Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
build.exe

Overview

General Information

Sample name:build.exe
Analysis ID:1454159
MD5:05eecfc1820ab3273409323601a71f23
SHA1:5076d5c3a1aa6f2ffcc299f803d0dd01b33d6dd7
SHA256:4a72f3948f014c2ded502832814c6d65feb78bd1caef7df8bcecb78f7a90b6e2
Tags:exe
Infos:

Detection

Quasar
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected Quasar RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Quasar RAT
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Writes to foreign memory regions
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Compiles C# or VB.Net code
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • build.exe (PID: 5776 cmdline: "C:\Users\user\Desktop\build.exe" MD5: 05EECFC1820AB3273409323601A71F23)
    • csc.exe (PID: 4924 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Quasar RAT, QuasarRATQuasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.
  • APT33
  • Dropping Elephant
  • Stone Panda
  • The Gorgon Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Host:Port": "OuB3'!fy.", "InstallName": "0vRva!b|>", "MutexName": "`H]\"':q", "StartupKey": "}p(3k<Y?Zi1BM", "Tag": "UnW))[Q>", "ServerSignature": "[{+'*", "ServerCertificate": "@ETksT"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
    00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Quasarrat_e52df647unknownunknown
    • 0x3ea04:$a1: GetKeyloggerLogsResponse
    • 0x3e165:$a2: DoDownloadAndExecute
    • 0x50614:$a3: http://api.ipify.org/
    • 0x4e11d:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7}
    • 0x4f46b:$a5: " /sc ONLOGON /tr "
    00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmpQuasar_RAT_1Detects Quasar RATFlorian Roth
    • 0x3df21:$s1: DoUploadAndExecute
    • 0x3e165:$s2: DoDownloadAndExecute
    • 0x3dce6:$s3: DoShellExecute
    • 0x3e11d:$s4: set_Processname
    • 0x5824:$op1: 04 1E FE 02 04 16 FE 01 60
    • 0x5748:$op2: 00 17 03 1F 20 17 19 15 28
    • 0x61ae:$op3: 00 04 03 69 91 1B 40
    • 0x69fe:$op3: 00 04 03 69 91 1B 40
    00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmpQuasardetect Remcos in memoryJPCERT/CC Incident Response Group
    • 0x4ee2a:$quasarstr1: [PRIVATE KEY LOCATION: "{0}"]
    • 0x4ea3e:$quasarstr2: User: {0}{3}Pass: {1}{3}Host: {2}
    • 0x33dc9:$class: Core.MouseKeyHook.WinApi
    00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
      Click to see the 9 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      3.2.csc.exe.720000.0.unpackJoeSecurity_QuasarYara detected Quasar RATJoe Security
        3.2.csc.exe.720000.0.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
          3.2.csc.exe.720000.0.unpackWindows_Trojan_Quasarrat_e52df647unknownunknown
          • 0x3ec04:$a1: GetKeyloggerLogsResponse
          • 0x3e365:$a2: DoDownloadAndExecute
          • 0x50814:$a3: http://api.ipify.org/
          • 0x4e31d:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7}
          • 0x4f66b:$a5: " /sc ONLOGON /tr "
          3.2.csc.exe.720000.0.unpackQuasar_RAT_1Detects Quasar RATFlorian Roth
          • 0x3e121:$s1: DoUploadAndExecute
          • 0x3e365:$s2: DoDownloadAndExecute
          • 0x3dee6:$s3: DoShellExecute
          • 0x3e31d:$s4: set_Processname
          • 0x5a24:$op1: 04 1E FE 02 04 16 FE 01 60
          • 0x5948:$op2: 00 17 03 1F 20 17 19 15 28
          • 0x63ae:$op3: 00 04 03 69 91 1B 40
          • 0x6bfe:$op3: 00 04 03 69 91 1B 40
          3.2.csc.exe.720000.0.unpackQuasar_RAT_2Detects Quasar RATFlorian Roth
          • 0x3ec04:$x1: GetKeyloggerLogsResponse
          • 0x3ee44:$s1: DoShellExecuteResponse
          • 0x3e7b3:$s2: GetPasswordsResponse
          • 0x3ed17:$s3: GetStartupItemsResponse
          • 0x3e135:$s5: RunHidden
          • 0x3e153:$s5: RunHidden
          • 0x3e161:$s5: RunHidden
          • 0x3e175:$s5: RunHidden
          Click to see the 50 entries

          Sigma Signatures

          ⊘No Sigma rule has matched

          Snort Signatures

          ⊘No Snort rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Found malware configuration
          Source: 3.2.csc.exe.720000.0.unpackMalware Configuration Extractor: Quasar {"Host:Port": "OuB3'!fy.", "InstallName": "0vRva!b|>", "MutexName": "`H]\"':q", "StartupKey": "}p(3k<Y?Zi1BM", "Tag": "UnW))[Q>", "ServerSignature": "[{+'*", "ServerCertificate": "@ETksT"}
          Multi AV Scanner detection for submitted file
          Source: build.exeReversingLabs: Detection: 16%
          Yara detected Quasar RAT
          Source: Yara matchFile source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: build.exe PID: 5776, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: csc.exe PID: 4924, type: MEMORYSTR
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.2% probability
          Source: build.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: build.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
          Source: Binary string: D:\Sources\foobar2000-desktop-1.6.x\foobar2000\Release\foobar2000.pdb source: build.exe

          Networking

          barindex
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: OuB3'!fy.
          Yara detected Generic Downloader
          Source: Yara matchFile source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPE
          Source: global trafficTCP traffic: 192.168.2.6:49708 -> 64.42.179.59:62604
          Source: Joe Sandbox ViewIP Address: 208.95.112.1 208.95.112.1
          Source: unknownDNS query: name: ip-api.com
          Source: global trafficHTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficHTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
          Source: global trafficDNS traffic detected: DNS query: ip-api.com
          Source: global trafficDNS traffic detected: DNS query: roblox.airdns.org
          Source: build.exe, build.exe, 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, build.exe, 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, csc.exe, 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org/
          Source: build.exeString found in binary or memory: http://forums.foobar2000.org/
          Source: build.exe, build.exe, 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, build.exe, 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, csc.exe, 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://freegeoip.net/xml/
          Source: build.exeString found in binary or memory: http://help.foobar2000.org/
          Source: build.exeString found in binary or memory: http://help.foobar2000.org/filesystem::g_get_canonical_pathfilesystem::g_list_directoryunpack://file
          Source: csc.exe, 00000003.00000002.4552710355.0000000006FC9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4552710355.0000000006FDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com
          Source: build.exe, build.exe, 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, build.exe, 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, csc.exe, 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4552710355.0000000006F84000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json/
          Source: csc.exe, 00000003.00000002.4552710355.0000000006FDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/
          Source: build.exeString found in binary or memory: http://schemas.microsof
          Source: csc.exe, 00000003.00000002.4552710355.0000000006FC9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: build.exeString found in binary or memory: http://wiki.hydrogenaudio.org/index.php?title=Replaygain
          Source: build.exeString found in binary or memory: http://wiki.hydrogenaudio.org/index.php?title=ReplaygainSet
          Source: build.exeString found in binary or memory: http://www.foobar2000.org/FAQ.html
          Source: build.exeString found in binary or memory: http://www.foobar2000.org/FAQ.htmlCould
          Source: build.exeString found in binary or memory: https://www.foobar2000.org/
          Source: build.exeString found in binary or memory: https://www.foobar2000.org/download
          Source: build.exeString found in binary or memory: https://www.foobar2000.org/downloadcomponent_manager::on_app_initPre
          Source: build.exeString found in binary or memory: https://www.foobar2000.org/downloadportablestandardquietcrashednoguisafeinstallfoobar2000.exe:
          Source: build.exeString found in binary or memory: https://www.foobar2000.org/license
          Source: build.exeString found in binary or memory: https://www.foobar2000.org/licensehttps://www.foobar2000.org/http://forums.foobar2000.org/AboutOpens

          Key, Mouse, Clipboard, Microphone and Screen Capturing

          barindex
          Installs a global keyboard hook
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeWindows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeJump to behavior

          E-Banking Fraud

          barindex
          Yara detected Quasar RAT
          Source: Yara matchFile source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: build.exe PID: 5776, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: csc.exe PID: 4924, type: MEMORYSTR

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Detects Vermin Keylogger Author: Florian Roth
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Detects Patchwork malware Author: Florian Roth
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Detects malware from disclosed CN malware set Author: Florian Roth
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: QuasarRAT payload Author: ditekSHen
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Detects Vermin Keylogger Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Detects Patchwork malware Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Detects malware from disclosed CN malware set Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: QuasarRAT payload Author: ditekSHen
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Detects Vermin Keylogger Author: Florian Roth
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Detects Patchwork malware Author: Florian Roth
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Detects malware from disclosed CN malware set Author: Florian Roth
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: QuasarRAT payload Author: ditekSHen
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Vermin Keylogger Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Patchwork malware Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects malware from disclosed CN malware set Author: Florian Roth
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: QuasarRAT payload Author: ditekSHen
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: QuasarRAT payload Author: ditekSHen
          Source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
          Source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
          Source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
          Source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Detects Quasar RAT Author: Florian Roth
          Source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess Stats: CPU usage > 49%
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_0041715A NtQueryDefaultLocale,0_2_0041715A
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_004175F9 NtQueryDefaultLocale,0_2_004175F9
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_004070F40_2_004070F4
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_0041CD000_2_0041CD00
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_0052D9100_2_0052D910
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_0041D2570_2_0041D257
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_00401ECD0_2_00401ECD
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_0041CABA0_2_0041CABA
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_004073020_2_00407302
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_06C0A5503_2_06C0A550
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_06C09C803_2_06C09C80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_06C099383_2_06C09938
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0B01C1F43_2_0B01C1F4
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0B01D9C83_2_0B01D9C8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0B0D4C083_2_0B0D4C08
          Source: build.exeBinary or memory string: OriginalFilename vs build.exe
          Source: build.exe, 00000000.00000003.2245234460.000000000126E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameD3D10Warp.dllj% vs build.exe
          Source: build.exe, 00000000.00000003.2245196148.000000000126C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameD3D10Warp.dllj% vs build.exe
          Source: build.exe, 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameRuntimeBroker.exej% vs build.exe
          Source: build.exe, 00000000.00000000.2088429488.00000000006A5000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamefoobar2000.exeN vs build.exe
          Source: build.exe, 00000000.00000002.2406369807.000000000101A000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRuntimeBroker.exej% vs build.exe
          Source: build.exe, 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamefoobar2000.exeN vs build.exe
          Source: build.exeBinary or memory string: OriginalFilenamefoobar2000.exeN vs build.exe
          Source: build.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
          Source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarRAT author = ditekSHen, description = QuasarRAT payload
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
          Source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarRAT author = ditekSHen, description = QuasarRAT payload
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
          Source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarRAT author = ditekSHen, description = QuasarRAT payload
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
          Source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarRAT author = ditekSHen, description = QuasarRAT payload
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
          Source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarRAT author = ditekSHen, description = QuasarRAT payload
          Source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
          Source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
          Source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
          Source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
          Source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
          Source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
          Source: 0.2.build.exe.64179a.1.raw.unpack, ----.csBase64 encoded string: 'wUl/f9Z9c0HJkgn0LkR3tgx0jNemZdZZXwtrjN37gTmQDAxJ4eNPr2zJxD5FzUY1jQK6EfZUz8L7LpT8o9WAQw==', 'vVjY5ZJ6o3UiZAcBxrVNLmrSiaHSFpdrImDrkV5LGLuTGeXI8KiLiDnHeoQPgWKXayXFoAm9/HPYQx9jgdEuUw==', 'NloEf4TXdEEtCAPA23YG77hR2gBZhlUN5TMEkM69F+Eyq9b1haRauu4n35RqUTobX693FMns3mIxEX0yOeSzgQ==', 'XdMKS0zmM2HqG9GB1xiQOPNEdup7dD0JGElTLtP+P7K5Dnyc0uQgFoqEeNn8lfszXBTQHP8SNtp2QEKv5Cc6pyOM0UMg6xlul+IBxcQoqFA=', '/M1VhpGWTx0I8npMFdssAo9WCr99LhMb3S5IME+AIGA7a506KCvXiQj+jZ6MhEim1zeP2ZJxzqpHwOWk66wdXQ==', 'prnH13WVqb4TCDeg4YtKiDyngbILmcdacqg0YSiDr2WBGmyAGWjNA3LD2I6nE9qzXt7sbFGVZ7vpLp6yHEghoA=='
          Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/1@2/2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Roaming\LogsJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMutant created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_DT5aFgoH5h6bbtKq7Q
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMutant created: NULL
          Source: build.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\build.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: build.exeReversingLabs: Detection: 16%
          Source: build.exeString found in binary or memory: /add <list-of-files> - appends the specified files to the current playlist instead of replacing the playlist content and playing them immediately
          Source: build.exeString found in binary or memory: /play, /pause, /playpause, /prev, /next, /rand, /stop - playback controls
          Source: build.exeString found in binary or memory: /play, /pause, /playpause, /prev, /next, /rand, /stop - playback controls
          Source: build.exeString found in binary or memory: " /add "%1"
          Source: build.exeString found in binary or memory: @" "addplaynow.icoicons\generic.icoSoftware\Classesfoobar2000.url.foobar2000.SOFTWARE\Classes\CLSID\{511D48AF-9E45-4CB8-8F02-9C1BE4BC3CF8}\InprocServer32/LegacyDisable{511D48AF-9E45-4CB8-8F02-9C1BE4BC3CF8}CommandDirectory\shellex\ContextMenuHandlers\Fb2kShellExtPlay in foobar2000" "%1"Enqueue in foobar2000" /add "%1"AudioCD\shell\play\commandbckupAudioCDAudioCDbckupAudioCDOverflow
          Source: build.exeString found in binary or memory: /stop
          Source: build.exeString found in binary or memory: /stop
          Source: build.exeString found in binary or memory: /install
          Source: build.exeString found in binary or memory: AMultiple wildcard levels not supported.*/immediate/add/playnow/help/?ErrorUnknown commandline parameter: /playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/nogui/noresume/quiet/safe/install/command:/playlist_command:/playing_command:/context_command:
          Source: build.exeString found in binary or memory: AMultiple wildcard levels not supported.*/immediate/add/playnow/help/?ErrorUnknown commandline parameter: /playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/nogui/noresume/quiet/safe/install/command:/playlist_command:/playing_command:/context_command:
          Source: build.exeString found in binary or memory: AMultiple wildcard levels not supported.*/immediate/add/playnow/help/?ErrorUnknown commandline parameter: /playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/nogui/noresume/quiet/safe/install/command:/playlist_command:/playing_command:/context_command:
          Source: build.exeString found in binary or memory: AMultiple wildcard levels not supported.*/immediate/add/playnow/help/?ErrorUnknown commandline parameter: /playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/nogui/noresume/quiet/safe/install/command:/playlist_command:/playing_command:/context_command:
          Source: build.exeString found in binary or memory: Do you want to continue?| files|Error writing playlist (Load Playlist%path_sort%Scanning for dead items...Rename playlist: "Select destination folderCould not save playlist to "FPLOpen...Replaces current playlist with specified file(s), then starts playback.Add files...Add folder...Add location...Adds specified file(s) to the current playlist.Adds contents of the specified folder to the current playlist.Adds the specified URL to the current playlist.New playlistLoad playlist...Save playlist...Previous playlistNext playlistRemove playlistRename playlistSave all playlists...Creates a new, empty playlist.Creates a new playlist from the specified file.Saves the current playlist to the specified file.Switches to the previous playlist.Switches to the next playlist.Removes the current playlist.Renames the current playlist.Saves all loaded playlists to files in the specified folder.VolumeMuteIncreases playback volume.Decreases playback volume.Mutes or unmutes playback. dBSet to - dB.Set playback volume to -StopPlay or pauseNextPreviousRandomStops playback.Pauses or unpauses playback.Starts playback.Starts, pauses or unpauses playback.Starts playing the next track from the current playlist.Starts playing the previous track from the current playlist.Starts playing a random track from the current playlist.Stop after currentPlayback follows cursorCursor follows playbackStops playback after currently played item.Toggles playback-follows-cursor mode.Toggles cursor-follows-playback mode.OrderSets playback order to "UndoRedoReverts the last operation.Repeats the last reverted operation.ClearSelect allClears the list.Selects all list items.Remove duplicatesRemove dead itemsRemoves duplicate items from the list.Removes dead items from the list.RemoveCropRemoves the selected items from the list.Crops the list to the selected items.1 second5 seconds10 seconds30 seconds1 minute2 minutes5 minutes10 minutesSeekBack by Ahead by Seeks back by Seeks ahead by ActivateHideActivate or hideShow now playingShow now playing in playlistActivates foobar2000 window.Hides foobar2000 window.Activates or hides foobar2000 window.Displays information about currently playing track.Focuses the playlist display on the currently playing track.Always on TopToggles always-on-top mode.Save as playlist...Saves playlist file containing specified items.ConfigureRescan foldersRescans folders specified in your Media Library configuration to update Media Library with newly added files as well as remove references to files that have been deleted.Opens the Media Library Preferences page.SearchSearches for items matching specified pattern.Remove now playing track from playlistRemoves the now playing track from its playlist.y
          Source: build.exeString found in binary or memory: /addcomponent
          Source: build.exeString found in binary or memory: No updatable components present.Checking for UpdatesNameVersionModule UTC)About Component maintenance failureInstall Componentfoobar2000 components|foo_*.zip;*.fb2k-componentAnother instance of this component already exists in your foobar2000 application folder; you need to remove it manually before you can update this component automatically.": Could not load component "(unknown - please apply changes to load)Component removal failureComponents/addcomponentCheck for updated componentsChecks for updated versions of installed components.
          Source: unknownProcess created: C:\Users\user\Desktop\build.exe "C:\Users\user\Desktop\build.exe"
          Source: C:\Users\user\Desktop\build.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
          Source: C:\Users\user\Desktop\build.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"Jump to behavior
          Source: C:\Users\user\Desktop\build.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\build.exeSection loaded: k7rn7l32.dllJump to behavior
          Source: C:\Users\user\Desktop\build.exeSection loaded: ntd3ll.dllJump to behavior
          Source: C:\Users\user\Desktop\build.exeSection loaded: d3d9.dllJump to behavior
          Source: C:\Users\user\Desktop\build.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\build.exeSection loaded: dwmapi.dllJump to behavior
          Source: C:\Users\user\Desktop\build.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\build.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\build.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\build.exeSection loaded: d3d10warp.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rasapi32.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rasman.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rtutils.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
          Source: build.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
          Source: build.exeStatic file information: File size 3124224 > 1048576
          Source: build.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x1b2a00
          Source: build.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
          Source: build.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
          Source: build.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
          Source: build.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: build.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
          Source: build.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
          Source: build.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
          Source: build.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: D:\Sources\foobar2000-desktop-1.6.x\foobar2000\Release\foobar2000.pdb source: build.exe
          Source: C:\Users\user\Desktop\build.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
          Source: C:\Users\user\Desktop\build.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"Jump to behavior
          Source: build.exeStatic PE information: real checksum: 0x2536d9 should be: 0x308742
          Source: build.exeStatic PE information: section name: _RDATA
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_00593E24 push eax; ret 0_2_00593E42
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_06C097C7 pushad ; retf 3_2_06C097C9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_06C0F938 pushfd ; retf 0006h3_2_06C0F952

