AD9
__wcsnicmp.LIBCMT ref: 00E26AF1
__wcsnicmp.LIBCMT ref: 00E26B09
__wcsnicmp.LIBCMT ref: 00E26B21
__wcsnicmp.LIBCMT ref: 00E26B35
__wcsnicmp.LIBCMT ref: 00E26B76
__wcsnicmp.LIBCMT ref: 00E26B8A
__wcsnicmp.LIBCMT ref: 00E26B9E
__wcsnicmp.LIBCMT ref: 00E26BB2

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __wcsnicmp
String ID:
API String ID: 1038674560-0
Opcode ID: 0931da494cef05cec8b91f0bd4c9705f932a48058e9e9bcdb53fe5057f95192b
Instruction ID: d91473ff81e2cca6ad8cfefcb38ca7fa8a00aef0ff8778cfb059f0c8b69ab891
Opcode Fuzzy Hash: 0931da494cef05cec8b91f0bd4c9705f932a48058e9e9bcdb53fe5057f95192b
Instruction Fuzzy Hash: 09813CB0640225BBCF24AF30ED82FEF77A8AF14304F146125FD45BA182EB60EB59D255

Function 00E846D6 Relevance: 18.2, APIs: 12, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 00E8473C
_wcscmp.LIBCMT ref: 00E84747
_wcscat.LIBCMT ref: 00E8475D
_wcsstr.LIBCMT ref: 00E84768
_wcscat.LIBCMT ref: 00E847CD
_wcscat.LIBCMT ref: 00E847D4
_wcsncpy.LIBCMT ref: 00E847FF

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscat$_wcscmp_wcscpy_wcsncpy_wcsstr
String ID:
API String ID: 3576275495-0
Opcode ID: 94cdbcfc506f87f95492efacfbea3f2d752ded87778f8e838e5bfb1cadab23a8
Instruction ID: 3afd38a839c6b1f2d5c04d2f923a57f9eea268a5cca4d6e661dc08a172da370e
Opcode Fuzzy Hash: 94cdbcfc506f87f95492efacfbea3f2d752ded87778f8e838e5bfb1cadab23a8
Instruction Fuzzy Hash: AB410571A002017AEB14BB74AC46FBF77ECEF41710F50106AF908F6182EB759A0597A9

Function 00E47040 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00E4707B

Part of subcall function 00E48D68: __getptd_noexit.LIBCMT ref: 00E48D68

__gmtime64_s.LIBCMT ref: 00E47114
__gmtime64_s.LIBCMT ref: 00E4714A
__gmtime64_s.LIBCMT ref: 00E47167
__allrem.LIBCMT ref: 00E471BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E471D9
__allrem.LIBCMT ref: 00E471F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E4720E
__allrem.LIBCMT ref: 00E47225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E47243
__invoke_watson.LIBCMT ref: 00E472B4

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: a894b1b025fa0eb56b5d975a28b471de4d193b92b34753072ea5fa52b6b18987
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 8A7116B1A09716ABD7149E79EC41B9AB3E8AF50328F10523AF854F7681E770D94487D0

Function 00E893DF Relevance: 12.3, APIs: 8, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E891E9: __time64.LIBCMT ref: 00E891F3

Part of subcall function 00E25045: _fseek.LIBCMT ref: 00E2505D

__wsplitpath.LIBCMT ref: 00E894BE

Part of subcall function 00E4432E: __wsplitpath_helper.LIBCMT ref: 00E4436E

_wcscpy.LIBCMT ref: 00E894D1
_wcscat.LIBCMT ref: 00E894E4
__wsplitpath.LIBCMT ref: 00E89509
_wcscat.LIBCMT ref: 00E8951F
_wcscat.LIBCMT ref: 00E89532

Part of subcall function 00E8922F: _memmove.LIBCMT ref: 00E89268
Part of subcall function 00E8922F: _memmove.LIBCMT ref: 00E89277

_wcscmp.LIBCMT ref: 00E89479

Part of subcall function 00E899BE: _wcscmp.LIBCMT ref: 00E89AAE
Part of subcall function 00E899BE: _wcscmp.LIBCMT ref: 00E89AC1