          Hooking and other Techniques for Hiding and Protection

          barindex
          Hides that the sample has been downloaded from the Internet (zone.identifier)
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe:Zone.Identifier read attributes | deleteJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMemory allocated: 6AF0000 memory reserve | memory write watchJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMemory allocated: 6F60000 memory reserve | memory write watchJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMemory allocated: 6AF0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_00427A40 rdtsc 0_2_00427A40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeWindow / User API: threadDelayed 614Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeWindow / User API: threadDelayed 9193Jump to behavior
          Source: C:\Users\user\Desktop\build.exeAPI coverage: 3.2 %
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 5632Thread sleep count: 32 > 30Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 5632Thread sleep time: -29514790517935264s >= -30000sJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2120Thread sleep count: 614 > 30Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2120Thread sleep count: 9193 > 30Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 5632Thread sleep count: 41 > 30Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: csc.exe, 00000003.00000002.4551386328.0000000005071000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_00427A40 rdtsc 0_2_00427A40
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_00592412 mov esi, dword ptr fs:[00000030h]0_2_00592412
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_0059247E GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,0_2_0059247E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Allocates memory in foreign processes
          Source: C:\Users\user\Desktop\build.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 720000 protect: page execute and read and writeJump to behavior
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\build.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 720000 value starts with: 4D5AJump to behavior
          Writes to foreign memory regions
          Source: C:\Users\user\Desktop\build.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 720000Jump to behavior
          Source: C:\Users\user\Desktop\build.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 8EE008Jump to behavior
          Source: C:\Users\user\Desktop\build.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"Jump to behavior
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_00592716 cpuid 0_2_00592716
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformationJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformationJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\build.exeCode function: 0_2_00593435 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00593435
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected Quasar RAT
          Source: Yara matchFile source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: build.exe PID: 5776, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: csc.exe PID: 4924, type: MEMORYSTR

          Remote Access Functionality

          barindex
          Detected Quasar RAT
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMutex created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_DT5aFgoH5h6bbtKq7QJump to behavior
          Yara detected Quasar RAT
          Source: Yara matchFile source: 3.2.csc.exe.720000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.64179a.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.fc0000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.64179a.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.build.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: build.exe PID: 5776, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: csc.exe PID: 4924, type: MEMORYSTR

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
          Command and Scripting Interpreter          		1
          DLL Side-Loading          		311
          Process Injection          		1
          Masquerading          		11
          Input Capture          		1
          System Time Discovery          		Remote Services11
          Input Capture          		1
          Encrypted Channel          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
          DLL Side-Loading          		1
          Disable or Modify Tools          		LSASS Memory21
          Security Software Discovery          		Remote Desktop Protocol1
          Archive Collected Data          		1
          Non-Standard Port          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)31
          Virtualization/Sandbox Evasion          		Security Account Manager31
          Virtualization/Sandbox Evasion          		SMB/Windows Admin SharesData from Network Shared Drive1
          Remote Access Software          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook311
          Process Injection          		NTDS1
          Application Window Discovery          		Distributed Component Object ModelInput Capture1
          Ingress Tool Transfer          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
          Hidden Files and Directories          		LSA Secrets1
          System Network Configuration Discovery          		SSHKeylogging2
          Non-Application Layer Protocol          		Scheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts11
          Obfuscated Files or Information          		Cached Domain Credentials23
          System Information Discovery          		VNCGUI Input Capture112
          Application Layer Protocol          		Data Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          DLL Side-Loading          		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          build.exe16%ReversingLabs

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
          http://help.foobar2000.org/filesystem::g_get_canonical_pathfilesystem::g_list_directoryunpack://file0%Avira URL Cloudsafe
          https://www.foobar2000.org/licensehttps://www.foobar2000.org/http://forums.foobar2000.org/AboutOpens0%Avira URL Cloudsafe
          http://freegeoip.net/xml/0%Avira URL Cloudsafe
          OuB3'!fy.0%Avira URL Cloudsafe
          http://www.foobar2000.org/FAQ.htmlCould0%Avira URL Cloudsafe
          http://www.foobar2000.org/FAQ.html0%Avira URL Cloudsafe
          https://www.foobar2000.org/downloadportablestandardquietcrashednoguisafeinstallfoobar2000.exe:0%Avira URL Cloudsafe
          http://ip-api.com/json/0%Avira URL Cloudsafe
          http://schemas.datacontract.org/2004/07/0%Avira URL Cloudsafe
          http://wiki.hydrogenaudio.org/index.php?title=Replaygain0%Avira URL Cloudsafe
          https://www.foobar2000.org/license0%Avira URL Cloudsafe
          http://forums.foobar2000.org/0%Avira URL Cloudsafe
          http://ip-api.com0%Avira URL Cloudsafe
          http://api.ipify.org/0%Avira URL Cloudsafe
          http://help.foobar2000.org/0%Avira URL Cloudsafe
          https://www.foobar2000.org/download0%Avira URL Cloudsafe
          https://www.foobar2000.org/downloadcomponent_manager::on_app_initPre0%Avira URL Cloudsafe
          http://schemas.microsof0%Avira URL Cloudsafe
          https://www.foobar2000.org/0%Avira URL Cloudsafe
          http://wiki.hydrogenaudio.org/index.php?title=ReplaygainSet0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          ip-api.com
          		208.95.112.1
          		truefalse
            		unknown
            roblox.airdns.org
            		64.42.179.59
            		truefalse
              		unknown

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              OuB3'!fy.true
              • Avira URL Cloud: safe
              		unknown
              http://ip-api.com/json/false
              • Avira URL Cloud: safe
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://help.foobar2000.org/filesystem::g_get_canonical_pathfilesystem::g_list_directoryunpack://filebuild.exefalse
              • Avira URL Cloud: safe
              		unknown
              http://freegeoip.net/xml/build.exe, build.exe, 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, build.exe, 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, csc.exe, 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://www.foobar2000.org/licensehttps://www.foobar2000.org/http://forums.foobar2000.org/AboutOpensbuild.exefalse
              • Avira URL Cloud: safe
              		unknown
              http://wiki.hydrogenaudio.org/index.php?title=Replaygainbuild.exefalse
              • Avira URL Cloud: safe
              		unknown
              http://www.foobar2000.org/FAQ.htmlCouldbuild.exefalse
              • Avira URL Cloud: safe
              		unknown
              https://www.foobar2000.org/downloadportablestandardquietcrashednoguisafeinstallfoobar2000.exe:build.exefalse
              • Avira URL Cloud: safe
              		unknown
              http://schemas.datacontract.org/2004/07/csc.exe, 00000003.00000002.4552710355.0000000006FDC000.00000004.00000800.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.foobar2000.org/FAQ.htmlbuild.exefalse
              • Avira URL Cloud: safe
              		unknown
              http://forums.foobar2000.org/build.exefalse
              • Avira URL Cloud: safe
              		unknown
              https://www.foobar2000.org/licensebuild.exefalse
              • Avira URL Cloud: safe
              		unknown
              http://ip-api.comcsc.exe, 00000003.00000002.4552710355.0000000006FC9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4552710355.0000000006FDC000.00000004.00000800.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://api.ipify.org/build.exe, build.exe, 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, build.exe, 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, csc.exe, 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namecsc.exe, 00000003.00000002.4552710355.0000000006FC9000.00000004.00000800.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              https://www.foobar2000.org/downloadbuild.exefalse
              • Avira URL Cloud: safe
              		unknown
              https://www.foobar2000.org/downloadcomponent_manager::on_app_initPrebuild.exefalse
              • Avira URL Cloud: safe
              		unknown
              https://www.foobar2000.org/build.exefalse
              • Avira URL Cloud: safe
              		unknown
              http://schemas.microsofbuild.exefalse
              • Avira URL Cloud: safe
              		unknown
              http://wiki.hydrogenaudio.org/index.php?title=ReplaygainSetbuild.exefalse
              • Avira URL Cloud: safe
              		unknown
              http://help.foobar2000.org/build.exefalse
              • Avira URL Cloud: safe
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              208.95.112.1
              		ip-api.comUnited States
              		53334TUT-ASUSfalse
              64.42.179.59
              		roblox.airdns.orgUnited States
              		63018DEDICATEDUSfalse

              General Information

              Joe Sandbox version:40.0.0 Tourmaline
              Analysis ID:1454159
              Start date and time:2024-06-09 00:57:08 +02:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:0h 8m 1s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:6
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample name:build.exe
              Detection:MAL
              Classification:mal100.troj.spyw.evad.winEXE@3/1@2/2
              EGA Information:
              • Successful, ratio: 100%
              HCA Information:
              • Successful, ratio: 86%
              • Number of executed functions: 49
              • Number of non-executed functions: 19
              Cookbook Comments:
              • Found application associated with file extension: .exe
              • Override analysis time to 240000 for current running targets taking high CPU consumption

              Warnings

              • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
              • Report size getting too big, too many NtProtectVirtualMemory calls found.
              • Report size getting too big, too many NtQueryValueKey calls found.
              • Report size getting too big, too many NtReadVirtualMemory calls found.
              • VT rate limit hit for: build.exe

              Simulations

              Behavior and APIs

              TimeTypeDescription
              18:58:29API Interceptor10502644x Sleep call for process: csc.exe modified

              Joe Sandbox View / Context

              IPs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              208.95.112.1ZLsIkKPtLQ.exeGet hashmaliciousUnknownBrowse
              • ip-api.com/line/?fields=hosting
              ZLsIkKPtLQ.exeGet hashmaliciousUnknownBrowse
              • ip-api.com/line/?fields=hosting
              fix.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
              • ip-api.com/json/?fields=225545
              PO.docx.docGet hashmaliciousAgentTeslaBrowse
              • ip-api.com/line/?fields=hosting
              ac#U03c2.exeGet hashmaliciousAgentTeslaBrowse
              • ip-api.com/line/?fields=hosting
              PYT W2471234-MLIG.vbsGet hashmaliciousAgentTesla, GuLoaderBrowse
              • ip-api.com/line/?fields=hosting
              staff record or employee record.vbsGet hashmaliciousAgentTesla, GuLoaderBrowse
              • ip-api.com/line/?fields=hosting
              4ef10e7296fb6c5df039a4b95147b1cb4482bdbee0a097863fe345b295302cc9_dump.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
              • ip-api.com/line/?fields=hosting
              rlytKovocev.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
              • ip-api.com/line/?fields=hosting
              US00061Q0904081THBKK.exeGet hashmaliciousAgentTeslaBrowse
              • ip-api.com/line/?fields=hosting

              Domains

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              ip-api.comZLsIkKPtLQ.exeGet hashmaliciousUnknownBrowse
              • 208.95.112.1
              ZLsIkKPtLQ.exeGet hashmaliciousUnknownBrowse
              • 208.95.112.1
              fix.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
              • 208.95.112.1
              PO.docx.docGet hashmaliciousAgentTeslaBrowse
              • 208.95.112.1
              PYT W2471234-MLIG.vbsGet hashmaliciousAgentTesla, GuLoaderBrowse
              • 208.95.112.1
              staff record or employee record.vbsGet hashmaliciousAgentTesla, GuLoaderBrowse
              • 208.95.112.1
              4ef10e7296fb6c5df039a4b95147b1cb4482bdbee0a097863fe345b295302cc9_dump.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
              • 208.95.112.1
              rlytKovocev.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
              • 208.95.112.1
              US00061Q0904081THBKK.exeGet hashmaliciousAgentTeslaBrowse
              • 208.95.112.1

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              DEDICATEDUSReplace.exeGet hashmaliciousUnknownBrowse
              • 74.201.73.52
              x1b5bmJgLm.elfGet hashmaliciousUnknownBrowse
              • 200.220.163.225
              0FnrrE8B6Y.elfGet hashmaliciousMiraiBrowse
              • 168.81.61.232
              D2M15lCoQK.elfGet hashmaliciousMiraiBrowse
              • 45.74.57.45
              CGlwOBF2cH.elfGet hashmaliciousUnknownBrowse
              • 45.74.57.32
              SecuriteInfo.com.Win32.Trojan.CobaltStrike.4EYNH5.5772.17622.dllGet hashmaliciousCobaltStrikeBrowse
              • 64.42.181.227
              VlkShT2TjD.elfGet hashmaliciousGafgytBrowse
              • 172.83.131.72
              Enrollment PO, from United Way of the Midlands.emlGet hashmaliciousUnknownBrowse
              • 216.105.168.10
              9Dcya2QOaQ.elfGet hashmaliciousMiraiBrowse
              • 14.1.28.237
              file.exeGet hashmaliciousGlupteba, GuLoader, Socks5Systemz, StealcBrowse
              • 74.201.73.52
              TUT-ASUSZLsIkKPtLQ.exeGet hashmaliciousUnknownBrowse
              • 208.95.112.1
              ZLsIkKPtLQ.exeGet hashmaliciousUnknownBrowse
              • 208.95.112.1
              fix.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
              • 208.95.112.1
              PO.docx.docGet hashmaliciousAgentTeslaBrowse
              • 208.95.112.1
              ac#U03c2.exeGet hashmaliciousAgentTeslaBrowse
              • 208.95.112.1
              PYT W2471234-MLIG.vbsGet hashmaliciousAgentTesla, GuLoaderBrowse
              • 208.95.112.1
              staff record or employee record.vbsGet hashmaliciousAgentTesla, GuLoaderBrowse
              • 208.95.112.1
              4ef10e7296fb6c5df039a4b95147b1cb4482bdbee0a097863fe345b295302cc9_dump.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
              • 208.95.112.1
              rlytKovocev.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
              • 208.95.112.1
              US00061Q0904081THBKK.exeGet hashmaliciousAgentTeslaBrowse
              • 208.95.112.1

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              C:\Users\user\AppData\Roaming\Logs\06-08-2024

              Download File
              Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
              File Type:data
              Category:modified
              Size (bytes):224
              Entropy (8bit):7.0000643526969695
              Encrypted:false
              SSDEEP:3:IU7ypXNBONYLh5v3XXGUmDjgnhtHCcjRJl8c1Rz32ABfVv2XrX2MQvpFTjtBAxun:IU2yYLbHWUMgvb91llJVuX6pWxun
              MD5:EE237B2B8C0B798C319F9A5F03E264B7
              SHA1:BBDA400AF206972C9A190D9416E6C03E46D2B11B
              SHA-256:DE1671284457B2E9253BCB6BC3F8276C1ADFC9A5F3E1EBBB5AFDB0C475BB28B0
              SHA-512:FE94D648C3ECE17C5C9C15D0F60B926615ACF4D5D6066FAE1630DAB70F93505D040830641808C763E58F71CB847E841C4F403F2ABA598C24562C0D560D366B63
              Malicious:false
              Reputation:low
              Preview:.81d....4.h...c.p..o....a..a.....1....p.Wp..e.D.e...Y..6..3I...a...Y......<mooYA...........E....H.Z.L.....5^/.kI..q.d8 ..!..K...=}.B2mi.|.^.aU.R_~,..|.q.:..~.SWc.o...N..2|..CbI.GmF..../.. ..'+....L...J.Jde3....

              Static File Info

              General

              File type:PE32 executable (GUI) Intel 80386, for MS Windows
              Entropy (8bit):6.828488553975669
              TrID:
              • Win32 Executable (generic) a (10002005/4) 98.95%
              • foobar 2000 generic component (102126/2) 1.01%
              • Generic Win/DOS Executable (2004/3) 0.02%
              • DOS Executable Generic (2002/1) 0.02%
              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
              File name:build.exe
              File size:3'124'224 bytes
              MD5:05eecfc1820ab3273409323601a71f23
              SHA1:5076d5c3a1aa6f2ffcc299f803d0dd01b33d6dd7
              SHA256:4a72f3948f014c2ded502832814c6d65feb78bd1caef7df8bcecb78f7a90b6e2
              SHA512:81d10658aaf6d6341b929dcdb1eccd97dd752b7cbe7b497ed85b88a03ea540a2de6b24ae98ace353e861d1ea7ad181449e332dec26b075c4684c7286cc167a00
              SSDEEP:49152:rBT0kcpBrQvDFw/Wb/Zy8kIvLSXkbPvEZNLlUHDZQ:rdcf8i/2/Zy8kIO10Q
              TLSH:F5E5C012BB92C26DC39134B0996DA76BE265DFF82B224AC377C43D0E56368D32533E54
              File Content Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........j.l...?...?...?.s.?...?.d.?...?.~.>...?.~.>...?.~.>...?.W.?...?.~.>...?S+.?...?.~.>...?.c.>...?.c.>...?.c.>...?.c.>...?...?...