_wcsncpy.LIBCMT ref: 00E8974F

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscat_wcscmp$__wsplitpath_memmove$__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 2744720387-0
Opcode ID: 7bde44c990673b2af3bc100e7e87403791543089c4b2218ce68508d90e78ae60
Instruction ID: 525d3109725297121358a5d98e4ec2e02a69a970ec1af5c380b521e900513f18
Opcode Fuzzy Hash: 7bde44c990673b2af3bc100e7e87403791543089c4b2218ce68508d90e78ae60
Instruction Fuzzy Hash: F0C14CB1D00229AACF11EF94DD85EEEB7BCAF44300F0450AAF60DF6152EB319A449F65

Function 00E7C072 Relevance: 12.1, APIs: 8, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memcmp.LIBCMT ref: 00E7C087
_memcmp.LIBCMT ref: 00E7C0A9
_memcmp.LIBCMT ref: 00E7C0C1
_memcmp.LIBCMT ref: 00E7C0D4
_memcmp.LIBCMT ref: 00E7C0EE
_memcmp.LIBCMT ref: 00E7C101
_memcmp.LIBCMT ref: 00E7C119
_memcmp.LIBCMT ref: 00E7C134

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: c12ac602da8119e874521257cd9dfaa127012efb1a5dc6b425e7bf2f3418d560
Instruction ID: 36494b664fc7a1595e9c40d39ab15d5bd008b8e9a97b0289a0bcbcdf8fd49131
Opcode Fuzzy Hash: c12ac602da8119e874521257cd9dfaa127012efb1a5dc6b425e7bf2f3418d560
Instruction Fuzzy Hash: E5210761601205B7DA10A520AD42FAF27ACAF10398F34A079FD0DB6286F755DD1181E5

Function 00E8C9C7 Relevance: 10.8, APIs: 7, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__swprintf.LIBCMT ref: 00E8CAFB
__swprintf.LIBCMT ref: 00E8CB3E

Part of subcall function 00E27F41: _memmove.LIBCMT ref: 00E27F82

__swprintf.LIBCMT ref: 00E8CB92

Part of subcall function 00E438D8: __woutput_l.LIBCMT ref: 00E43931

__swprintf.LIBCMT ref: 00E8CBE0

Part of subcall function 00E438D8: __flsbuf.LIBCMT ref: 00E43953
Part of subcall function 00E438D8: __flsbuf.LIBCMT ref: 00E4396B

__swprintf.LIBCMT ref: 00E8CC2F
__swprintf.LIBCMT ref: 00E8CC7E
__swprintf.LIBCMT ref: 00E8CCCD

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __swprintf$__flsbuf$__woutput_l_memmove
String ID:
API String ID: 1085135966-0
Opcode ID: 56caca95bc29ac1748e1b54578c136374a5eabc245eea90b4cbabceb48a1cedd
Instruction ID: 2eab42da828f59ee0c186433c160803ad2fc17ebde70eb59bbe957a4b3c00c4b
Opcode Fuzzy Hash: 56caca95bc29ac1748e1b54578c136374a5eabc245eea90b4cbabceb48a1cedd
Instruction Fuzzy Hash: F6A141B2508314ABC714FB64D986DAFB7ECFF94700F406919F586E2192EB34DA48C762

Function 00E7B397 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscmp.LIBCMT ref: 00E7B3EC
_wcscmp.LIBCMT ref: 00E7B44F
_wcsstr.LIBCMT ref: 00E7B460
_wcscmp.LIBCMT ref: 00E7B4A8
_wcscmp.LIBCMT ref: 00E7B528

Strings

@, xrefs: 00E7B3BC

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscmp$_wcsstr
String ID: @
API String ID: 3312506106-2766056989
Opcode ID: 26f0174115f4de1ad349d66af205d20e13eb213b035462e9321afc0d08666d5a
Instruction ID: 0ea52ecf0d1f7e494dc6be9b4dc1c41023534a50b0bc4f77116a6e81f70fd473
Opcode Fuzzy Hash: 26f0174115f4de1ad349d66af205d20e13eb213b035462e9321afc0d08666d5a
Instruction Fuzzy Hash: C781A0710083059FDB14DF10D885FAA7BE8EF44318F14E56AFD89AA096EB34DD49CB61

Function 00E8675A Relevance: 9.2, APIs: 6, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memmove.LIBCMT ref: 00E868AD
_memmove.LIBCMT ref: 00E867E8

Part of subcall function 00E29997: __itow.LIBCMT ref: 00E299C2
Part of subcall function 00E29997: __swprintf.LIBCMT ref: 00E29A0C

_memmove.LIBCMT ref: 00E8685B
_memmove.LIBCMT ref: 00E86942
_memmove.LIBCMT ref: 00E8695B
_memmove.LIBCMT ref: 00E86977