              File Icon

              Icon Hash:334de0b2926d330e

              Static PE Info

              General

              Entrypoint:0x592fb7
              Entrypoint Section:.text
              Digitally signed:false
              Imagebase:0x400000
              Subsystem:windows gui
              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Time Stamp:0x60DF6267 [Fri Jul 2 19:00:55 2021 UTC]
              TLS Callbacks:
              CLR (.Net) Version:
              OS Version Major:6
              OS Version Minor:0
              File Version Major:6
              File Version Minor:0
              Subsystem Version Major:6
              Subsystem Version Minor:0
              Import Hash:d9ca0b2979f53d063e2f67bf794d871e

              Entrypoint Preview

              Instruction
              call 00007F78914D2C1Bh
              jmp 00007F78914D25CFh
              cmp ecx, dword ptr [0060600Ch]
              jne 00007F78914D2753h
              ret
              jmp 00007F78914D2D41h
              push ebp
              mov ebp, esp
              sub esp, 0Ch
              lea ecx, dword ptr [ebp-0Ch]
              call 00007F7891350378h
              push 006005CCh
              lea eax, dword ptr [ebp-0Ch]
              push eax
              call 00007F78914D2E61h
              int3
              push ebp
              mov ebp, esp
              sub esp, 0Ch
              lea ecx, dword ptr [ebp-0Ch]
              call 00007F789134E3FBh
              push 00600520h
              lea eax, dword ptr [ebp-0Ch]
              push eax
              call 00007F78914D2E44h
              int3
              push ebp
              mov ebp, esp
              and dword ptr [0060F640h], 00000000h
              sub esp, 24h
              or dword ptr [00606010h], 01h
              push 0000000Ah
              call dword ptr [005B4270h]
              test eax, eax
              je 00007F78914D28FFh
              and dword ptr [ebp-10h], 00000000h
              xor eax, eax
              push ebx
              push esi
              push edi
              xor ecx, ecx
              lea edi, dword ptr [ebp-24h]
              push ebx
              cpuid
              mov esi, ebx
              pop ebx
              mov dword ptr [edi], eax
              mov dword ptr [edi+04h], esi
              mov dword ptr [edi+08h], ecx
              xor ecx, ecx
              mov dword ptr [edi+0Ch], edx
              mov eax, dword ptr [ebp-24h]
              mov edi, dword ptr [ebp-1Ch]
              mov dword ptr [ebp-0Ch], eax
              xor edi, 6C65746Eh
              mov eax, dword ptr [ebp-18h]
              xor eax, 49656E69h
              mov dword ptr [ebp-08h], eax
              mov eax, dword ptr [ebp-20h]
              xor eax, 756E6547h
              mov dword ptr [ebp-04h], eax
              xor eax, eax
              inc eax
              push ebx
              cpuid
              mov esi, ebx
              pop ebx
              lea ebx, dword ptr [ebp-24h]

              Rich Headers

              Programming Language:
              • [IMP] VS2008 SP1 build 30729
              • [LNK] VC++ 6.0 SP5 build 8804

              Data Directories

              NameVirtual AddressVirtual Size Is in Section
              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IMPORT0x201d840x280.rdata
              IMAGE_DIRECTORY_ENTRY_RESOURCE0x23a0000xc9e4c.rsrc
              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
              IMAGE_DIRECTORY_ENTRY_BASERELOC0x2590000x1fb5c.rsrc
              IMAGE_DIRECTORY_ENTRY_DEBUG0x1d618c0x70.rdata
              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
              IMAGE_DIRECTORY_ENTRY_TLS0x1d62000x18.rdata
              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x1b55d00x40.rdata
              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IAT0x1b40000xa10.rdata
              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x201bdc0x60.rdata
              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

              Sections

              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
              .text0x10000x1b30000x1b2a00e8593eff3ee99ade21f0b8832eb981f5False0.5174803844909405data6.619740105993806IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              .rdata0x1b40000x520000x51c0040e1f3f3f2d14d150e601d15d4be2d94False0.36135201643730885data5.133578148682718IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
              .data0x2060000x110000x96009240840389beee6c50171ef330772096False0.3370052083333333DOS executable (block device driver \277DN\346@\273)4.809660508586643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              _RDATA0x2170000x230000x22c00241f50e9d164772437fd3eebd88a3edbFalse0.16984459307553956data5.38723924085817IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
              .rsrc0x23a0000xc9e4c0xca000476a260b582dabb4c1f23a5c3221535aFalse0.5772777595142327data7.22780749407607IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

              Resources

              NameRVASizeTypeLanguageCountryZLIB Complexity
              AFX_DIALOG_LAYOUT0x23b4900x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4940x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4980x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b49c0x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4a00x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4a40x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4a80x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4ac0x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4b00x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4b40x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4b80x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4bc0x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4c00x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4c40x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4c80x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4cc0x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4d00x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4d40x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4d80x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4dc0x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4e00x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4e40x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4e80x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4ec0x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4f00x2dataEnglishUnited States5.0
              AFX_DIALOG_LAYOUT0x23b4f40x2dataEnglishUnited States5.0
              PNG0x23b4f80x779PNG image data, 256 x 256, 8-bit colormap, non-interlacedEnglishUnited States0.3319393622582331
              PNG0x23bc740x788PNG image data, 256 x 256, 8-bit colormap, non-interlacedEnglishUnited States0.33454356846473027
              PNG0x23c3fc0x5366PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States1.0004215456674472
              RT_BITMAP0x2417640x57036PC bitmap, Windows 3.x format, 44904 x 2 x 46, image size 356810, cbSize 356406, bits offset 540.6731031464116766
              RT_ICON0x29879c0xb340PC bitmap, Windows 3.x format, 6690 x 2 x 44, image size 46230, cbSize 45888, bits offset 540.48579149232914925
              RT_ICON0x2a3adc0x78f1PC bitmap, Windows 3.x format, 4215 x 2 x 35, image size 31486, cbSize 30961, bits offset 540.4694938793966603
              RT_ICON0x2ab3d00xce87PC bitmap, Windows 3.x format, 6654 x 2 x 53, image size 53264, cbSize 52871, bits offset 540.5121711335136464
              RT_ICON0x2b82580x3487bPC bitmap, Windows 3.x format, 27743 x 2 x 44, image size 215498, cbSize 215163, bits offset 540.5007645366536068
              RT_ICON0x2ecad40x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.33630393996247654
              RT_ICON0x2edb7c0x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 6720EnglishUnited States0.29319526627218934
              RT_ICON0x2ef5e40x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.258298755186722
              RT_ICON0x2f1b8c0x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.20896315540859708
              RT_ICON0x2f5db40x5cd2PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9988216480094269
              RT_ICON0x2fba880x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.5301418439716312
              RT_ICON0x2fbef00x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 1680EnglishUnited States0.4511627906976744
              RT_ICON0x2fc5a80x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400EnglishUnited States0.41270491803278686
              RT_ICON0x2fcf300x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colorsEnglishUnited States0.2956989247311828
              RT_DIALOG0x2fd2180x502dataEnglishUnited States0.3962558502340094
              RT_DIALOG0x2fd71c0x1e8dataEnglishUnited States0.5368852459016393
              RT_DIALOG0x2fd9040x318dataEnglishUnited States0.4696969696969697
              RT_DIALOG0x2fdc1c0x188dataEnglishUnited States0.5586734693877551
              RT_DIALOG0x2fdda40x1e8dataEnglishUnited States0.5430327868852459
              RT_DIALOG0x2fdf8c0x6a0dataEnglishUnited States0.3938679245283019
              RT_DIALOG0x2fe62c0x278dataEnglishUnited States0.44936708860759494
              RT_DIALOG0x2fe8a40xc8dataEnglishUnited States0.675
              RT_DIALOG0x2fe96c0x4d2dataEnglishUnited States0.3987034035656402
              RT_DIALOG0x2fee400x2b0dataEnglishUnited States0.4738372093023256
              RT_DIALOG0x2ff0f00xd0dataEnglishUnited States0.6586538461538461
              RT_DIALOG0x2ff1c00x124dataEnglishUnited States0.589041095890411
              RT_DIALOG0x2ff2e40x30edataEnglishUnited States0.4322250639386189
              RT_DIALOG0x2ff5f40x174dataEnglishUnited States0.5698924731182796
              RT_DIALOG0x2ff7680x220dataEnglishUnited States0.48713235294117646
              RT_DIALOG0x2ff9880x2d2dataEnglishUnited States0.4695290858725762
              RT_DIALOG0x2ffc5c0xecdataEnglishUnited States0.673728813559322
              RT_DIALOG0x2ffd480x1e0dataEnglishUnited States0.5229166666666667
              RT_DIALOG0x2fff280x1b0dataEnglishUnited States0.5532407407407407
              RT_DIALOG0x3000d80x1a4dataEnglishUnited States0.5333333333333333
              RT_DIALOG0x30027c0x100dataEnglishUnited States0.62890625
              RT_DIALOG0x30037c0x60dataEnglishUnited States0.7291666666666666
              RT_DIALOG0x3003dc0x4acdataEnglishUnited States0.3804347826086957
              RT_DIALOG0x3008880x326dataEnglishUnited States0.4640198511166253
              RT_DIALOG0x300bb00x1f8dataEnglishUnited States0.5496031746031746
              RT_DIALOG0x300da80xe0dataEnglishUnited States0.6607142857142857
              RT_DIALOG0x300e880x136dataEnglishUnited States0.6129032258064516
              RT_DIALOG0x300fc00x1c4dataEnglishUnited States0.5575221238938053
              RT_DIALOG0x3011840x104dataEnglishUnited States0.573076923076923
              RT_DIALOG0x3012880xaadataEnglishUnited States0.7411764705882353
              RT_DIALOG0x3013340x1f4dataEnglishUnited States0.49
              RT_DIALOG0x3015280x12cdataEnglishUnited States0.5966666666666667
              RT_DIALOG0x3016540x40dataEnglishUnited States0.765625
              RT_DIALOG0x3016940x228dataEnglishUnited States0.519927536231884
              RT_DIALOG0x3018bc0xa4dataEnglishUnited States0.6707317073170732
              RT_DIALOG0x3019600xb8dataEnglishUnited States0.6739130434782609
              RT_DIALOG0x301a180x228dataEnglishUnited States0.5018115942028986
              RT_DIALOG0x301c400xa8dataEnglishUnited States0.6607142857142857
              RT_DIALOG0x301ce80x11cdataEnglishUnited States0.5845070422535211
              RT_DIALOG0x301e040x1c8dataEnglishUnited States0.4868421052631579
              RT_DIALOG0x301fcc0x32cdataEnglishUnited States0.45566502463054187
              RT_DIALOG0x3022f80x90dataEnglishUnited States0.6944444444444444
              RT_DIALOG0x3023880xc6dataEnglishUnited States0.6919191919191919
              RT_DIALOG0x3024500x224dataEnglishUnited States0.5547445255474452
              RT_DIALOG0x3026740x224dataEnglishUnited States0.5602189781021898
              RT_DIALOG0x3028980x120dataEnglishUnited States0.5972222222222222
              RT_DIALOG0x3029b80x5d8dataEnglishUnited States0.4177807486631016
              RT_DIALOG0x302f900x17edataEnglishUnited States0.5837696335078534
              RT_DIALOG0x3031100x19edataEnglishUnited States0.5193236714975845
              RT_DIALOG0x3032b00x1e0dataEnglishUnited States0.51875
              RT_DIALOG0x3034900x3fcdataEnglishUnited States0.43823529411764706
              RT_DIALOG0x30388c0x6edataEnglishUnited States0.7181818181818181
              RT_DIALOG0x3038fc0x7cdataEnglishUnited States0.7338709677419355
              RT_DIALOG0x3039780xe4dataEnglishUnited States0.6754385964912281
              RT_ACCELERATOR0x303a5c0x20dataEnglishUnited States0.96875
              RT_ACCELERATOR0x303a7c0x18dataEnglishUnited States1.2083333333333333
              RT_ACCELERATOR0x303a940x28dataEnglishUnited States0.95
              RT_GROUP_ICON0x303abc0x76dataEnglishUnited States0.7457627118644068
              RT_GROUP_ICON0x303b340x14dataEnglishUnited States1.25
              RT_VERSION0x303b480x304dataEnglishUnited States0.4481865284974093

              Imports

              DLLImport
              SHLWAPI.dllSHDeleteKeyW, SHAutoComplete, StrCmpLogicalW
              KERNEL32.dllCancelIo, ReadDirectoryChangesW, GetFileInformationByHandle, GetOverlappedResult, LoadLibraryW, GetCurrentProcessId, SetErrorMode, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, AcquireSRWLockShared, ReleaseSRWLockShared, CreateMutexW, FindResourceExW, SetThreadPriority, GetCurrentThread, GlobalFree, SystemTimeToFileTime, LocalFileTimeToFileTime, GetVersion, SetThreadExecutionState, ResumeThread, GetLocaleInfoW, GetNumberFormatW, DecodePointer, GlobalSize, SetLastError, FindResourceW, TryEnterCriticalSection, EnterCriticalSection, LoadResource, LockResource, SizeofResource, GetProcessHeap, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, HeapDestroy, SetEndOfFile, GetFileTime, FlushFileBuffers, FindFirstFileW, GetNativeSystemInfo, lstrlenW, GetCommandLineW, GlobalAlloc, GlobalLock, GlobalUnlock, MultiByteToWideChar, ReadFile, WriteFile, DuplicateHandle, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, FileTimeToSystemTime, GetThreadPriority, GetFileSize, SetFilePointer, SetFileTime, FileTimeToLocalFileTime, DeleteFileW, RemoveDirectoryW, GetFileAttributesW, MoveFileExW, GetFileAttributesExW, FindNextFileW, FindClose, GetExitCodeThread, CopyFileW, Sleep, GetTickCount64, VirtualQuery, VirtualProtect, GetSystemInfo, DosDateTimeToFileTime, InitOnceComplete, InitOnceBeginInitialize, EncodePointer, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, LoadLibraryExA, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, FreeLibrary, IsDebuggerPresent, SetDllDirectoryW, OutputDebugStringW, WideCharToMultiByte, CreateEventW, WaitForMultipleObjects, SetEvent, ResetEvent, QueryPerformanceFrequency, QueryPerformanceCounter, MulDiv, CloseHandle, WaitForSingleObject, GetModuleHandleW, GetProcAddress, GetTickCount, InitializeCriticalSection, InitializeCriticalSectionEx, GetLastError, DeleteCriticalSection, RaiseException, GetCurrentThreadId, GetVersionExW, LeaveCriticalSection
              USER32.dllCreateDialogParamW, SetWindowLongW, BeginPaint, GetClipboardData, IsCharAlphaW, IsClipboardFormatAvailable, CharLowerW, UnregisterClassW, DestroyWindow, ShowWindow, GetDlgItem, SetLayeredWindowAttributes, PtInRect, EndDeferWindowPos, BeginDeferWindowPos, DeferWindowPos, EmptyClipboard, GetDlgCtrlID, DestroyAcceleratorTable, LoadAcceleratorsW, MoveWindow, IsChild, SetForegroundWindow, GetFocus, GetWindowPlacement, IsIconic, EnumThreadWindows, IsWindowVisible, CopyRect, MonitorFromRect, DrawTextExW, GetWindow, MonitorFromWindow, LoadIconW, TranslateAcceleratorW, RegisterClipboardFormatW, wsprintfW, AllowSetForegroundWindow, EnumWindows, GetClassNameW, SetActiveWindow, CheckMenuRadioItem, GetMenuItemCount, RegisterShellHookWindow, DeregisterShellHookWindow, CharUpperW, GetComboBoxInfo, AdjustWindowRect, DrawEdge, SetClipboardData, CloseClipboard, OpenClipboard, NotifyWinEvent, RedrawWindow, TrackMouseEvent, IsRectEmpty, InflateRect, FrameRect, UnhookWindowsHookEx, SetWindowsHookExW, CallNextHookEx, GetNextDlgTabItem, InvalidateRgn, SystemParametersInfoW, ScrollWindowEx, SetScrollPos, UpdateWindow, SetScrollInfo, SetRectEmpty, SetGestureConfig, CloseGestureInfoHandle, GetGestureInfo, MapDialogRect, IsZoomed, DrawTextW, FillRect, ReleaseCapture, GetCursorPos, SetMenuItemInfoW, GetMenuItemInfoW, GetDC, GetClientRect, RegisterWindowMessageW, RegisterClassW, DispatchMessageW, TranslateMessage, PostQuitMessage, GetMessageW, MsgWaitForMultipleObjects, PeekMessageW, IsDialogMessageW, GetWindowThreadProcessId, WindowFromPoint, MapVirtualKeyW, SendDlgItemMessageW, SetDlgItemTextW, GetSystemMetrics, OffsetRect, UnregisterHotKey, RegisterHotKey, TrackPopupMenuEx, SetMenuDefaultItem, EndPaint, IntersectRect, MapWindowPoints, EnumChildWindows, MessageBeep, InvalidateRect, DialogBoxParamW, EndDialog, GetMenu, AdjustWindowRectEx, GetWindowRect, MessageBoxW, GetActiveWindow, GetScrollInfo, SetCursor, LoadImageW, DestroyMenu, GetMonitorInfoW, MonitorFromPoint, DrawIconEx, CreatePopupMenu, TrackPopupMenu, AppendMenuW, DestroyIcon, GetMessagePos, LoadCursorW, GetClassInfoExW, RegisterClassExW, CreateWindowExW, CallWindowProcW, ClientToScreen, ScreenToClient, SetFocus, SetWindowTextW, KillTimer, SetTimer, GetKeyState, EnableWindow, SetWindowPos, DefWindowProcW, GetWindowLongW, GetWindowTextLengthW, GetWindowTextW, SetCapture, PostMessageW, IsWindowEnabled, GetParent, DrawFrameControl, GetSysColor, ReleaseDC, GetWindowDC, SendMessageW
              ADVAPI32.dllRegEnumKeyExW, RegSetValueExW, RegCloseKey, RegOpenKeyW, RegCreateKeyW, RegDeleteValueW, RegQueryInfoKeyW, RegEnumValueW, RegCreateKeyExW, CryptGetHashParam, CryptVerifySignatureW, CryptHashData, CryptCreateHash, CryptDestroyKey, CryptDestroyHash, CryptReleaseContext, CryptImportKey, CryptAcquireContextW, RegOpenKeyExW, RegQueryValueExW
              SHELL32.dllShellExecuteW, DragAcceptFiles, DragFinish, SHOpenFolderAndSelectItems, SHGetDesktopFolder, ShellExecuteExW, SHGetFolderPathW
              ole32.dllCoTaskMemAlloc, CoCreateGuid, PropVariantClear, ReleaseStgMedium, CoTaskMemFree, CoUninitialize, CoInitialize, CLSIDFromString, OleInitialize, CreateStreamOnHGlobal, RegisterDragDrop, RevokeDragDrop, DoDragDrop, OleGetClipboard, OleSetClipboard, CoCreateInstance, OleUninitialize