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: c980da28a62c4ba725a147fb03ad7cf39ad065675ec9d8c85ca63c75a62be2be
Instruction ID: 2e14432239239e9aa772e5f1b89fed062146fd83e55c80882b37ab68dd35c858
Opcode Fuzzy Hash: c980da28a62c4ba725a147fb03ad7cf39ad065675ec9d8c85ca63c75a62be2be
Instruction Fuzzy Hash: B3619A3050066A9BDF15FF24D882EFE37E4AF88308F046559F85D7B292DB31A945CB90

Function 00E84F63 Relevance: 9.2, APIs: 6, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscmp.LIBCMT ref: 00E84FFC

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: ba19efe675873d0c81a9ddd57d43b08cfe129d5363b37745d707531d05513a48
Instruction ID: 929e64727b81b8b5471c4018081aea3aec16a6c526473ff466597ef3b6e7f48e
Opcode Fuzzy Hash: ba19efe675873d0c81a9ddd57d43b08cfe129d5363b37745d707531d05513a48
Instruction Fuzzy Hash: 755175B21087859BD724EB60D8819DFB3ECEF84340F40592EB28DE3191EF74A58C8766

Function 00E29997 Relevance: 9.1, APIs: 6, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__itow.LIBCMT ref: 00E299C2
__swprintf.LIBCMT ref: 00E29A0C
__i64tow.LIBCMT ref: 00E5FA0F

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID:
API String ID: 421087845-0
Opcode ID: 3f5488ad3a946cab8c056db5eb318d354419bc3af618c4ea88005c1c2f23587b
Instruction ID: 7ad64d023fb7e215f720848e60ac3568fd2a330b6294404ebc05a303b44fd5ac
Opcode Fuzzy Hash: 3f5488ad3a946cab8c056db5eb318d354419bc3af618c4ea88005c1c2f23587b
Instruction Fuzzy Hash: 37410671604615AFDB24DF74E842F7673E8EB88314F20686FE549F7282EA3199458B11

Function 00E8589F Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcsncpy.LIBCMT ref: 00E858E1
_wcsncpy.LIBCMT ref: 00E85913
_wcsncpy.LIBCMT ref: 00E85946
_wcsncpy.LIBCMT ref: 00E85988
_wcsncpy.LIBCMT ref: 00E859C2
_wcsncpy.LIBCMT ref: 00E859F1

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: 7a73a9d8b045da8df5336bb66c02e39a5d5c0cabf30c4969930a264d4c6a1f2d
Instruction ID: 49538a72f8e206366c876349b7503a729e05e75487dee6cf64efcebcd7e76137
Opcode Fuzzy Hash: 7a73a9d8b045da8df5336bb66c02e39a5d5c0cabf30c4969930a264d4c6a1f2d
Instruction Fuzzy Hash: 064160A6C2051876CB51FBB5988AACFB3A8DF04310F50A956F518F3121FB34E715C7A9

Function 00E49D26 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00E49D26

Part of subcall function 00E433C7: __initp_misc_winsig.LIBCMT ref: 00E433E5

__mtinitlocks.LIBCMT ref: 00E49D2B
__mtterm.LIBCMT ref: 00E49D34

Part of subcall function 00E49D9C: _free.LIBCMT ref: 00E49E9D

__calloc_crt.LIBCMT ref: 00E49D59
__initptd.LIBCMT ref: 00E49D7B

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 206718379-0
Opcode ID: 0032ce98d80b6da20572b252ff7a2ec3726a0071997436604a018428a97a3cd4
Instruction ID: 7fc9779b9aa90de271e7c965dd8cf2cbd3bf1cccaec33cbab7db9af7c8cb36f4
Opcode Fuzzy Hash: 0032ce98d80b6da20572b252ff7a2ec3726a0071997436604a018428a97a3cd4
Instruction Fuzzy Hash: 46F05E72A597126AE6347BB8BC0779B26D4EF01734F206B3AF468F50E3FF2098414594

Function 00E8A45A Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00E8A49C
_memset.LIBCMT ref: 00E8A51D
_wcsncpy.LIBCMT ref: 00E8A559

Strings

:, xrefs: 00E8A4BD
\, xrefs: 00E8A4B2

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __swprintf_memset_wcsncpy
String ID: :$\
API String ID: 214737766-1166558509
Opcode ID: 5f33faa08cb701eabbd1d6ffb6acf6de227f701ccc96ef5130cbe269c31a5bbd
Instruction ID: 07631a1b3bdb164b3a887c3cd712553c65308ef238cf9770133e09da84bb615f
Opcode Fuzzy Hash: 5f33faa08cb701eabbd1d6ffb6acf6de227f701ccc96ef5130cbe269c31a5bbd
Instruction Fuzzy Hash: 3631B371500109ABDB219FA0DC48FEF73BCEF88705F1455BAF90CE2150E77096548B25

Function 00E7AA64 Relevance: 7.8, APIs: 5, Instructions: 273COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00E7AB46
_wcscmp.LIBCMT ref: 00E7AB59
_wcscmp.LIBCMT ref: 00E7ABEA
_wcscmp.LIBCMT ref: 00E7AD5C
_wcscmp.LIBCMT ref: 00E7AD96

Part of subcall function 00E4386C: _iswctype.LIBCMT ref: 00E43874

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscmp$__swprintf_iswctype
String ID:
API String ID: 3564621516-0
Opcode ID: 4b92ad8b0c6b80a2dfb9578a1e43b2159a4eff4beb40b0b2335c71dd6fe31aaa
Instruction ID: c2c3dff73e4966c3aec484dc29b13ffb62dbae702bb3437b06c8ddf03581e59a
Opcode Fuzzy Hash: 4b92ad8b0c6b80a2dfb9578a1e43b2159a4eff4beb40b0b2335c71dd6fe31aaa
Instruction Fuzzy Hash: D8A1C171204206AFD719DF20C884BAEF7E8FF84319F189639FA9DA2550D730E955CB92

Function 00E4564D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E456AB
_memcpy_s.LIBCMT ref: 00E4571D
__read_nolock.LIBCMT ref: 00E4577B
__filbuf.LIBCMT ref: 00E4579E
_memset.LIBCMT ref: 00E457E2

Part of subcall function 00E48D68: __getptd_noexit.LIBCMT ref: 00E48D68

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 8dbd51b3496345ca7cb82c2743d3bc8638698ba2a79feaee521bcd0c413a1846
Instruction ID: 18f45522e619e12dfbd947f7959408d293017b3a6bb515890221e4aad8321f5b
Opcode Fuzzy Hash: 8dbd51b3496345ca7cb82c2743d3bc8638698ba2a79feaee521bcd0c413a1846
Instruction Fuzzy Hash: EC51C432A00B05DBDB248F79E8886AE77B5AF40324F25977AF835B72D2D7709D548B40

Function 00E848F3 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00E8495D
_memmove.LIBCMT ref: 00E84970
_strcat.LIBCMT ref: 00E84989
_wcscpy.LIBCMT ref: 00E849A0
_wcscpy.LIBCMT ref: 00E849BC

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscpy$_memmove_strcat
String ID:
API String ID: 559723171-0
Opcode ID: 3e644901dee28f1f78e9cc2e3f0c9b527e20158314d878990267789537b01a74
Instruction ID: 4fca59003f1a4f9dea37f2ce24828e85336d4984a749309ce72398d0f75a4fe9
Opcode Fuzzy Hash: 3e644901dee28f1f78e9cc2e3f0c9b527e20158314d878990267789537b01a74
Instruction Fuzzy Hash: A511F071A04116ABDB20BB64AC0AEDE77ECDF80720F5011BAF50CB2091EF749AC58765

Function 00E7C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00E7C176
_memcmp.LIBCMT ref: 00E7C194
_memcmp.LIBCMT ref: 00E7C1A7
_memcmp.LIBCMT ref: 00E7C1BF
_memcmp.LIBCMT ref: 00E7C1D7

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 136c7ff23bac88b3aafdae7ad22df313182075a9526e151d416b8a52663093c7
Instruction ID: 12dbdd76b2f4c65a9443b6e0d50386c0b3c6249741a045eba488334ab0c38d9f
Opcode Fuzzy Hash: 136c7ff23bac88b3aafdae7ad22df313182075a9526e151d416b8a52663093c7
Instruction Fuzzy Hash: B501DD716451067BEA04A5209D42FAB77EC9F113A8FA490B9FD08B7243F754DE11C2E4