              Possible Origin

              Language of compilation systemCountry where language is spokenMap
              EnglishUnited States

              Network Behavior

              Network Port Distribution

              TCP Packets

              TimestampSource PortDest PortSource IPDest IP
              Jun 9, 2024 00:58:30.427321911 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 00:58:30.432347059 CEST8049707208.95.112.1192.168.2.6
              Jun 9, 2024 00:58:30.432549953 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 00:58:30.432910919 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 00:58:30.437844038 CEST8049707208.95.112.1192.168.2.6
              Jun 9, 2024 00:58:31.023138046 CEST8049707208.95.112.1192.168.2.6
              Jun 9, 2024 00:58:31.233716011 CEST8049707208.95.112.1192.168.2.6
              Jun 9, 2024 00:58:31.233820915 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 00:58:31.672353983 CEST4970862604192.168.2.664.42.179.59
              Jun 9, 2024 00:58:31.677300930 CEST626044970864.42.179.59192.168.2.6
              Jun 9, 2024 00:58:31.677433968 CEST4970862604192.168.2.664.42.179.59
              Jun 9, 2024 00:58:40.150311947 CEST626044970864.42.179.59192.168.2.6
              Jun 9, 2024 00:58:40.151092052 CEST4970862604192.168.2.664.42.179.59
              Jun 9, 2024 00:58:40.161585093 CEST4970862604192.168.2.664.42.179.59
              Jun 9, 2024 00:58:40.166524887 CEST626044970864.42.179.59192.168.2.6
              Jun 9, 2024 00:58:45.707062006 CEST4970962604192.168.2.664.42.179.59
              Jun 9, 2024 00:58:45.715641975 CEST626044970964.42.179.59192.168.2.6
              Jun 9, 2024 00:58:45.715759993 CEST4970962604192.168.2.664.42.179.59
              Jun 9, 2024 00:58:54.196542025 CEST626044970964.42.179.59192.168.2.6
              Jun 9, 2024 00:58:54.196785927 CEST4970962604192.168.2.664.42.179.59
              Jun 9, 2024 00:58:54.196850061 CEST4970962604192.168.2.664.42.179.59
              Jun 9, 2024 00:58:54.201728106 CEST626044970964.42.179.59192.168.2.6
              Jun 9, 2024 00:58:59.988590956 CEST4971162604192.168.2.664.42.179.59
              Jun 9, 2024 00:58:59.993664980 CEST626044971164.42.179.59192.168.2.6
              Jun 9, 2024 00:58:59.993810892 CEST4971162604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:08.469892979 CEST626044971164.42.179.59192.168.2.6
              Jun 9, 2024 00:59:08.469988108 CEST4971162604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:08.470751047 CEST4971162604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:08.475684881 CEST626044971164.42.179.59192.168.2.6
              Jun 9, 2024 00:59:08.623506069 CEST8049707208.95.112.1192.168.2.6
              Jun 9, 2024 00:59:08.623640060 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 00:59:14.035347939 CEST4971262604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:14.040432930 CEST626044971264.42.179.59192.168.2.6
              Jun 9, 2024 00:59:14.040549040 CEST4971262604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:22.514908075 CEST626044971264.42.179.59192.168.2.6
              Jun 9, 2024 00:59:22.515017986 CEST4971262604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:22.515206099 CEST4971262604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:22.520121098 CEST626044971264.42.179.59192.168.2.6
              Jun 9, 2024 00:59:28.003921032 CEST4971362604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:28.009838104 CEST626044971364.42.179.59192.168.2.6
              Jun 9, 2024 00:59:28.009921074 CEST4971362604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:36.489104986 CEST626044971364.42.179.59192.168.2.6
              Jun 9, 2024 00:59:36.489192963 CEST4971362604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:36.489918947 CEST4971362604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:36.494761944 CEST626044971364.42.179.59192.168.2.6
              Jun 9, 2024 00:59:42.035345078 CEST4971462604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:42.040621042 CEST626044971464.42.179.59192.168.2.6
              Jun 9, 2024 00:59:42.040719032 CEST4971462604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:50.535265923 CEST626044971464.42.179.59192.168.2.6
              Jun 9, 2024 00:59:50.537774086 CEST4971462604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:50.538180113 CEST4971462604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:50.543044090 CEST626044971464.42.179.59192.168.2.6
              Jun 9, 2024 00:59:55.988579988 CEST4971562604192.168.2.664.42.179.59
              Jun 9, 2024 00:59:55.993824005 CEST626044971564.42.179.59192.168.2.6
              Jun 9, 2024 00:59:55.993911982 CEST4971562604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:04.489880085 CEST626044971564.42.179.59192.168.2.6
              Jun 9, 2024 01:00:04.490051985 CEST4971562604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:04.496280909 CEST4971562604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:04.501244068 CEST626044971564.42.179.59192.168.2.6
              Jun 9, 2024 01:00:10.019515038 CEST4971662604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:10.024465084 CEST626044971664.42.179.59192.168.2.6
              Jun 9, 2024 01:00:10.024665117 CEST4971662604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:11.036283016 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 01:00:11.346847057 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 01:00:11.956284046 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 01:00:13.159379959 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 01:00:15.565612078 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 01:00:18.510658026 CEST626044971664.42.179.59192.168.2.6
              Jun 9, 2024 01:00:18.512162924 CEST4971662604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:18.516267061 CEST4971662604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:18.521145105 CEST626044971664.42.179.59192.168.2.6
              Jun 9, 2024 01:00:20.378350019 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 01:00:24.254399061 CEST4971762604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:24.259490967 CEST626044971764.42.179.59192.168.2.6
              Jun 9, 2024 01:00:24.259571075 CEST4971762604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:29.987469912 CEST4970780192.168.2.6208.95.112.1
              Jun 9, 2024 01:00:32.737643957 CEST626044971764.42.179.59192.168.2.6
              Jun 9, 2024 01:00:32.737772942 CEST4971762604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:32.741714001 CEST4971762604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:32.746525049 CEST626044971764.42.179.59192.168.2.6
              Jun 9, 2024 01:00:38.410337925 CEST4971862604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:38.415189981 CEST626044971864.42.179.59192.168.2.6
              Jun 9, 2024 01:00:38.417798042 CEST4971862604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:46.921688080 CEST626044971864.42.179.59192.168.2.6
              Jun 9, 2024 01:00:46.922116995 CEST4971862604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:46.922331095 CEST4971862604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:46.927139997 CEST626044971864.42.179.59192.168.2.6
              Jun 9, 2024 01:00:52.222918987 CEST4971962604192.168.2.664.42.179.59
              Jun 9, 2024 01:00:52.228003025 CEST626044971964.42.179.59192.168.2.6
              Jun 9, 2024 01:00:52.228082895 CEST4971962604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:00.707787037 CEST626044971964.42.179.59192.168.2.6
              Jun 9, 2024 01:01:00.707891941 CEST4971962604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:00.709724903 CEST4971962604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:00.714672089 CEST626044971964.42.179.59192.168.2.6
              Jun 9, 2024 01:01:06.145164967 CEST4972062604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:06.150197983 CEST626044972064.42.179.59192.168.2.6
              Jun 9, 2024 01:01:06.150293112 CEST4972062604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:14.624651909 CEST626044972064.42.179.59192.168.2.6
              Jun 9, 2024 01:01:14.624886990 CEST4972062604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:14.625068903 CEST4972062604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:14.629863024 CEST626044972064.42.179.59192.168.2.6
              Jun 9, 2024 01:01:20.191739082 CEST4972162604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:20.196882963 CEST626044972164.42.179.59192.168.2.6
              Jun 9, 2024 01:01:20.196993113 CEST4972162604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:28.669207096 CEST626044972164.42.179.59192.168.2.6
              Jun 9, 2024 01:01:28.669435978 CEST4972162604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:28.670027018 CEST4972162604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:28.674875975 CEST626044972164.42.179.59192.168.2.6
              Jun 9, 2024 01:01:34.045419931 CEST4972262604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:34.050563097 CEST626044972264.42.179.59192.168.2.6
              Jun 9, 2024 01:01:34.050676107 CEST4972262604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:42.524682045 CEST626044972264.42.179.59192.168.2.6
              Jun 9, 2024 01:01:42.527949095 CEST4972262604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:42.532143116 CEST4972262604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:42.536956072 CEST626044972264.42.179.59192.168.2.6
              Jun 9, 2024 01:01:48.082185030 CEST4972362604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:48.087420940 CEST626044972364.42.179.59192.168.2.6
              Jun 9, 2024 01:01:48.087496996 CEST4972362604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:56.593508959 CEST626044972364.42.179.59192.168.2.6
              Jun 9, 2024 01:01:56.593802929 CEST4972362604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:56.601223946 CEST4972362604192.168.2.664.42.179.59
              Jun 9, 2024 01:01:56.606745005 CEST626044972364.42.179.59192.168.2.6
              Jun 9, 2024 01:02:01.926012993 CEST4972462604192.168.2.664.42.179.59
              Jun 9, 2024 01:02:01.930937052 CEST626044972464.42.179.59192.168.2.6
              Jun 9, 2024 01:02:01.931015968 CEST4972462604192.168.2.664.42.179.59
              Jun 9, 2024 01:02:10.423391104 CEST626044972464.42.179.59192.168.2.6
              Jun 9, 2024 01:02:10.423799038 CEST4972462604192.168.2.664.42.179.59
              Jun 9, 2024 01:02:10.424019098 CEST4972462604192.168.2.664.42.179.59
              Jun 9, 2024 01:02:10.428894997 CEST626044972464.42.179.59192.168.2.6

              UDP Packets

              TimestampSource PortDest PortSource IPDest IP
              Jun 9, 2024 00:58:30.413016081 CEST5899153192.168.2.61.1.1.1
              Jun 9, 2024 00:58:30.420564890 CEST53589911.1.1.1192.168.2.6
              Jun 9, 2024 00:58:31.567081928 CEST4934453192.168.2.61.1.1.1
              Jun 9, 2024 00:58:31.665853977 CEST53493441.1.1.1192.168.2.6

              DNS Queries

              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Jun 9, 2024 00:58:30.413016081 CEST192.168.2.61.1.1.10x9973Standard query (0)ip-api.comA (IP address)IN (0x0001)false
              Jun 9, 2024 00:58:31.567081928 CEST192.168.2.61.1.1.10xa0c7Standard query (0)roblox.airdns.orgA (IP address)IN (0x0001)false

              DNS Answers

              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Jun 9, 2024 00:58:30.420564890 CEST1.1.1.1192.168.2.60x9973No error (0)ip-api.com208.95.112.1A (IP address)IN (0x0001)false
              Jun 9, 2024 00:58:31.665853977 CEST1.1.1.1192.168.2.60xa0c7No error (0)roblox.airdns.org64.42.179.59A (IP address)IN (0x0001)false

              HTTP Request Dependency Graph

              • ip-api.com

              HTTP Packets

              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              0192.168.2.649707208.95.112.1804924C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
              TimestampBytes transferredDirectionData
              Jun 9, 2024 00:58:30.432910919 CEST144OUTGET /json/ HTTP/1.1
              User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0
              Host: ip-api.com
              Connection: Keep-Alive
              Jun 9, 2024 00:58:31.023138046 CEST468INHTTP/1.1 200 OK
              Date: Sat, 08 Jun 2024 22:58:30 GMT
              Content-Type: application/json; charset=utf-8
              Content-Length: 291
              Access-Control-Allow-Origin: *
              X-Ttl: 60
              X-Rl: 44
              Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 54 58 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 54 65 78 61 73 22 2c 22 63 69 74 79 22 3a 22 4b 69 6c 6c 65 65 6e 22 2c 22 7a 69 70 22 3a 22 37 36 35 34 39 22 2c 22 6c 61 74 22 3a 33 31 2e 30 30 36 35 2c 22 6c 6f 6e 22 3a 2d 39 37 2e 38 34 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 22 2c 22 69 73 70 22 3a 22 51 75 61 64 72 61 4e 65 74 22 2c 22 6f 72 67 22 3a 22 4f 4d 47 49 54 53 46 41 53 54 22 2c 22 61 73 22 3a 22 41 53 38 31 30 30 20 51 75 61 64 72 61 4e 65 74 20 45 6e 74 65 72 70 72 69 73 65 73 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 31 22 7d
              Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"TX","regionName":"Texas","city":"Killeen","zip":"76549","lat":31.0065,"lon":-97.8406,"timezone":"America/Chicago","isp":"QuadraNet","org":"OMGITSFAST","as":"AS8100 QuadraNet Enterprises LLC","query":"173.254.250.91"}
              Jun 9, 2024 00:58:31.233716011 CEST468INHTTP/1.1 200 OK
              Date: Sat, 08 Jun 2024 22:58:30 GMT
              Content-Type: application/json; charset=utf-8
              Content-Length: 291
              Access-Control-Allow-Origin: *
              X-Ttl: 60
              X-Rl: 44
              Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 54 58 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 54 65 78 61 73 22 2c 22 63 69 74 79 22 3a 22 4b 69 6c 6c 65 65 6e 22 2c 22 7a 69 70 22 3a 22 37 36 35 34 39 22 2c 22 6c 61 74 22 3a 33 31 2e 30 30 36 35 2c 22 6c 6f 6e 22 3a 2d 39 37 2e 38 34 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 22 2c 22 69 73 70 22 3a 22 51 75 61 64 72 61 4e 65 74 22 2c 22 6f 72 67 22 3a 22 4f 4d 47 49 54 53 46 41 53 54 22 2c 22 61 73 22 3a 22 41 53 38 31 30 30 20 51 75 61 64 72 61 4e 65 74 20 45 6e 74 65 72 70 72 69 73 65 73 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 31 22 7d
              Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"TX","regionName":"Texas","city":"Killeen","zip":"76549","lat":31.0065,"lon":-97.8406,"timezone":"America/Chicago","isp":"QuadraNet","org":"OMGITSFAST","as":"AS8100 QuadraNet Enterprises LLC","query":"173.254.250.91"}


              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              High Level Behavior Distribution

              Click to dive into process behavior distribution

              Behavior

              Click to jump to process

              System Behavior

              General

              Target ID:0
              Start time:18:57:55
              Start date:08/06/2024
              Path:C:\Users\user\Desktop\build.exe
              Wow64 process (32bit):true
              Commandline:"C:\Users\user\Desktop\build.exe"
              Imagebase:0x400000
              File size:3'124'224 bytes
              MD5 hash:05EECFC1820AB3273409323601A71F23
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Yara matches:
              • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
              • Rule: Windows_Trojan_Quasarrat_e52df647, Description: unknown, Source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
              • Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth
              • Rule: Quasar, Description: detect Remcos in memory, Source: 00000000.00000002.2406369807.0000000000FC2000.00000040.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
              • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
              • Rule: Windows_Trojan_Quasarrat_e52df647, Description: unknown, Source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, Author: unknown
              • Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, Author: Florian Roth
              • Rule: Quasar, Description: detect Remcos in memory, Source: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
              Reputation:low
              Has exited:true

              General

              Target ID:3
              Start time:18:58:26
              Start date:08/06/2024
              Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
              Wow64 process (32bit):true
              Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
              Imagebase:0xc90000
              File size:2'141'552 bytes
              MD5 hash:EB80BB1CA9B9C7F516FF69AFCFD75B7D
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Yara matches:
              • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
              • Rule: Windows_Trojan_Quasarrat_e52df647, Description: unknown, Source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
              • Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth
              • Rule: Quasar, Description: detect Remcos in memory, Source: 00000003.00000002.4550205864.0000000000722000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
              Reputation:moderate
              Has exited:false