Function 00E26BEC Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 478COMMON

Download Yara Rule

Strings

AU3!, xrefs: 00E26CC1
EA06, xrefs: 00E5E87B

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _iswctype_wcscpy
String ID: AU3!$EA06
API String ID: 2497406411-2658333250
Opcode ID: 8ddd441a78d35076e32a957d01a437332a313098eaf865798266cc633cce37bb
Instruction ID: 17630a94eaaaefd3d8ee82572ef8ac23ad7208fb1a6769f12cb297c3e99311ca
Opcode Fuzzy Hash: 8ddd441a78d35076e32a957d01a437332a313098eaf865798266cc633cce37bb
Instruction Fuzzy Hash: 7302AF711083519FC724EF24D981AAFBBE5BF88314F14591DF89AA72A1DB30DA49CB42

Function 00E8ED8E Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00E29997: __itow.LIBCMT ref: 00E299C2
Part of subcall function 00E29997: __swprintf.LIBCMT ref: 00E29A0C

Part of subcall function 00E3FEC6: _wcscpy.LIBCMT ref: 00E3FEE9

_wcstok.LIBCMT ref: 00E8EEFF
_wcscpy.LIBCMT ref: 00E8EF8E
_memset.LIBCMT ref: 00E8EFC1

Strings

X, xrefs: 00E8EFFE

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 4834a5bba9af908416cba5e6f0ab32a119d71f01a50de142e129c452bab497dc
Instruction ID: 9c891a726164d8d33adae61a44a9e214d739898a6c038fa8e48939c74221ae2a
Opcode Fuzzy Hash: 4834a5bba9af908416cba5e6f0ab32a119d71f01a50de142e129c452bab497dc
Instruction Fuzzy Hash: 52C18E716083109FC724EF24D885A9AB7E0FF84314F10696DF99DA72A2DB30ED45CB92

Function 00E32E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00E40FF6: std::exception::exception.LIBCMT ref: 00E4102C
Part of subcall function 00E40FF6: __CxxThrowException@8.LIBCMT ref: 00E41041

Part of subcall function 00E27F41: _memmove.LIBCMT ref: 00E27F82

Part of subcall function 00E27BB1: _memmove.LIBCMT ref: 00E27C0B

__swprintf.LIBCMT ref: 00E3302D

Strings

(+I, xrefs: 00E33054, 00E330B1, 00E33058

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: (+I
API String ID: 1943609520-2960116247
Opcode ID: 33d803d847b3f5c5eab3986870dea013c9ba33329d7410d6cfcc8cbfdeac6615
Instruction ID: 89ddd1b42f035010710dff3a44f16098cd5ae81708cea571163322b37b4154f8
Opcode Fuzzy Hash: 33d803d847b3f5c5eab3986870dea013c9ba33329d7410d6cfcc8cbfdeac6615
Instruction Fuzzy Hash: 25918F712183119FC718EF24E889C6EBBE4EF85754F00691DF486A72A1DA30EE44CB52

Function 00E362F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E363A8
_memmove.LIBCMT ref: 00E36446
_memset.LIBCMT ref: 00E3646A

Strings

ERCP, xrefs: 00E36313

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 25dc1189b28c8648ea83cdad9136b95fe85d6ab8f80ab522c9aa2e22ef6a070d
Instruction ID: 8ea78e1464e3213e3f456944ea8ec8f07e9b2a59aa559d41b5b9a388bba4a69f
Opcode Fuzzy Hash: 25dc1189b28c8648ea83cdad9136b95fe85d6ab8f80ab522c9aa2e22ef6a070d
Instruction Fuzzy Hash: B6519F71900709ABDB24CF65C8857EABBF4FF04318F20D56EE65AEB241E7719A84CB50

Function 00E8DB04 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00E8DC7B
_wcscat.LIBCMT ref: 00E8DC93
_wcscat.LIBCMT ref: 00E8DCA5

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscat$__wsplitpath
String ID:
API String ID: 1413645957-0
Opcode ID: fc3230f8597e6524a7f3363b63e7403b20e8896006eff84071d3e2fe3a36d42b
Instruction ID: 9bbf5847e39c6babb453be3c169c7860c80e06e3c4fc1088d12041b1392a2dfd
Opcode Fuzzy Hash: fc3230f8597e6524a7f3363b63e7403b20e8896006eff84071d3e2fe3a36d42b
Instruction Fuzzy Hash: 458150B15082459FCB24FF24C8459AAB7E8BB88314F15A82EF88DE7291E731DD44CB52

Function 00E8DE85 Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00E8DFC1
_wcscat.LIBCMT ref: 00E8DFD9
_wcscat.LIBCMT ref: 00E8DFEB
_wcscpy.LIBCMT ref: 00E8E073