              Disassembly

              Reset < >

                Execution Graph

                Execution Coverage:1.2%
                Dynamic/Decrypted Code Coverage:0%
                Signature Coverage:12%
                Total number of Nodes:573
                Total number of Limit Nodes:0
                execution_graph 4067 406660 4068 426668 4067->4068 4079 4cedd0 4068->4079 4070 426671 4071 4266f2 4070->4071 4072 4cedd0 10 API calls 4070->4072 4073 426772 4072->4073 4075 426786 4073->4075 4087 592716 4073->4087 4076 426889 4092 4230e0 4076->4092 4080 4cedfe 4079->4080 4081 4cee40 4079->4081 4099 592b09 EnterCriticalSection 4080->4099 4081->4070 4083 4cee08 4083->4081 4084 592716 IsProcessorFeaturePresent 4083->4084 4085 4cee22 4084->4085 4104 592abf EnterCriticalSection LeaveCriticalSection 4085->4104 4089 59271b 4087->4089 4088 592735 4088->4076 4089->4088 4090 593008 IsProcessorFeaturePresent 4089->4090 4091 59302d 4090->4091 4091->4076 4111 423e10 4092->4111 4098 42319d 4100 592b1d 4099->4100 4101 592b22 LeaveCriticalSection 4100->4101 4108 592b91 4100->4108 4101->4083 4105 592b5b 4104->4105 4106 592b77 SetEvent ResetEvent 4105->4106 4107 592b66 4105->4107 4106->4081 4107->4081 4109 592bb8 LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 4108->4109 4110 592b9f 4108->4110 4109->4110 4110->4100 4112 423e56 4111->4112 4114 42310b 4112->4114 4131 421f40 4112->4131 4115 57eff1 4114->4115 4116 57effb __EH_prolog 4115->4116 4240 57f258 4116->4240 4121 525120 4122 52514e 4121->4122 4130 5251bd 4121->4130 4123 592b09 5 API calls 4122->4123 4124 525158 4123->4124 4125 592716 IsProcessorFeaturePresent 4124->4125 4124->4130 4126 525174 4125->4126 4128 5251a7 4126->4128 4252 4b0700 4126->4252 4129 592abf __Init_thread_footer 4 API calls 4128->4129 4129->4130 4130->4098 4132 422147 4131->4132 4133 421f5e 4131->4133 4132->4114 4134 422158 4133->4134 4135 421f6c GetClientRect 4133->4135 4136 422161 4134->4136 4137 42236c 4134->4137 4138 42209d 4135->4138 4146 421faa 4135->4146 4136->4132 4140 422184 BeginDeferWindowPos 4136->4140 4137->4132 4143 42239a GetWindowLongW GetWindowLongW 4137->4143 4138->4132 4144 4220b2 GetWindowLongW 4138->4144 4139 421fb0 GetDlgItem 4141 421fd3 GetWindowRect 4139->4141 4139->4146 4142 4222d4 4140->4142 4160 4221bc 4140->4160 4141->4146 4147 421fea MapWindowPoints 4141->4147 4148 422355 EndDeferWindowPos 4142->4148 4149 4222da GetClientRect 4142->4149 4150 4223c7 4143->4150 4151 42241f 4143->4151 4144->4132 4145 4220c3 CreateWindowExW 4144->4145 4145->4132 4153 4220f8 GetClientRect 4145->4153 4146->4138 4146->4139 4163 54e1bd 4146->4163 4147->4146 4148->4132 4149->4148 4154 4222ec GetWindowRect 4149->4154 4150->4151 4152 4223ce MapDialogRect AdjustWindowRectEx 4150->4152 4151->4132 4156 42242d MapDialogRect AdjustWindowRectEx 4151->4156 4152->4151 4153->4132 4155 42210a GetWindowRect 4153->4155 4154->4148 4157 4222fe IsZoomed DeferWindowPos EndDeferWindowPos 4154->4157 4155->4132 4158 42211c SetWindowPos 4155->4158 4156->4132 4157->4132 4158->4132 4161 4222a0 DeferWindowPos 4160->4161 4162 422294 GetDlgItem 4160->4162 4161->4142 4161->4160 4162->4161 4164 54e278 4163->4164 4165 54e1e3 4163->4165 4165->4164 4168 54e283 4165->4168 4169 54e26c 4168->4169 4170 54e28b 4168->4170 4169->4146 4172 424220 4170->4172 4173 424246 4172->4173 4174 424236 4172->4174 4173->4169 4174->4173 4175 424286 4174->4175 4182 59247e GetProcessHeap HeapAlloc 4174->4182 4178 424299 4175->4178 4191 592580 4175->4191 4198 5924e3 4178->4198 4181 4242bd 4181->4169 4183 59249a 4182->4183 4184 592496 4182->4184 4202 592210 4183->4202 4184->4175 4186 5924a5 4188 5924b5 4186->4188 4216 59231c 4186->4216 4189 5924df 4188->4189 4190 5924ce GetProcessHeap HeapFree 4188->4190 4189->4175 4190->4184 4192 59258b 4191->4192 4197 5925a2 4191->4197 4193 5925a4 4192->4193 4194 592597 4192->4194 4192->4197 4196 592210 5 API calls 4193->4196 4239 5922e7 GetCurrentProcess FlushInstructionCache 4194->4239 4196->4197 4197->4178 4199 5924ef 4198->4199 4201 4242a2 SetWindowLongW 4198->4201 4200 592210 5 API calls 4199->4200 4199->4201 4200->4201 4201->4181 4203 59222a LoadLibraryExA 4202->4203 4204 59221d DecodePointer 4202->4204 4205 5922bb 4203->4205 4206 592243 4203->4206 4204->4186 4205->4186 4229 5922c0 GetProcAddress 4206->4229 4208 592253 4208->4205 4209 5922c0 2 API calls 4208->4209 4210 59226a 4209->4210 4210->4205 4211 5922c0 2 API calls 4210->4211 4212 592281 4211->4212 4212->4205 4213 5922c0 2 API calls 4212->4213 4214 592298 4213->4214 4214->4205 4215 59229f DecodePointer 4214->4215 4215->4205 4217 592329 4216->4217 4224 59232e 4216->4224 4232 592412 IsProcessorFeaturePresent 4217->4232 4218 59233c GetProcessHeap HeapAlloc 4221 59238a RaiseException 4218->4221 4227 592351 4218->4227 4219 592356 InterlockedPopEntrySList 4222 592374 VirtualAlloc 4219->4222 4219->4227 4221->4227 4222->4221 4223 59239c InterlockedPopEntrySList 4222->4223 4225 5923b1 VirtualFree 4223->4225 4226 5923c2 4223->4226 4224->4218 4224->4219 4224->4221 4225->4227 4228 5923c8 InterlockedPushEntrySList 4226->4228 4227->4188 4228->4227 4228->4228 4230 5922d3 4229->4230 4231 5922d7 EncodePointer 4229->4231 4230->4208 4231->4208 4233 59241e 4232->4233 4234 592425 GetPEB 4232->4234 4233->4224 4235 592471 4234->4235 4236 592437 GetProcessHeap HeapAlloc 4234->4236 4235->4224 4236->4235 4237 59244e InitializeSListHead 4236->4237 4237->4235 4238 592461 GetProcessHeap HeapFree 4237->4238 4238->4235 4239->4197 4241 592716 IsProcessorFeaturePresent 4240->4241 4242 57f034 4241->4242 4243 57f2d4 4242->4243 4246 57f548 4243->4246 4245 42312c 4245->4098 4245->4121 4247 57f557 4246->4247 4249 57f5ad 4246->4249 4248 592716 IsProcessorFeaturePresent 4247->4248 4251 57f55e 4248->4251 4250 57f548 IsProcessorFeaturePresent 4249->4250 4249->4251 4250->4251 4251->4245 4253 4b076c 4252->4253 4255 4b070e 4252->4255 4253->4126 4254 4b0762 4254->4126 4255->4254 4257 52d910 4255->4257 4258 52db10 4257->4258 4259 52d937 4257->4259 4258->4255 4260 592b09 5 API calls 4259->4260 4261 52d941 4260->4261 4261->4258 4262 592abf __Init_thread_footer 4 API calls 4261->4262 4262->4258 4263 407002 4264 407015 4263->4264 4269 40702c 4264->4269 4270 40774a 4269->4270 4271 40776f VirtualProtect 4270->4271 4272 4077a9 4271->4272 4288 4026c2 4289 4226c6 4288->4289 4292 421cf0 GetDC 4289->4292 4291 4226d3 4293 421d23 ReleaseDC 4292->4293 4293->4291 4319 401922 4320 42192a 4319->4320 4321 4219bd 4320->4321 4329 421af0 4320->4329 4324 42198b 4324->4321 4327 42198f GetWindowRect 4324->4327 4325 42194f SendMessageW 4325->4324 4326 421963 SendMessageW SendMessageW 4325->4326 4326->4324 4344 421a40 4327->4344 4330 421b04 SetLastError 4329->4330 4331 421948 4329->4331 4350 424030 4330->4350 4331->4324 4331->4325 4333 421bf2 4358 54c6d1 GetLastError 4333->4358 4334 421b18 4334->4333 4335 421b34 4334->4335 4337 59247e 24 API calls 4334->4337 4338 592580 7 API calls 4335->4338 4340 421bee SetLastError 4335->4340 4337->4335 4339 421b49 4338->4339 4341 421be2 4339->4341 4342 421b54 GetCurrentThreadId EnterCriticalSection LeaveCriticalSection CreateWindowExW 4339->4342 4340->4333 4341->4340 4342->4331 4342->4333 4345 421a53 4344->4345 4346 421a60 SendMessageW 4345->4346 4347 421a75 SendMessageW 4345->4347 4346->4347 4348 421ae3 4347->4348 4349 421aaf SendMessageW SendMessageW 4347->4349 4348->4321 4349->4348 4351 424060 4350->4351 4352 424172 4351->4352 4353 4240ce GetClassInfoExW 4351->4353 4352->4334 4354 4240e8 GetClassInfoExW 4353->4354 4355 424103 4353->4355 4354->4352 4354->4355 4356 42413a SetLastError GetClassInfoExW 4355->4356 4356->4352 4357 424165 GetLastError 4356->4357 4357->4352 4359 54c6ea 4358->4359 4360 403785 4362 423789 4360->4362 4361 4237e7 4362->4361 4363 4230e0 61 API calls 4362->4363 4364 4237cc 4363->4364 4366 423aa0 4364->4366 4368 423ae6 4366->4368 4367 423afa 4367->4361 4368->4367 4371 423bc0 4368->4371 4372 423beb 4371->4372 4374 423c08 4371->4374 4377 422750 4372->4377 4375 422750 92 API calls 4374->4375 4376 423b74 4374->4376 4375->4376 4376->4361 4378 422761 4377->4378 4379 4227bf 4377->4379 4378->4379 4380 422796 4378->4380 4381 4227c8 4378->4381 4379->4376 4380->4379 4385 4227b4 DestroyWindow 4380->4385 4382 4227d0 4381->4382 4383 4227e5 4381->4383 4390 422860 GetWindowLongW 4382->4390 4383->4379 4386 4227fe 4383->4386 4388 422816 4383->4388 4385->4379 4421 422a70 4386->4421 4388->4379 4389 42282d DestroyWindow 4388->4389 4389->4379 4391 4228a6 GetDlgItem 4390->4391 4392 422889 SetWindowLongW SetWindowPos 4390->4392 4393 4228ca 4391->4393 4394 4228c5 4391->4394 4392->4391 4396 592580 7 API calls 4393->4396 4398 4228fb GetWindowLongW 4393->4398 4395 59247e 24 API calls 4394->4395 4395->4393 4397 4228dd 4396->4397 4399 5924e3 5 API calls 4397->4399 4401 422911 SetWindowLongW 4398->4401 4402 422918 4398->4402 4400 4228e5 SetWindowLongW 4399->4400 4400->4398 4403 4228f2 4400->4403 4401->4402 4404 422931 GetDlgItem 4402->4404 4403->4398 4405 422950 4404->4405 4406 422955 4404->4406 4407 59247e 24 API calls 4405->4407 4408 592580 7 API calls 4406->4408 4410 422986 GetWindowLongW 4406->4410 4407->4406 4409 422968 4408->4409 4411 5924e3 5 API calls 4409->4411 4413 42299c SetWindowLongW 4410->4413 4415 4229a3 4410->4415 4412 422970 SetWindowLongW 4411->4412 4412->4410 4414 42297d 4412->4414 4413->4415 4414->4410 4432 54d118 4415->4432 4417 4229e8 4418 54d118 2 API calls 4417->4418 4419 422a14 GetDlgItem SendMessageW 4418->4419 4419->4379 4422 422a9b 4421->4422 4431 422b8c 4421->4431 4446 422c40 4422->4446 4425 422ba8 4428 422bc7 GetDlgItem SendMessageW 4425->4428 4426 422b1c GetDlgItem 4427 422b51 4426->4427 4451 421920 4427->4451 4430 422bfb DestroyWindow 4428->4430 4430->4431 4431->4379 4433 54d122 __EH_prolog 4432->4433 4438 54d2e9 4433->4438 4435 54d1a9 4442 54db5c 4435->4442 4437 54d1ec 4437->4417 4439 54d306 4438->4439 4441 54d302 4438->4441 4440 54d319 GetWindowTextW 4439->4440 4440->4441 4441->4435 4443 54db66 __EH_prolog 4442->4443 4444 592716 IsProcessorFeaturePresent 4443->4444 4445 54db86 4444->4445 4445->4437 4447 423e10 51 API calls 4446->4447 4448 422c75 4447->4448 4449 592716 IsProcessorFeaturePresent 4448->4449 4450 422b14 4449->4450 4450->4425 4450->4426 4452 42192a 4451->4452 4453 4219bd 4452->4453 4454 421af0 38 API calls 4452->4454 4453->4431 4455 421948 4454->4455 4456 42198b 4455->4456 4457 42194f SendMessageW 4455->4457 4456->4453 4459 42198f GetWindowRect 4456->4459 4457->4456 4458 421963 SendMessageW SendMessageW 4457->4458 4458->4456 4460 421a40 4 API calls 4459->4460 4460->4453 4273 406c07 4274 40774a 4273->4274 4275 40776f VirtualProtect 4274->4275 4276 4077a9 4275->4276 4461 409388 4462 409359 4461->4462 4463 40938d 4461->4463 4464 41f371 11 API calls 4463->4464 4465 41f367 4464->4465 3885 40776a 3886 40776f VirtualProtect 3885->3886 3887 4077a9 3886->3887 4277 593435 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 3882 4202b2 3883 4202d0 ExitProcess 3882->3883 4466 4095b3 4467 41c3de 4466->4467 4468 425461 4467->4468 4476 424da0 4467->4476 4470 4254df 4471 4cedd0 10 API calls 4470->4471 4472 4254ed 4471->4472 4473 425557 4472->4473 4481 425370 4472->4481 4492 4257a0 4473->4492 4499 427870 4476->4499 4478 424e08 4479 4cedd0 10 API calls 4478->4479 4480 424e44 4479->4480 4480->4470 4482 592716 IsProcessorFeaturePresent 4481->4482 4483 425397 4482->4483 4484 425461 4483->4484 4485 424da0 13 API calls 4483->4485 4484->4473 4486 4254df 4485->4486 4487 4cedd0 10 API calls 4486->4487 4488 4254ed 4487->4488 4489 425557 4488->4489 4490 425370 27 API calls 4488->4490 4491 4257a0 14 API calls 4489->4491 4490->4489 4491->4484 4493 425818 4492->4493 4494 425900 4493->4494 4495 42590b 4493->4495 4513 425ea0 4494->4513 4519 425cd0 4495->4519 4498 425909 4498->4468 4500 427880 4499->4500 4503 4278bb 4500->4503 4504 429510 4500->4504 4502 42789d 4502->4478 4503->4478 4505 429541 4504->4505 4506 42952f 4504->4506 4505->4502 4506->4505 4507 429582 QueryPerformanceCounter 4506->4507 4508 4295ad QueryPerformanceFrequency 4507->4508 4509 4295f9 4507->4509 4508->4509 4510 4295c4 4508->4510 4511 429625 QueryPerformanceCounter 4509->4511 4510->4502 4512 429645 4511->4512 4512->4502 4514 425efc 4513->4514 4523 425120 4514->4523 4516 425f0e 4517 425cd0 14 API calls 4516->4517 4518 425f66 4517->4518 4518->4498 4520 425cfd 4519->4520 4522 425dbb 4519->4522 4521 425120 14 API calls 4520->4521 4521->4522 4522->4498 4528 4e5510 4523->4528 4525 425149 4533 4279a0 4525->4533 4527 42515e 4527->4516 4529 4e553c GetCurrentThreadId 4528->4529 4530 4e554a 4528->4530 4529->4530 4537 4e54b0 4530->4537 4532 4e5586 4532->4525 4534 4279c4 4533->4534 4540 57fd4a 4534->4540 4536 4279f8 4536->4527 4538 4e54bc GetCurrentThreadId 4537->4538 4539 4e54ca 4537->4539 4538->4539 4539->4532 4541 57fd54 __EH_prolog 4540->4541 4544 57fdfd 4541->4544 4546 591b20 4541->4546 4545 57fe21 4544->4545 4555 591960 4544->4555 4545->4536 4547 591b5f 4546->4547 4548 591b92 GetCurrentThread GetThreadPriority 4547->4548 4549 591960 6 API calls 4548->4549 4550 591ba8 4549->4550 4551 591c02 4550->4551 4552 591bc5 SetThreadPriority ResumeThread 4550->4552 4554 591c07 GetCurrentThread GetThreadPriority 4551->4554 4553 591bde 4552->4553 4553->4541 4554->4541 4556 591969 GetCurrentThread GetThreadPriority GetThreadPriority 4555->4556 4557 5919b0 4555->4557 4558 591990 WaitForSingleObject 4556->4558 4559 591986 SetThreadPriority 4556->4559 4557->4544 4560 5919a0 CloseHandle 4558->4560 4561 5919b2 4558->4561 4559->4558 4560->4557 4561->4544 4295 4070f4 4297 4073aa 4295->4297 4296 40776f VirtualProtect 4300 4077a9 4296->4300 4298 40743c 4297->4298 4299 4076bb VirtualProtect 4297->4299 4298->4296 4299->4297 4562 4095b9 4563 41c7bf 4562->4563 4564 41c9f9 4563->4564 4567 41d306 4563->4567 4574 41caba 4564->4574 4568 41da06 VirtualProtect 4567->4568 4569 41da27 4568->4569 4570 41da41 11 API calls 4569->4570 4571 41da37 4570->4571 4572 41f371 11 API calls 4571->4572 4573 41f367 4572->4573 4581 41cb52 4574->4581 4575 41da06 VirtualProtect 4576 41da27 4575->4576 4580 41da41 11 API calls 4576->4580 4578 41cf29 4587 41ce88 4578->4587 4612 41d257 4578->4612 4579 41cb82 4579->4578 4579->4587 4602 41d1b8 4579->4602 4582 41da37 4580->4582 4581->4579 4588 41cd00 4581->4588 4584 41f371 11 API calls 4582->4584 4585 41f367 4584->4585 4587->4575 4589 41cbf9 4588->4589 4589->4588 4590 41cd00 13 API calls 4589->4590 4591 41cda5 4589->4591 4590->4589 4592 41ce88 4591->4592 4600 41d1b8 13 API calls 4591->4600 4601 41cf29 4591->4601 4593 41da06 VirtualProtect 4592->4593 4594 41da27 4593->4594 4595 41da41 11 API calls 4594->4595 4597 41da37 4595->4597 4596 41d257 12 API calls 4596->4592 4598 41f371 11 API calls 4597->4598 4599 41f367 4598->4599 4600->4601 4601->4592 4601->4596 4603 41d1c5 4602->4603 4604 41d257 12 API calls 4603->4604 4605 41d250 4603->4605 4604->4605 4606 41da06 VirtualProtect 4605->4606 4607 41da27 4606->4607 4608 41da41 11 API calls 4607->4608 4609 41da37 4608->4609 4610 41f371 11 API calls 4609->4610 4611 41f367 4610->4611 4619 41d261 4612->4619 4613 41da06 VirtualProtect 4614 41da27 4613->4614 4615 41da41 11 API calls 4614->4615 4616 41da37 4615->4616 4617 41f371 11 API calls 4616->4617 4618 41f367 4617->4618 4619->4613 3888 4066db 3889 41d843 3888->3889 3891 41d957 VirtualProtect 3889->3891 3898 41d991 3889->3898 3893 41da27 3891->3893 3906 41da41 3893->3906 3899 41d9bc VirtualProtect 3898->3899 3901 41da27 3899->3901 3902 41da41 11 API calls 3901->3902 3903 41da37 3902->3903 3910 41f371 3903->3910 3907 41da58 3906->3907 3908 41f371 11 API calls 3907->3908 3909 41f367 3908->3909 3911 41f506 3910->3911 3912 41f394 3910->3912 3925 41fcb2 3911->3925 3919 41f510 3912->3919 3920 41f51d 3919->3920 3921 41f52c 3919->3921 3937 41f7fd 3920->3937 3929 41f557 3921->3929 3926 41fcc6 ExitProcess 3925->3926 3927 41fccf 3 API calls 3925->3927 3927->3926 3931 41f56f 3929->3931 3930 41f579 3933 41f7fd 10 API calls 3930->3933 3931->3930 3940 41f5bc 3931->3940 3934 41f7f2 3933->3934 3970 41f810 3937->3970 3941 41f5f3 3940->3941 3946 41f690 3941->3946 3947 41f6b0 3946->3947 3948 41f5f3 3947->3948 3951 41f6bc 3947->3951 3949 41f690 10 API calls 3948->3949 3952 41f689 3949->3952 3950 41f75e 3962 41f7ae 3950->3962 3951->3950 3958 41f768 3951->3958 3956 41f7fd 10 API calls 3952->3956 3957 41f7f2 3956->3957 3959 41f7e8 3958->3959 3960 41f7fd 10 API calls 3959->3960 3961 41f7f2 3960->3961 3963 41f689 3962->3963 3964 41f594 3962->3964 3966 41f7fd 10 API calls 3963->3966 3964->3963 3965 41f5bc 10 API calls 3964->3965 3968 41f5b4 3965->3968 3967 41f7f2 3966->3967 3969 41f690 10 API calls 3968->3969 3969->3963 3977 41f823 ExitProcess 3970->3977 3978 41f864 3970->3978 3972 41fbd9 3974 41fcb2 4 API calls 3972->3974 3975 41fcab 3974->3975 4002 41fccf 3975->4002 3982 41f8c4 3978->3982 3983 41faef 3978->3983 3982->3972 3995 41fbe1 3982->3995 4013 41fafe 3983->4013 3996 41fbf2 3995->3996 3997 41fcb2 4 API calls 3996->3997 3999 4203a1 ExitProcess 3996->3999 3998 41fcab 3997->3998 4000 41fccf 3 API calls 3998->4000 4001 41fcc6 4000->4001 4001->3999 4005 41fd36 4002->4005 4010 41fd45 4002->4010 4003 420093 ExitProcess 4005->4003 4007 420192 4005->4007 4006 420298 4060 4202b2 4006->4060 4007->4006 4054 42022a 4007->4054 4010->4005 4043 41ffb3 4010->4043 4014 41fb2f 4013->4014 4017 41fb23 4013->4017 4024 41fb40 4014->4024 4016 41fbd9 4019 41fcb2 4 API calls 4016->4019 4017->4016 4018 41fbe1 5 API calls 4017->4018 4018->4016 4020 41fcab 4019->4020 4021 41fccf 3 API calls 4020->4021 4022 41fcc6 ExitProcess 4021->4022 4034 41fb51 4024->4034 4035 41fb88 4034->4035 4036 41fbe1 5 API calls 4035->4036 4038 41fbd9 4035->4038 4036->4038 4037 41fcb2 4 API calls 4039 41fcab 4037->4039 4038->4037 4040 41fccf 3 API calls 4039->4040 4041 41fcc6 ExitProcess 4040->4041 4047 41fdad 4043->4047 4044 420093 ExitProcess 4046 41ff59 4046->4044 4050 420192 4046->4050 4047->4046 4049 41ffb3 ExitProcess 4047->4049 4048 420298 4051 4202b2 ExitProcess 4048->4051 4049->4047 4050->4048 4052 42022a ExitProcess 4050->4052 4053 4202a9 4051->4053 4052->4050 4056 4201de 4054->4056 4055 420298 4057 4202b2 ExitProcess 4055->4057 4056->4054 4056->4055 4059 42022a ExitProcess 4056->4059 4058 4202a9 4057->4058 4059->4056 4061 4202d0 ExitProcess 4060->4061 4063 41715a 4065 4173cc 4063->4065 4064 417760 NtQueryDefaultLocale 4066 417783 4064->4066 4065->4064 4278 40763f 4279 407587 4278->4279 4281 40769b 4279->4281 4284 4076bb 4279->4284 4282 40776f VirtualProtect 4281->4282 4283 4077a9 4282->4283 4285 407700 4284->4285 4286 40776f VirtualProtect 4285->4286 4287 4077a9 4286->4287