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscat$__wsplitpath_wcscpy
String ID:
API String ID: 3240238573-0
Opcode ID: dcc13d4e5357b2cc399167f9022ebe31d76fa79487d8bad422ff16d79010f260
Instruction ID: 161a28237430dd6420f9404a44fddd7a5656a57101a41f4bcadb2a8fc6f9faa2
Opcode Fuzzy Hash: dcc13d4e5357b2cc399167f9022ebe31d76fa79487d8bad422ff16d79010f260
Instruction Fuzzy Hash: C36158B25083159FDB10EF20D8419AEB3E8FF89314F04596EF98DA7291DB31E949CB52

Function 00E8A0B5 Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 00E27F41: _memmove.LIBCMT ref: 00E27F82

__swprintf.LIBCMT ref: 00E8A177
__swprintf.LIBCMT ref: 00E8A190
_wprintf.LIBCMT ref: 00E8A246
_wprintf.LIBCMT ref: 00E8A264

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __swprintf_wprintf$_memmove
String ID:
API String ID: 2249476411-0
Opcode ID: 4cd43bcf80d0820f65665fea3393de1bcc51a8b0913537eaf14d6fb74990e2d9
Instruction ID: 33acf602971218dc1e9baa19dfa9e6ecff303302c89a6de31a83e7c5300d92d9
Opcode Fuzzy Hash: 4cd43bcf80d0820f65665fea3393de1bcc51a8b0913537eaf14d6fb74990e2d9
Instruction Fuzzy Hash: D6518372900219BADF25FBE0DD86EEEB7B8AF04300F145166F509720A1EB356F58DB61

Function 00E897E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00E25045: _fseek.LIBCMT ref: 00E2505D

Part of subcall function 00E899BE: _wcscmp.LIBCMT ref: 00E89AAE
Part of subcall function 00E899BE: _wcscmp.LIBCMT ref: 00E89AC1

_free.LIBCMT ref: 00E8992C
_free.LIBCMT ref: 00E89933
_free.LIBCMT ref: 00E8999E
_free.LIBCMT ref: 00E899A6

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _free$_wcscmp$_fseek
String ID:
API String ID: 3404660211-0
Opcode ID: 88e032742d06d326e4d6d5cc1431d5dcb2cd90c0f8f7e6ce6201bb629da5c016
Instruction ID: cf23d38f06031519e180d789fb2493790c52ca2decace07de2fa6041d7425096
Opcode Fuzzy Hash: 88e032742d06d326e4d6d5cc1431d5dcb2cd90c0f8f7e6ce6201bb629da5c016
Instruction Fuzzy Hash: 0F512DB1D04258AFDF249F64DC41AAEBBB9EF48310F1414AEB60DB7241DB715A808F59

Function 00E89EA3 Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 00E27F41: _memmove.LIBCMT ref: 00E27F82

__swprintf.LIBCMT ref: 00E89F64
__swprintf.LIBCMT ref: 00E89F7D
_wprintf.LIBCMT ref: 00E8A024
_wprintf.LIBCMT ref: 00E8A042

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __swprintf_wprintf$_memmove
String ID:
API String ID: 2249476411-0
Opcode ID: 919a289ee3f523d30e238457d5dcd5ad8f839c127a8fc31a7f0e566c568d85a8
Instruction ID: 20e015fac1a4e1ad8b4f44a75a43154fed2b3703c30fe605195bebaa1b602f8b
Opcode Fuzzy Hash: 919a289ee3f523d30e238457d5dcd5ad8f839c127a8fc31a7f0e566c568d85a8
Instruction Fuzzy Hash: 1051A572900219BADF15FBE0DD82EEEB7B9AF08300F245166F50972091EB752F58DB61

Function 00E4493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E449D0
__flush.LIBCMT ref: 00E449F0
__write.LIBCMT ref: 00E44A23
__flsbuf.LIBCMT ref: 00E44A51

Part of subcall function 00E48D68: __getptd_noexit.LIBCMT ref: 00E48D68

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: c493345b90a54299f19da1f1b80ffad1cdca9c45b265d9ae20e396771537fb45
Instruction ID: f2717002921725bdb2039d2f895175ad1a3a6da40a749e085468a2ea65858a36
Opcode Fuzzy Hash: c493345b90a54299f19da1f1b80ffad1cdca9c45b265d9ae20e396771537fb45
Instruction Fuzzy Hash: FC41E8B1B006069BDF18CE69E880BAF77A5EFC4354B24913DE955E76C0E770DD40A744

Function 00E59187 Relevance: 6.1, APIs: 4, Instructions: 130COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E48D68: __getptd_noexit.LIBCMT ref: 00E48D68

__getbuf.LIBCMT ref: 00E59221
__write.LIBCMT ref: 00E5924F
__lseeki64.LIBCMT ref: 00E59293
__write.LIBCMT ref: 00E592C2

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __write$__getbuf__getptd_noexit__lseeki64
String ID:
API String ID: 4182129353-0
Opcode ID: 3a829089bdaea1667142616d274cfe03e737d4b106993d1ff820ab1d966bf4dc
Instruction ID: f4aa9f6287dbf539188662a0d492de98881dfa20b6c7502118783f04564d0a43
Opcode Fuzzy Hash: 3a829089bdaea1667142616d274cfe03e737d4b106993d1ff820ab1d966bf4dc
Instruction Fuzzy Hash: C7411575500B01EFD7249F68E841AFA73E4EF81325F049A2DEC66AB6E2D734EC048B10

Function 00E8F200 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00E8F236
_wcscmp.LIBCMT ref: 00E8F24D
_wcscmp.LIBCMT ref: 00E8F2DF
_wcscmp.LIBCMT ref: 00E8F2F6

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 58bcf13c288eddfd2e692422b01c0418072611c199188e78e98c6afa980456a9
Instruction ID: 11ac4850ace311d002d418c565b394d68024d0482904ee7bb21bf621504f0657
Opcode Fuzzy Hash: 58bcf13c288eddfd2e692422b01c0418072611c199188e78e98c6afa980456a9
Instruction Fuzzy Hash: 5331C7765012196EDB10EBB4EC48ADE77AC9F48365F1005B6E808F30A0DB34DA49CB64

Function 00E8F35D Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00E8F393
_wcscmp.LIBCMT ref: 00E8F3AA
_wcscmp.LIBCMT ref: 00E8F427
_wcscmp.LIBCMT ref: 00E8F43E

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: ec6b9d9e702f045fbfb62a8a4d4bf93f4726aadb3ab887182078068f471a89aa
Instruction ID: 04ab077f3cc2591b1e166206cd4180f90c321a6d8019f7c174ed1797ee0519f3
Opcode Fuzzy Hash: ec6b9d9e702f045fbfb62a8a4d4bf93f4726aadb3ab887182078068f471a89aa
Instruction Fuzzy Hash: E131B5715012196ACB20BBB4EC88ADF77AC9F49364F201576E85CF30A0D735DA59CB64

Function 00E57207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00E5722B

Part of subcall function 00E57912: __fltout2.LIBCMT ref: 00E5793B

__cftog_l.LIBCMT ref: 00E57251
__cftoe_l.LIBCMT ref: 00E57283

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 017a2453cbcfcc24944b531973d880baaf62571aaa98cc22983e5ef917dba6fa
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: EE01807A05414ABBCF125E84EC01CEE3F62BF59346F099915FE9868031D237C9B9AB81

Function 00E9B1B7 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 00E9B2C3

Strings

xrL, xrefs: 00E9B2F9
xrL, xrefs: 00E9B325

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: __itow_s
String ID: xrL$xrL
API String ID: 3653519197-2396213246
Opcode ID: 6cdbd28f4cd270a4002642e91cc7d34447675df6c538d3934ab11c2a8ded0c4f
Instruction ID: 2f351a27feabdc4376cc4884957ab0e03efce1636e296a56974c4ead96469653
Opcode Fuzzy Hash: 6cdbd28f4cd270a4002642e91cc7d34447675df6c538d3934ab11c2a8ded0c4f
Instruction Fuzzy Hash: 41B19D70A00209ABDF14DF54D980EAEB7FAFF58304F149469F945AB252EB70E941CB60

Function 00E78858 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E7889B

Strings

, xrefs: 00E788AA

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-3916222277
Opcode ID: 7b372a644be77f3f5313eb40cabb9a66cdceb54fd3a95a3fdea66fc4a7f3adc6
Instruction ID: 8b4094f643cce7049f1bfc8a4ca75a26ed46ca6a223227b9376e18f5dc635e9f
Opcode Fuzzy Hash: 7b372a644be77f3f5313eb40cabb9a66cdceb54fd3a95a3fdea66fc4a7f3adc6
Instruction Fuzzy Hash: 90818071940209BFDF11DFA4DD49AEE7BB8EF14308F18952AF928B2161DB318E15DB60