                Executed Functions

                Function 0041CABA Relevance: 42.3, APIs: 1, Strings: 23, Instructions: 298memoryCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 0 41caba-41cb80 2 41cb91-41cbdc 0->2 3 41cb82-41cb8c 0->3 8 41cbed-41cbf3 2->8 9 41cbde-41cbe8 2->9 5 41ce4d-41ce86 3->5 10 41cec9-41cf27 5->10 11 41ce88-41cec4 5->11 12 41cbf9-41cc51 8->12 9->5 20 41cf29-41cf35 10->20 21 41cf3a-41cf4f 10->21 16 41da06-41f370 VirtualProtect call 41da41 call 41f371 11->16 15 41cc58-41cd1f call 41cd00 12->15 36 41cd21-41cd37 15->36 37 41cd39-41cd49 15->37 24 41d22b-41d232 20->24 25 41cf51-41cf5d 21->25 26 41cf62-41cf81 21->26 29 41d306-41da00 call 41d316 call 41d32c call 41d37c call 41d676 call 41d6d5 24->29 30 41d238-41d252 call 41d257 24->30 25->24 31 41cf83-41cf8f 26->31 32 41cf94-41cfa6 26->32 29->16 30->29 31->24 33 41cfb9-41d022 32->33 34 41cfa8-41cfb4 32->34 46 41d028-41d072 33->46 47 41d21f-41d225 33->47 34->24 42 41cd9c-41cda3 36->42 37->15 43 41cd4f-41cd62 37->43 50 41cde5-41ce31 42->50 51 41cda5-41cde3 42->51 43->15 49 41cd68-41cd78 43->49 56 41d083-41d094 46->56 47->24 58 41cd86 49->58 59 41cd7a-41cd84 49->59 54 41ce43 50->54 55 41ce33-41ce3d 50->55 51->5 54->5 55->12 55->54 62 41d135-41d186 56->62 63 41d09a-41d0aa 56->63 65 41cd90-41cd96 58->65 59->65 78 41d194-41d1eb call 41d1b8 62->78 79 41d188-41d192 62->79 63->62 67 41d0b0-41d101 63->67 65->42 71 41d103-41d125 67->71 72 41d127 67->72 71->72 76 41d12e 71->76 72->56 76->62 91 41d1f9 78->91 92 41d1ed-41d1f7 78->92 82 41d203-41d20a 79->82 85 41d21a 82->85 86 41d20c-41d218 82->86 85->24 86->24 91->82 92->82
                APIs
                • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 0041DA1D
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
                • API String ID: 544645111-215400123
                • Opcode ID: 25ceb620cde84b9a6f9aae2053d098413eef51a21165765ed1d1780b96466641
                • Instruction ID: 96e07906f0b69665a99d788711513d70affac305f80943359574ecec95edf81e
                • Opcode Fuzzy Hash: 25ceb620cde84b9a6f9aae2053d098413eef51a21165765ed1d1780b96466641
                • Instruction Fuzzy Hash: 85C108B1C082689EF720CA24DC84BEABB74EB91304F1481FAD84D56681D77D5FC59F62
                Function 0041CD00 Relevance: 26.8, APIs: 1, Strings: 14, Instructions: 549memoryCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 100 41cd00-41cd1f 101 41cd21-41cd37 100->101 102 41cd39-41cd49 100->102 103 41cd9c-41cda3 101->103 104 41cc58-41ccfe call 41cd00 102->104 105 41cd4f-41cd62 102->105 108 41cde5-41ce31 103->108 109 41cda5-41cde3 103->109 104->100 105->104 107 41cd68-41cd78 105->107 113 41cd86 107->113 114 41cd7a-41cd84 107->114 110 41ce43 108->110 111 41ce33-41ce3d 108->111 116 41ce4d-41ce86 109->116 110->116 111->110 117 41cbf9-41cc51 111->117 118 41cd90-41cd96 113->118 114->118 120 41cec9-41cf27 116->120 121 41ce88-41cec4 116->121 117->104 118->103 127 41cf29-41cf35 120->127 128 41cf3a-41cf4f 120->128 124 41da06-41f370 VirtualProtect call 41da41 call 41f371 121->124 130 41d22b-41d232 127->130 131 41cf51-41cf5d 128->131 132 41cf62-41cf81 128->132 134 41d306-41da00 call 41d316 call 41d32c call 41d37c call 41d676 call 41d6d5 130->134 135 41d238-41d252 call 41d257 130->135 131->130 136 41cf83-41cf8f 132->136 137 41cf94-41cfa6 132->137 134->124 135->134 136->130 138 41cfb9-41d022 137->138 139 41cfa8-41cfb4 137->139 147 41d028-41d072 138->147 148 41d21f-41d225 138->148 139->130 152 41d083-41d094 147->152 148->130 155 41d135-41d186 152->155 156 41d09a-41d0aa 152->156 170 41d194-41d1eb call 41d1b8 155->170 171 41d188-41d192 155->171 156->155 159 41d0b0-41d101 156->159 163 41d103-41d125 159->163 164 41d127 159->164 163->164 168 41d12e 163->168 164->152 168->155 183 41d1f9 170->183 184 41d1ed-41d1f7 170->184 174 41d203-41d20a 171->174 177 41d21a 174->177 178 41d20c-41d218 174->178 177->130 178->130 183->174 184->174
                APIs
                • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 0041DA1D
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID: E$P$S$W$_S$c$e$i$o$r$s$s$t$x
                • API String ID: 544645111-3000879820
                • Opcode ID: a571f0c90d2804b6c4b6a94c3c8824fd73f5f93a1ceecb7862db087940158e4a
                • Instruction ID: 884b98e7c8a569db0c5dd9b21bdebe68354a6858b6c49b710d0825530fee468d
                • Opcode Fuzzy Hash: a571f0c90d2804b6c4b6a94c3c8824fd73f5f93a1ceecb7862db087940158e4a
                • Instruction Fuzzy Hash: 0632B0B1D046689BEB24CB14DC90BEABBB5EB85304F1481FAD80D66381D7399EC2CF55
                Function 0041D257 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 233memoryCOMMON
                Download Yara Rule

                Control-flow Graph

                APIs
                • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 0041DA1D
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID: E$P$S$W$_S$c$e$i$o$r$s$s$t$x
                • API String ID: 544645111-3000879820
                • Opcode ID: 4c95bf7e24adb1db337edbd5686769632907e5f9b1fa7965824d33e121b4d76c
                • Instruction ID: d158561e8fbb367ccf9def83134a1f9f02d01e5a30f4799e541c6d94b93b0aa4
                • Opcode Fuzzy Hash: 4c95bf7e24adb1db337edbd5686769632907e5f9b1fa7965824d33e121b4d76c
                • Instruction Fuzzy Hash: 5381FBF1D086689FE7208A64DC44BEA7BB4EB81314F1480FBD84D56241D77D9EC68B92
                Function 004070F4 Relevance: 1.8, APIs: 1, Instructions: 250memoryCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 328 4070f4-40743a 330 40743c-407448 328->330 331 40744d-407462 328->331 332 40773e-4077e0 call 40775d VirtualProtect call 4077d7 330->332 333 407464-407470 331->333 334 407475-407494 331->334 371 4077e6 332->371 333->332 336 407496-4074a2 334->336 337 4074a7-4074b9 334->337 336->332 339 4074bb-4074c7 337->339 340 4074cc-407535 337->340 339->332 344 407732-407738 340->344 345 40753b-407585 340->345 344->332 347 407596-4075a7 345->347 349 407648-407673 347->349 350 4075ad-4075bd 347->350 352 407678-407699 349->352 350->349 351 4075c3-407614 350->351 354 407616-407638 351->354 355 40763a 351->355 356 4076a7-4076bf call 4076bb 352->356 357 40769b-4076a5 352->357 354->355 359 407641 354->359 355->347 356->352 368 4076c1-4076fe 356->368 361 407716-40771d 357->361 359->349 366 40772d 361->366 367 40771f-40772b 361->367 366->332 367->332 369 407700-40770a 368->369 370 40770c 368->370 369->361 370->361 371->371
                APIs
                • VirtualProtect.KERNELBASE(?,?,00000040,FFFFEBA4,?,?,?,?,?,?,?,?,00406A5A,?), ref: 0040779F
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID:
                • API String ID: 544645111-0
                • Opcode ID: 1873d2e98772a56a1f3f50abdc1a30725eabaefc76c8d9e6bd4245df3509a6a5
                • Instruction ID: 7044fe5ad64ec624e05532b87b8b60acdd503ca618109fa90a8a530f8245d850
                • Opcode Fuzzy Hash: 1873d2e98772a56a1f3f50abdc1a30725eabaefc76c8d9e6bd4245df3509a6a5
                • Instruction Fuzzy Hash: 83B16CB1E096688FEB24CB14CD90AEAB7B5FF95314F1441FAD40D67281D6386E82CF46
                Function 0041715A Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 472 41715a-41745c 476 41746f-417484 472->476 477 41745e-41746a 472->477 479 417497-4174b6 476->479 480 417486-417492 476->480 478 417760-41777d NtQueryDefaultLocale 477->478 483 417783-417797 call 417793 478->483 484 417976-4179ed call 4179be call 4179df 478->484 481 4174c9-4174db 479->481 482 4174b8-4174c4 479->482 480->478 486 4174dd-4174e9 481->486 487 4174ee-417557 481->487 482->478 502 4179fe-417a24 484->502 486->478 493 417754-41775a 487->493 494 41755d-4175a7 487->494 493->478 496 4175b8-4175c9 494->496 497 41766a-41774d 496->497 498 4175cf-4175df 496->498 497->478 498->497 500 4175e5-417636 call 4175f9 498->500 512 417638-41765a 500->512 513 41765c 500->513 506 417a31 502->506 507 417a26-417b0d call 417a72 502->507 506->502 512->513 515 417663 512->515 513->496 515->497
                APIs
                • NtQueryDefaultLocale.NTDLL(00000000,?), ref: 00417775
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: DefaultLocaleQuery
                • String ID:
                • API String ID: 2949231068-0
                • Opcode ID: 9e16f5c70233000f8796cb9847f4fe9ff4f8a1996f646a2b5f2b0288281738fc
                • Instruction ID: 1476018a360be73aa8c090b949e9f603223c4eaf32c2674842341c04bba03150
                • Opcode Fuzzy Hash: 9e16f5c70233000f8796cb9847f4fe9ff4f8a1996f646a2b5f2b0288281738fc
                • Instruction Fuzzy Hash: 119128B5D056298FEB25CB14CC90BEABBB5BB84305F2481EAD40DA7785D6389EC1CF44
                Function 00407302 Relevance: 1.6, APIs: 1, Instructions: 110memoryCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 522 407302-40743a 524 40743c-407448 522->524 525 40744d-407462 522->525 526 40773e-4077e0 call 40775d VirtualProtect call 4077d7 524->526 527 407464-407470 525->527 528 407475-407494 525->528 565 4077e6 526->565 527->526 530 407496-4074a2 528->530 531 4074a7-4074b9 528->531 530->526 533 4074bb-4074c7 531->533 534 4074cc-407535 531->534 533->526 538 407732-407738 534->538 539 40753b-407585 534->539 538->526 541 407596-4075a7 539->541 543 407648-407673 541->543 544 4075ad-4075bd 541->544 546 407678-407699 543->546 544->543 545 4075c3-407614 544->545 548 407616-407638 545->548 549 40763a 545->549 550 4076a7-4076bf call 4076bb 546->550 551 40769b-4076a5 546->551 548->549 553 407641 548->553 549->541 550->546 562 4076c1-4076fe 550->562 555 407716-40771d 551->555 553->543 560 40772d 555->560 561 40771f-40772b 555->561 560->526 561->526 563 407700-40770a 562->563 564 40770c 562->564 563->555 564->555 565->565
                APIs
                • VirtualProtect.KERNELBASE(?,?,00000040,FFFFEBA4,?,?,?,?,?,?,?,?,00406A5A,?), ref: 0040779F
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID:
                • API String ID: 544645111-0
                • Opcode ID: c344707cfbab93dcc97d1c11e4f3f2b1d6c2ec5e440ddba98dd8b3829dc6d8af
                • Instruction ID: c42c5b1f42dffbf49fc5b76768434c5c7e43c850f319e5ac3534525e9833c05b
                • Opcode Fuzzy Hash: c344707cfbab93dcc97d1c11e4f3f2b1d6c2ec5e440ddba98dd8b3829dc6d8af
                • Instruction Fuzzy Hash: 0C31E6B2D185145BF7188A11DC5AAF77778EB80310F1481BFD90E672C0DA7D6A828E52
                Function 004175F9 Relevance: 1.6, APIs: 1, Instructions: 89COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 105654f194b1627633bd327a17a53a427163800dc8890f4475b953e3d5da5d0b
                • Instruction ID: 7436e0e746358629e4f8e39342140078f633d27b8fe66c8979fcf4bf99a85519
                • Opcode Fuzzy Hash: 105654f194b1627633bd327a17a53a427163800dc8890f4475b953e3d5da5d0b
                • Instruction Fuzzy Hash: A7312671A086694BDB21CA2ACCD0BFF7BB5BF85305F2480EAC54D96612D6389EC18F04
                Function 004066DB Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 193memoryCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 230 4066db-4066de 231 41d8de-41d8f4 230->231 232 41d8f6 231->232 233 41d8fd 231->233 235 41d904-41d955 232->235 236 41d869-41d879 232->236 233->235 237 41d963-41d981 call 41d991 235->237 238 41d957-41d961 235->238 236->235 239 41d87f-41d8d0 236->239 248 41d986-41d990 237->248 240 41d9d2-41d9d9 238->240 239->232 246 41d8d2-41d8d8 239->246 243 41d9e9 240->243 244 41d9db-41d9e7 240->244 247 41d9fa-41da25 VirtualProtect 243->247 244->247 246->231 250 41da27-41f370 call 41da41 call 41f371 247->250 248->240
                APIs
                • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 0041DA1D
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID: B4GA$E$P$c$e$i$o$r$s$s$t$x
                • API String ID: 544645111-3409965509
                • Opcode ID: 045d9014f80a99a546df6506c6ee09ec708b008df3bde6707462fbf6d299fbac
                • Instruction ID: 7c2c2f91dbc6670ca05046b9be9ead0856f4a96fe15c102968989db437ed7b02
                • Opcode Fuzzy Hash: 045d9014f80a99a546df6506c6ee09ec708b008df3bde6707462fbf6d299fbac
                • Instruction Fuzzy Hash: D47105B1D086688BE720CA14CC947FB7BB4EB42305F1481FAC84D66641D63D9EC68F92
                Function 0041D991 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 120memoryCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 260 41d991-41d9ba 261 41d9c8 260->261 262 41d9bc-41d9c6 260->262 263 41d9d2-41d9d9 261->263 262->263 264 41d9e9 263->264 265 41d9db-41d9e7 263->265 266 41d9fa-41da25 VirtualProtect 264->266 265->266 268 41da27-41f370 call 41da41 call 41f371 266->268
                APIs
                • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 0041DA1D
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID: E$P$c$e$i$o$r$s$s$t$x
                • API String ID: 544645111-3128998556
                • Opcode ID: db82872b34bc3d4f552e77ac304a2551a86206f802105a463868d0a939822a0a
                • Instruction ID: 6a63ad6f5d7440d5b6abbd82c09b1e506eb7b05f559da2c88fcd2854066f675e
                • Opcode Fuzzy Hash: db82872b34bc3d4f552e77ac304a2551a86206f802105a463868d0a939822a0a
                • Instruction Fuzzy Hash: D741ECB1D086689FFB20C624CC547EA7BF4EB41304F1481EBD88D66681D67D5EC58F51
                Function 0041FFB3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 285COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 278 41ffb3-41ffb6 279 41ffbc-41ffe5 278->279 280 41fff7 279->280 281 41ffe7-41fff1 279->281 283 420001-420091 280->283 281->280 282 41fdad-41fe05 281->282 285 41fe0c-41fed3 call 41fea9 282->285 286 420093-42009f 283->286 287 4200a4-4200b9 283->287 301 41fed5-41feeb 285->301 302 41feed-41fefd 285->302 289 420395-4203a3 ExitProcess 286->289 291 4200bb-4200c7 287->291 292 4200cc-4200eb 287->292 291->289 295 4200fe-420110 292->295 296 4200ed-4200f9 292->296 297 420112-42011e 295->297 298 420123-42018c 295->298 296->289 297->289 303 420192-4201dc 298->303 304 420389-42038f 298->304 305 41ff50-41ff57 301->305 302->285 306 41ff03-41ff16 302->306 307 4201de-4201e7 303->307 308 4201ed-4201fe 303->308 304->289 309 41ff99-41ffbb call 41ffb3 305->309 310 41ff59-41ff97 305->310 306->285 311 41ff1c-41ff2c 306->311 307->308 312 420204-420214 308->312 313 42029f-4202b1 call 4202b2 308->313 309->279 310->283 315 41ff3a 311->315 316 41ff2e-41ff38 311->316 312->313 318 42021a-42026b call 42022a 312->318 317 41ff44-41ff4a 315->317 316->317 317->305 325 420291 318->325 326 42026d-42028f 318->326 325->307 326->325 327 420298 326->327 327->313
                APIs
                • ExitProcess.KERNEL32(00000000), ref: 004203A3
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ExitProcess
                • String ID: $JMCL
                • API String ID: 621844428-1225520770
                • Opcode ID: dd48e54cf680fd271e0dab93154a7b8b0d676f741f1781182f2fb917eeab6552
                • Instruction ID: 1f1a233c4ea98c28e290184e1d0bc566697d54f42b4a2dd98467d57f08cf4de7
                • Opcode Fuzzy Hash: dd48e54cf680fd271e0dab93154a7b8b0d676f741f1781182f2fb917eeab6552
                • Instruction Fuzzy Hash: 64C15CB5E042288BEB24CF14DD90AEAB7B6FB88300F1481EAD90DA7341D7795ED18F55
                Function 0041F810 Relevance: 1.7, APIs: 1, Instructions: 218COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 372 41f810-41f821 373 41f823-41f85f 372->373 374 41f864-41f8c2 372->374 378 4203a1-4203a3 ExitProcess 373->378 376 41f8d5-41f8ea 374->376 377 41f8c4-41f8d0 374->377 380 41f8fd-41f91c 376->380 381 41f8ec-41f8f8 376->381 379 41fbc6-41fbcd 377->379 382 41fca1-41fcce call 41fcb2 call 41fccf 379->382 383 41fbd3-41fbe0 call 41fbe1 379->383 384 41f92f-41f941 380->384 385 41f91e-41f92a 380->385 381->379 382->378 383->382 386 41f943-41f94f 384->386 387 41f954-41f9bd 384->387 385->379 386->379 393 41f9c3-41fa0d 387->393 394 41fbba-41fbc0 387->394 396 41fa1e-41fa2f 393->396 394->379 398 41fad0-41fb21 call 41faef 396->398 399 41fa35-41fa45 396->399 407 41fb23-41fb2d 398->407 408 41fb2f-41fb86 call 41fb40 398->408 399->398 400 41fa4b-41fa9c 399->400 402 41fac2 400->402 403 41fa9e-41fac0 400->403 402->396 403->402 405 41fac9 403->405 405->398 409 41fb9e-41fba5 407->409 414 41fb94 408->414 415 41fb88-41fb92 408->415 411 41fbb5 409->411 412 41fba7-41fbb3 409->412 411->379 412->379 414->409 415->409
                APIs
                • ExitProcess.KERNEL32(00000000), ref: 004203A3
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ExitProcess
                • String ID:
                • API String ID: 621844428-0
                • Opcode ID: 8a0ea8293272a5dce6b18dde29f5876ea0fd1f41c4ae5e383ca135e33276650e
                • Instruction ID: 41c0bda98abb6affdce0bfdaad6be249c0a48bc92da71cafe1fd5a24dbf5fdb0
                • Opcode Fuzzy Hash: 8a0ea8293272a5dce6b18dde29f5876ea0fd1f41c4ae5e383ca135e33276650e
                • Instruction Fuzzy Hash: 1B9179B4E09228CFEB25CB14CC90BEAB776BF84305F1481EAC84D67251D6396ED6CE45
                Function 0041FCCF Relevance: 1.7, APIs: 1, Instructions: 200COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 416 41fccf-41fd34 417 41fd45-41fd90 416->417 418 41fd36-41fd40 416->418 425 41fda1-41fda7 417->425 426 41fd92-41fd9c 417->426 419 420001-420091 418->419 423 420093-42009f 419->423 424 4200a4-4200b9 419->424 427 420395-4203a3 ExitProcess 423->427 429 4200bb-4200c7 424->429 430 4200cc-4200eb 424->430 428 41fdad-41fe05 425->428 426->419 432 41fe0c-41fed3 call 41fea9 428->432 429->427 433 4200fe-420110 430->433 434 4200ed-4200f9 430->434 448 41fed5-41feeb 432->448 449 41feed-41fefd 432->449 435 420112-42011e 433->435 436 420123-42018c 433->436 434->427 435->427 440 420192-4201dc 436->440 441 420389-42038f 436->441 443 4201de-4201e7 440->443 444 4201ed-4201fe 440->444 441->427 443->444 446 420204-420214 444->446 447 42029f-4202b1 call 4202b2 444->447 446->447 450 42021a-42026b call 42022a 446->450 451 41ff50-41ff57 448->451 449->432 452 41ff03-41ff16 449->452 467 420291 450->467 468 42026d-42028f 450->468 455 41ff99-41ffe5 call 41ffb3 451->455 456 41ff59-41ff97 451->456 452->432 457 41ff1c-41ff2c 452->457 469 41fff7 455->469 470 41ffe7-41fff1 455->470 456->419 461 41ff3a 457->461 462 41ff2e-41ff38 457->462 463 41ff44-41ff4a 461->463 462->463 463->451 467->443 468->467 471 420298 468->471 469->419 470->428 470->469 471->447
                APIs
                • ExitProcess.KERNEL32(00000000), ref: 004203A3
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ExitProcess
                • String ID:
                • API String ID: 621844428-0
                • Opcode ID: b391bec8c69c6ea0c80c362058d44944aa2b1426c5d4457fbb903709eddb4fc6
                • Instruction ID: 22430cc608b4b46f28f225414a516fc4dcb0ea27b6d590589a9f11856cb9d482
                • Opcode Fuzzy Hash: b391bec8c69c6ea0c80c362058d44944aa2b1426c5d4457fbb903709eddb4fc6
                • Instruction Fuzzy Hash: 8E71AFF6D101259FE7248B10EC44BFAB7B5EB88310F1081FAD90EA6741E6785EC68E55
                Function 0041FEA9 Relevance: 1.7, APIs: 1, Instructions: 170COMMON
                Download Yara Rule
                APIs
                • ExitProcess.KERNEL32(00000000), ref: 004203A3
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ExitProcess
                • String ID:
                • API String ID: 621844428-0
                • Opcode ID: c24bf6d99de0f2a3c11adbcb63d99e7db27727c7d3cd9f5913e1953949dac405
                • Instruction ID: 468ef1287cf3862ee6a732311484bf04ea925a2ccc64149078e9a72c15c0f2ec
                • Opcode Fuzzy Hash: c24bf6d99de0f2a3c11adbcb63d99e7db27727c7d3cd9f5913e1953949dac405
                • Instruction Fuzzy Hash: F661BDF1D102298BEB248B10DC847FAB3B5FB84311F1081EAE90DA6281E7785EC6CF55
                Function 00407150 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 566 407150-40743a 568 40743c-407448 566->568 569 40744d-407462 566->569 570 40773e-4077e0 call 40775d VirtualProtect call 4077d7 568->570 571 407464-407470 569->571 572 407475-407494 569->572 609 4077e6 570->609 571->570 574 407496-4074a2 572->574 575 4074a7-4074b9 572->575 574->570 577 4074bb-4074c7 575->577 578 4074cc-407535 575->578 577->570 582 407732-407738 578->582 583 40753b-407585 578->583 582->570 585 407596-4075a7 583->585 587 407648-407673 585->587 588 4075ad-4075bd 585->588 590 407678-407699 587->590 588->587 589 4075c3-407614 588->589 592 407616-407638 589->592 593 40763a 589->593 594 4076a7-4076bf call 4076bb 590->594 595 40769b-4076a5 590->595 592->593 597 407641 592->597 593->585 594->590 606 4076c1-4076fe 594->606 599 407716-40771d 595->599 597->587 604 40772d 599->604 605 40771f-40772b 599->605 604->570 605->570 607 407700-40770a 606->607 608 40770c 606->608 607->599 608->599 609->609
                APIs
                • VirtualProtect.KERNELBASE(?,?,00000040,FFFFEBA4,?,?,?,?,?,?,?,?,00406A5A,?), ref: 0040779F
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID:
                • API String ID: 544645111-0
                • Opcode ID: e85c90ef5863dd61c7a654771148e6924bd2c10f9f9041b8bfcfa50669615557
                • Instruction ID: 998609d879f4d36cde1debd14f82a78290edc987e1c20507e84fc6d065adc7b9
                • Opcode Fuzzy Hash: e85c90ef5863dd61c7a654771148e6924bd2c10f9f9041b8bfcfa50669615557
                • Instruction Fuzzy Hash: 9A31F6B2D082545BF7188B11DC59AEB7B78EB81310F1441FFD90E67280D63D6AC6CE52
                Function 004076BB Relevance: 1.6, APIs: 1, Instructions: 77memoryCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 610 4076bb-4076fe 611 407700-40770a 610->611 612 40770c 610->612 613 407716-40771d 611->613 612->613 614 40772d 613->614 615 40771f-40772b 613->615 616 40773e-4077e0 call 40775d VirtualProtect call 4077d7 614->616 615->616 627 4077e6 616->627 627->627
                APIs
                • VirtualProtect.KERNELBASE(?,?,00000040,FFFFEBA4,?,?,?,?,?,?,?,?,00406A5A,?), ref: 0040779F
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID:
                • API String ID: 544645111-0
                • Opcode ID: 9c2b22a18ebb58a2560ddd336db8cb0d0dfd2afaa7fc5d569bcc842e142561c6
                • Instruction ID: 932dec28702412b53e9c094fda6d120bcd460c0735ecd7e166b51138a84fedff
                • Opcode Fuzzy Hash: 9c2b22a18ebb58a2560ddd336db8cb0d0dfd2afaa7fc5d569bcc842e142561c6
                • Instruction Fuzzy Hash: 0121F0B1E086949BE7248B24ED90AEAB774FF85340F1442FBD509672C1D6392A82CF47
                Function 00407002 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 628 407002-4077e0 call 40702c call 40775d VirtualProtect call 4077d7 642 4077e6 628->642 642->642
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID:
                • API String ID: 544645111-0
                • Opcode ID: 91cad57a516e2f4c361eacc58a156d573613a8a0f31843566538594da25e37eb
                • Instruction ID: b91199c152535c76d48c2b5e435d673f220464ab319cc39e82abbb88fa2171cb
                • Opcode Fuzzy Hash: 91cad57a516e2f4c361eacc58a156d573613a8a0f31843566538594da25e37eb
                • Instruction Fuzzy Hash: 5921ACB2D1C5609BE3144B65DC48AEB7B78EF41340F0002FBD9095B083C2396A86CF93
                Function 0041FBE1 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 643 41fbe1-41fc5e 648 41fca1-41fcce call 41fcb2 call 41fccf 643->648 649 41fc60-41fc9c 643->649 653 4203a1-4203a3 ExitProcess 648->653 649->648 649->653
                APIs
                • ExitProcess.KERNEL32(00000000), ref: 004203A3
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ExitProcess
                • String ID:
                • API String ID: 621844428-0
                • Opcode ID: ab4ead3101172d02aac48522461da7bc08d1452eec5aebfae6fa96207dd12a1a
                • Instruction ID: 5bc159319ebb743867fb39de3f8c748a28a03fbd673abd2d44e4042212212909
                • Opcode Fuzzy Hash: ab4ead3101172d02aac48522461da7bc08d1452eec5aebfae6fa96207dd12a1a
                • Instruction Fuzzy Hash: CC115CF3E041485BF3105624DD45AFF7738DBC1314F1881BBE84986540E5BC9ACB8A97
                Function 0040702C Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID:
                • API String ID: 544645111-0
                • Opcode ID: f6bc614bc64cf056d1a09f5f2bfde908a2a7db6986d7a22e2c0509103412b2f7
                • Instruction ID: 3c0158fd909a129efc1a5eb41b99e6176bf6047d08ad53226ee2bae0628576df
                • Opcode Fuzzy Hash: f6bc614bc64cf056d1a09f5f2bfde908a2a7db6986d7a22e2c0509103412b2f7
                • Instruction Fuzzy Hash: B51176B3E081A05BE3104765EC48EE7BB38EB81310F0442FBD90D67181D6396EC68B93
                Function 00406C07 Relevance: 1.6, APIs: 1, Instructions: 57COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID:
                • API String ID: 544645111-0
                • Opcode ID: 5731e0e6edc125a2e43a085edf6b776cfc2c4dacd2189dfd6081b11495611bc1
                • Instruction ID: 9a8444cee67629d71a130239ee861f54f37e657be2337cb6b038551eb8c7450a
                • Opcode Fuzzy Hash: 5731e0e6edc125a2e43a085edf6b776cfc2c4dacd2189dfd6081b11495611bc1
                • Instruction Fuzzy Hash: 68114CB2E086405BF3148B21ED55EE77778FB81350F1482FFD50957181D6396A86CB53
                Function 004202B2 Relevance: 1.6, APIs: 1, Instructions: 53COMMON
                Download Yara Rule
                APIs
                • ExitProcess.KERNEL32(00000000), ref: 004203A3
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ExitProcess
                • String ID:
                • API String ID: 621844428-0
                • Opcode ID: 72de2b23a5a7004e1340f99e268a21924275a9173d8350a07b602b65527988a2
                • Instruction ID: e29210356c8ac607a074c4d3a0003b51328783218ad205ebd55b70756ab56305
                • Opcode Fuzzy Hash: 72de2b23a5a7004e1340f99e268a21924275a9173d8350a07b602b65527988a2
                • Instruction Fuzzy Hash: 5611B4B1E041658BDB24CA14EC947EE7AF5BB80300F6402EAC85E56286C7BC1FC18F46
                Function 0040776A Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON
                Download Yara Rule
                APIs
                • VirtualProtect.KERNELBASE(?,?,00000040,FFFFEBA4,?,?,?,?,?,?,?,?,00406A5A,?), ref: 0040779F
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ProtectVirtual
                • String ID:
                • API String ID: 544645111-0
                • Opcode ID: d53b0c6e95c7fd54e9a925cc6874bffe05f596334bc776d4928f5b1e923c50d3
                • Instruction ID: 8855314161c604dab32c9539a428904a4b839c8b04b57f9093ab9272a71fba34
                • Opcode Fuzzy Hash: d53b0c6e95c7fd54e9a925cc6874bffe05f596334bc776d4928f5b1e923c50d3
                • Instruction Fuzzy Hash: 8C0149B1E041806BE3248B61DD54EEBBB7CEF80340F0441FFE20957081C635AA86CF52