Function 00E271EB Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 00E5EDC9

Strings

\, xrefs: 00E5EDEC

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _wcscat
String ID: \
API String ID: 2563891980-2967466578
Opcode ID: 118cb3ff050fbbb02c10eb19e7119e6ea6e2689824d79bbb51778997a341d715
Instruction ID: bc8751bb3d10c10cd2f8bfe31155a41b77a64939716cf10b686f8820d0c37bb5
Opcode Fuzzy Hash: 118cb3ff050fbbb02c10eb19e7119e6ea6e2689824d79bbb51778997a341d715
Instruction Fuzzy Hash: D6715A715083019FC754EF25EC81DABBBE8FF94350B40587EF485A32A1EB709948CB6A

Function 00E9F732 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E9F75C
_memset.LIBCMT ref: 00E9F825

Part of subcall function 00E29997: __itow.LIBCMT ref: 00E299C2
Part of subcall function 00E29997: __swprintf.LIBCMT ref: 00E29A0C

Part of subcall function 00E3FEC6: _wcscpy.LIBCMT ref: 00E3FEE9

Strings

@, xrefs: 00E9F839

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memset$__itow__swprintf_wcscpy
String ID: @
API String ID: 2523036003-2766056989
Opcode ID: ba2112da4e235f177a894c41a925b00fdd6195b9ae917a27f31cb6d548eeaf1d
Instruction ID: 35d5deb35b3f1a1f95d0c3f58a4c6bd164dc48db6686a0e82bf1284a60a766c6
Opcode Fuzzy Hash: ba2112da4e235f177a894c41a925b00fdd6195b9ae917a27f31cb6d548eeaf1d
Instruction Fuzzy Hash: F2619CB5A006299FCF14DFA4D5819AEBBF4FF48314F14A469E84ABB351CB31AD40CB90

Function 00EA73C1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EA73D9

Strings

0, xrefs: 00EA73CF
F, xrefs: 00EA74D1

Memory Dump Source

Source File: 00000000.00000002.1680216243.0000000000E21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.1680197223.0000000000E20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000EAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680346764.0000000000EE3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1680423161.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_PI No 20000814C.jbxd

Similarity

API ID: _memset
String ID: 0$F
API String ID: 2102423945-3044882817
Opcode ID: 52c22e23c74f252828f5091ec4f41fccbfb650d377574ec2eca5ca95968dfe7a
Instruction ID: 33c6bf12b65345b0fd0c064639c2711d57ee47b88b42db753d7a13c840575596
Opcode Fuzzy Hash: 52c22e23c74f252828f5091ec4f41fccbfb650d377574ec2eca5ca95968dfe7a
Instruction Fuzzy Hash: 7C415674A01205EFDB20DF64D884E9ABBF9FF4E304F144438E965AB360D730A914CB64

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PI No 20000814C.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PI No 20000814C._a57618b41515ff9a6eee1ffe6c8e07652c9a3_194af5ac_d6ddeb29-df61-48d3-b221-d18d1e03fe73\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERACA6.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD53.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD73.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
PI No 20000814C.exe

Function 00E4800A Relevance: 1.5, APIs: 1, Instructions: 2
COMMON

Function 00E358C0 Relevance: 11.0, APIs: 7, Instructions: 532
COMMON

Function 00E35680 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 516
COMMON

Function 00E26A3C Relevance: 18.3, APIs: 12, Instructions: 275
COMMON

Function 00E846D6 Relevance: 18.2, APIs: 12, Instructions: 179
COMMON

Function 00E47040 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Function 00E893DF Relevance: 12.3, APIs: 8, Instructions: 322
COMMON

Function 00E7C072 Relevance: 12.1, APIs: 8, Instructions: 92
COMMON

Function 00E8C9C7 Relevance: 10.8, APIs: 7, Instructions: 280
COMMON

Function 00E7B397 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249
COMMON

Function 00E8675A Relevance: 9.2, APIs: 6, Instructions: 205
COMMON

Function 00E84F63 Relevance: 9.2, APIs: 6, Instructions: 170
COMMON

Function 00E29997 Relevance: 9.1, APIs: 6, Instructions: 146
COMMON

Function 00E8589F Relevance: 9.1, APIs: 6, Instructions: 138
COMMON