                Non-executed Functions

                Function 00592412 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON
                Download Yara Rule
                APIs
                • IsProcessorFeaturePresent.KERNEL32(0000000C,0059232E,00000000,00000000,005924C6,00000000,?,?,00000000), ref: 00592414
                • GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,?,00000000), ref: 0059243B
                • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00592442
                • InitializeSListHead.KERNEL32(00000000,?,?,00000000), ref: 0059244F
                • GetProcessHeap.KERNEL32(00000000,00000000,?,?,00000000), ref: 00592464
                • HeapFree.KERNEL32(00000000,?,?,00000000), ref: 0059246B
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
                • String ID:
                • API String ID: 1475849761-0
                • Opcode ID: 3894063a3a1850843fd365663f4c6672044bb0c88c45ff6ffa0b2371db1e62f6
                • Instruction ID: 61f176fd1efc5cde42d9c2f14e34ec8f0a40e9ad8dd8b2ca48b28944697b3bbe
                • Opcode Fuzzy Hash: 3894063a3a1850843fd365663f4c6672044bb0c88c45ff6ffa0b2371db1e62f6
                • Instruction Fuzzy Hash: 11F0AF35640301AFEF619F79EC08B067AA8FFA8712F044428F999D3251DB309844DF50
                Function 0059247E Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON
                Download Yara Rule
                APIs
                • GetProcessHeap.KERNEL32(00000008,00000008,00000000,00424286,7622DFA0,00000000,?,?,00000000), ref: 00592483
                • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 0059248A
                • GetProcessHeap.KERNEL32(00000000,00000000,?,?,00000000), ref: 005924D0
                • HeapFree.KERNEL32(00000000,?,?,00000000), ref: 005924D7
                  • Part of subcall function 0059231C: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,00000000,005924C6,00000000,?,?,00000000), ref: 00592340
                  • Part of subcall function 0059231C: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00592347
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: Heap$Process$Alloc$Free
                • String ID:
                • API String ID: 1864747095-0
                • Opcode ID: bdd2e89f7cce13ad9cf521c904f958435d6724c992339c1e6157058012224566
                • Instruction ID: beaeba306d3fe39cc743fb89b0af5f6c944f9616c6a0800de3271866b45945a1
                • Opcode Fuzzy Hash: bdd2e89f7cce13ad9cf521c904f958435d6724c992339c1e6157058012224566
                • Instruction Fuzzy Hash: DFF0B4766447226BDF752BBC7C0C95B3E55BFE0B61B114928F41EDB185DE20D8409B60
                Function 0052D910 Relevance: 1.7, APIs: 1, Instructions: 207COMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00592B09: EnterCriticalSection.KERNEL32(0060F61C,?,?,?,00525158,00616078,?,00000000,005A9CE1,000000FF,?,0042319D), ref: 00592B14
                  • Part of subcall function 00592B09: LeaveCriticalSection.KERNEL32(0060F61C,?,00525158,00616078,?,00000000,005A9CE1,000000FF,?,0042319D), ref: 00592B51
                • __Init_thread_footer.LIBCMT ref: 0052DB0B
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: CriticalSection$EnterInit_thread_footerLeave
                • String ID:
                • API String ID: 3960375172-0
                • Opcode ID: ab4d270cbbb53534f8c92a4f8be60fff7eba6527090ddf4d4e5d3127723f146c
                • Instruction ID: 5d6fafc3de38fa83bbede26ecfe44ae733c6c434a7af38891c4b54fb711eb241
                • Opcode Fuzzy Hash: ab4d270cbbb53534f8c92a4f8be60fff7eba6527090ddf4d4e5d3127723f146c
                • Instruction Fuzzy Hash: 857109715009714BD70CCE28E8726F57BA2BB86301F4E827FEB5386AD1C679E652CB50
                Function 00592716 Relevance: 1.7, APIs: 1, Instructions: 182COMMON
                Download Yara Rule
                APIs
                • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0059301F
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: FeaturePresentProcessor
                • String ID:
                • API String ID: 2325560087-0
                • Opcode ID: dedb4b6ba5bd9499249da44ea6a8597d948c84de17c93b5f33b2e2852dcf6df9
                • Instruction ID: 7bb6667c9af65f534ab51a75e90a60d57ffd640f6537029fd7c0a6b1cddf6e49
                • Opcode Fuzzy Hash: dedb4b6ba5bd9499249da44ea6a8597d948c84de17c93b5f33b2e2852dcf6df9
                • Instruction Fuzzy Hash: A561D471A40609DFDF24CF54D9857AEBFF5FB04310F14852AE816EB2A0D775AA40CB90
                Function 00401ECD Relevance: .2, Instructions: 176COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 66b1f2d940cc2a15b99bd33e8a4f4fa5933c9faf2ed567310e30107212ecc8de
                • Instruction ID: 2d25ff128d068f76006ad27daf84b356ad2c56a7a6956572dcec0643ae5f8720
                • Opcode Fuzzy Hash: 66b1f2d940cc2a15b99bd33e8a4f4fa5933c9faf2ed567310e30107212ecc8de
                • Instruction Fuzzy Hash: C26106B2C041159FFB1CCA24DE56AEEB779EB90300F1482FED90DA6284D6B85FC18E45
                Function 00427A40 Relevance: .0, Instructions: 23COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: ed25064e58b13f409ae6224364f1636c299320528e1d594b0044869da24cb299
                • Instruction ID: b7e3b764450d4a7df2afc685ccfb6effe7e2e3bb59e6dbdaf1d74b26299d9b3e
                • Opcode Fuzzy Hash: ed25064e58b13f409ae6224364f1636c299320528e1d594b0044869da24cb299
                • Instruction Fuzzy Hash: 2FE0D8B18002145B9200EB24AC094A77FD8EA45224F048679EC4CC3151F732E919C7C7
                Function 00421F40 Relevance: 44.1, APIs: 24, Strings: 1, Instructions: 386COMMON
                Download Yara Rule
                APIs
                • GetClientRect.USER32(?,?), ref: 00421F80
                • GetDlgItem.USER32(?,00000001), ref: 00421FC2
                • GetWindowRect.USER32(00000000,?), ref: 00421FD9
                • GetWindowLongW.USER32(?,000000F0), ref: 004220B5
                • CreateWindowExW.USER32(00000000,ScrollBar,005B5D98,54000014,00000000,00000000,80000000,80000000,?,00000000,00000000,00000000), ref: 004220EB
                • GetClientRect.USER32(?,?), ref: 00422100
                • GetWindowRect.USER32(00000000,?), ref: 00422112
                • SetWindowPos.USER32(00000000,00000000,?,?,00000000,00000000,00000005,?,?), ref: 00422141
                • BeginDeferWindowPos.USER32(00000000), ref: 004221A6
                • GetDlgItem.USER32(00000000,?), ref: 0042229A
                • DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000314), ref: 004222BE
                • GetClientRect.USER32(00000000,?), ref: 004222E2
                • GetWindowRect.USER32(00000000,?), ref: 004222F4
                • IsZoomed.USER32(00000000), ref: 00422301
                • DeferWindowPos.USER32(?,00000000,00000000,?,?,00000000,00000000,-00000355), ref: 0042233C
                • EndDeferWindowPos.USER32(00000000), ref: 00422343
                • EndDeferWindowPos.USER32(?), ref: 0042235A
                • GetWindowLongW.USER32(?,000000F0), ref: 004223AC
                • GetWindowLongW.USER32(?,000000EC), ref: 004223B7
                • MapDialogRect.USER32(?,?), ref: 004223EE
                • AdjustWindowRectEx.USER32(?,?,00000000,?), ref: 00422403
                • MapDialogRect.USER32(?,00000000), ref: 0042244D
                • AdjustWindowRectEx.USER32(?,?,00000000,?), ref: 00422462
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: Window$Rect$Defer$ClientLong$AdjustDialogItem$BeginCreateZoomed
                • String ID: ScrollBar
                • API String ID: 376062766-3978720103
                • Opcode ID: 5876d8cce9d716d45ecffc8679df0715509107c4c30f3f23e34ab5b04b4a616f
                • Instruction ID: e3a6938857b87d74d63ece223c9eab936984e1976c03630cfa8fdf1f6ee4a28b
                • Opcode Fuzzy Hash: 5876d8cce9d716d45ecffc8679df0715509107c4c30f3f23e34ab5b04b4a616f
                • Instruction Fuzzy Hash: C1F14771608701AFD720CF68D944B6ABBF4BF99304F048A1EF585A3660E775E894CF86
                Function 00422860 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 168windowCOMMON
                Download Yara Rule
                APIs
                • GetWindowLongW.USER32(00000001,000000EC), ref: 00422874
                • SetWindowLongW.USER32(00000001,000000EC,00000000), ref: 0042288F
                • SetWindowPos.USER32(00000001,00000000,00000000,00000000,00000000,00000000,00000037,?,?,00600594,00000000,004227E1,?,?,00600594), ref: 004228A0
                  • Part of subcall function 0054D118: __EH_prolog.LIBCMT ref: 0054D11D
                • GetDlgItem.USER32(00000001,00000435), ref: 004228AE
                • SetWindowLongW.USER32(?,000000FC,00000000), ref: 004228EC
                • GetWindowLongW.USER32(?,000000F0), ref: 004228FF
                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00422916
                • GetDlgItem.USER32(00000001,000003EC), ref: 00422939
                • SetWindowLongW.USER32(?,000000FC,00000000), ref: 00422977
                • GetWindowLongW.USER32(?,000000F0), ref: 0042298A
                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 004229A1
                • GetDlgItem.USER32(00000001,0000048D), ref: 00422A3E
                • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00422A58
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: Window$Long$Item$H_prologMessageSend
                • String ID: =
                • API String ID: 449355210-3048733930
                • Opcode ID: 00dbc9e9d13d928ce84c9130bf69b19c24ec69a3da25fb5464962becd9e0d513
                • Instruction ID: d14620618d2bcbfad0fa2956e50aecafd30e84ceab51e050cdf336f42f0c320b
                • Opcode Fuzzy Hash: 00dbc9e9d13d928ce84c9130bf69b19c24ec69a3da25fb5464962becd9e0d513
                • Instruction Fuzzy Hash: CD517DB0700612BFDB24AF34DD46B6ABEA4FF04310F10472AF469962E1DBB1E854DB94
                Function 00592210 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58libraryCOMMON
                Download Yara Rule
                APIs
                • DecodePointer.KERNEL32(?,00000000,?,005925AF,0060F5A4,00000000,00000000,?,00424299,?,004242D0,00000000,7622DFA0,00000000), ref: 00592222
                • LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,00000000,?,005925AF,0060F5A4,00000000,00000000,?,00424299,?,004242D0,00000000,7622DFA0), ref: 00592237
                • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005922B3
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: DecodePointer$LibraryLoad
                • String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
                • API String ID: 1423960858-1745123996
                • Opcode ID: 52dbb56f5492687e1749eba3708075505bc99e9558a7a815b2fdf984e7c565f9
                • Instruction ID: ed2355cb290234cf0a7731ac0611f87c8fae2e72131cdd1956bd2e7d00dabef1
                • Opcode Fuzzy Hash: 52dbb56f5492687e1749eba3708075505bc99e9558a7a815b2fdf984e7c565f9
                • Instruction Fuzzy Hash: 5A0196395817017BCF26AF14AC0BFCA3F99BF22788F040470FC05A63D2E791AA19C5A5
                Function 00591B20 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95threadCOMMON
                Download Yara Rule
                APIs
                • GetCurrentThread.KERNEL32 ref: 00591B92
                • GetThreadPriority.KERNEL32(00000000), ref: 00591B99
                • SetThreadPriority.KERNEL32(00000000,00000000), ref: 00591BC7
                • ResumeThread.KERNEL32(00000000), ref: 00591BCE
                • GetCurrentThread.KERNEL32 ref: 00591C10
                • GetThreadPriority.KERNEL32(00000000), ref: 00591C17
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: Thread$Priority$Current$Resume
                • String ID: ^QB
                • API String ID: 3552734753-2719061505
                • Opcode ID: 7f6c59f3951e32e3a4f9b91f87bc28aad2ca832e50b815342c61c3ec3102c33c
                • Instruction ID: 03d6b9e87ad54b36b64c078c781d29aeb48e9228a4f65d4f39ea40a867c40331
                • Opcode Fuzzy Hash: 7f6c59f3951e32e3a4f9b91f87bc28aad2ca832e50b815342c61c3ec3102c33c
                • Instruction Fuzzy Hash: EC31EE74A0121AEFCF14DFA4C848BAEBBB9FF44714F004259F812E3281DB74A944DBA4
                Function 0059231C Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON
                Download Yara Rule
                APIs
                • GetProcessHeap.KERNEL32(00000008,0000000D,00000000,00000000,005924C6,00000000,?,?,00000000), ref: 00592340
                • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00592347
                  • Part of subcall function 00592412: IsProcessorFeaturePresent.KERNEL32(0000000C,0059232E,00000000,00000000,005924C6,00000000,?,?,00000000), ref: 00592414
                • InterlockedPopEntrySList.KERNEL32(00000000,00000000,00000000,005924C6,00000000,?,?,00000000), ref: 00592357
                • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,00000000), ref: 0059237E
                • RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,?,00000000), ref: 00592392
                • InterlockedPopEntrySList.KERNEL32(00000000,?,?,00000000), ref: 005923A5
                • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000), ref: 005923B8
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
                • String ID:
                • API String ID: 2460949444-0
                • Opcode ID: a29c2ff020e0f5911fabb4ad7351b030c3f3b5123e20d623d3e08dec66a40b24
                • Instruction ID: 0df842aa626a0d04b8c36fb811008f0322823937be6daee0a24043841320a3f0
                • Opcode Fuzzy Hash: a29c2ff020e0f5911fabb4ad7351b030c3f3b5123e20d623d3e08dec66a40b24
                • Instruction Fuzzy Hash: E311C875640222BBEF311B68AC48F2B7E5DFB54741F150A30F905E6151DA64DC446FA4
                Function 00424030 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 170COMMON
                Download Yara Rule
                APIs
                • GetClassInfoExW.USER32(00000000,?,?), ref: 004240DE
                • GetClassInfoExW.USER32(?,00000030), ref: 004240F5
                • SetLastError.KERNEL32(00000000), ref: 00424146
                • GetClassInfoExW.USER32(00000008,00000030), ref: 00424157
                • GetLastError.KERNEL32 ref: 00424165
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ClassInfo$ErrorLast
                • String ID: ATL:
                • API String ID: 859646241-4086939539
                • Opcode ID: 7ff8f0649ccba273d9a7199bff72008dec24084cb5dc7ad8e958f1b60299d01c
                • Instruction ID: 3fbaa0924727ec093c9642173100ef8c0ed775f7d3121582ae9b3222a726813d
                • Opcode Fuzzy Hash: 7ff8f0649ccba273d9a7199bff72008dec24084cb5dc7ad8e958f1b60299d01c
                • Instruction Fuzzy Hash: B851E071A002259FCB20DFA4ED49A7FB7B9FB90704F40062AE900A7251D738A965DF99
                Function 00421AF0 Relevance: 9.1, APIs: 6, Instructions: 143threadCOMMON
                Download Yara Rule
                APIs
                • SetLastError.KERNEL32(00000000,?,?,?,?,?,00421948), ref: 00421B0C
                  • Part of subcall function 00424030: GetClassInfoExW.USER32(00000000,?,?), ref: 004240DE
                  • Part of subcall function 00424030: GetClassInfoExW.USER32(?,00000030), ref: 004240F5
                  • Part of subcall function 00424030: SetLastError.KERNEL32(00000000), ref: 00424146
                  • Part of subcall function 00424030: GetClassInfoExW.USER32(00000008,00000030), ref: 00424157
                  • Part of subcall function 00424030: GetLastError.KERNEL32 ref: 00424165
                • GetCurrentThreadId.KERNEL32 ref: 00421B56
                • EnterCriticalSection.KERNEL32(0060A298,?,?,?,?,?,00421948), ref: 00421B64
                • LeaveCriticalSection.KERNEL32(0060A298,?,?,?,?,?,00421948), ref: 00421B7D
                • CreateWindowExW.USER32(00000000,?,00000000,?,80000000,80000000,00000000,00000000,00000000,?,00000000), ref: 00421BD2
                • SetLastError.KERNEL32(0000000E,C0000005,00000001,?,00000000,00000000,?,?,?,?,?,00421948), ref: 00421BF0
                  • Part of subcall function 0059247E: GetProcessHeap.KERNEL32(00000008,00000008,00000000,00424286,7622DFA0,00000000,?,?,00000000), ref: 00592483
                  • Part of subcall function 0059247E: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 0059248A
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: ErrorLast$ClassInfo$CriticalHeapSection$AllocCreateCurrentEnterLeaveProcessThreadWindow
                • String ID:
                • API String ID: 1532336298-0
                • Opcode ID: 85b29703ff24dd9c7e6f1ee9b48d73370df39c5e7b0ae424bdae414b49aacd2b
                • Instruction ID: ef3214eb57b59108e217f77367fe40e9033944a6d5afb27af945ac68c309a1c2
                • Opcode Fuzzy Hash: 85b29703ff24dd9c7e6f1ee9b48d73370df39c5e7b0ae424bdae414b49aacd2b
                • Instruction Fuzzy Hash: DA417C71344311AFD714DF68DC85B2BBBE9EB98710F00452EF646DB290DBB4E8048BA1
                Function 00591960 Relevance: 9.0, APIs: 6, Instructions: 41threadsynchronizationCOMMON
                Download Yara Rule
                APIs
                • GetCurrentThread.KERNEL32 ref: 0059196A
                • GetThreadPriority.KERNEL32(00000000), ref: 00591971
                • GetThreadPriority.KERNEL32(00580217), ref: 0059197C
                • SetThreadPriority.KERNEL32(00580217,00000000), ref: 0059198A
                • WaitForSingleObject.KERNEL32(00580217,000000FF), ref: 00591995
                • CloseHandle.KERNEL32(00580217), ref: 005919A3
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: Thread$Priority$CloseCurrentHandleObjectSingleWait
                • String ID:
                • API String ID: 1718353164-0
                • Opcode ID: 73b32dfd8273e6295660c316631d924a610b0adb3fc8822fcb23d5032fc084f5
                • Instruction ID: 6f4a0c1e44ae4caed6706faa0e674f7cc049ea5f26ed3caede93d4ef78788e63
                • Opcode Fuzzy Hash: 73b32dfd8273e6295660c316631d924a610b0adb3fc8822fcb23d5032fc084f5
                • Instruction Fuzzy Hash: 60F03AB5100A13ABCF605BB8EE5D819FB69BF643617108725F036826F2DB31A865EF04
                Function 00422A70 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON
                Download Yara Rule
                APIs
                • GetDlgItem.USER32(00000001,00000435), ref: 00422B2B
                • GetDlgItem.USER32(00000001,0000048D), ref: 00422BCF
                • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00422BDF
                • DestroyWindow.USER32(00000001), ref: 00422BFE
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: Item$DestroyMessageSendWindow
                • String ID:
                • API String ID: 3090131160-0
                • Opcode ID: ca2848b37b557aabb613ca1c7846c7075ea2733f794bd155616e8047f823f290
                • Instruction ID: 56018adc457ee554f330d9e31960027dff2f61ac07181aeb852c591fced9a5cf
                • Opcode Fuzzy Hash: ca2848b37b557aabb613ca1c7846c7075ea2733f794bd155616e8047f823f290
                • Instruction Fuzzy Hash: 635154B0A00248ABDB20DFA9D949B9EBFF4BF58314F144519E411BB291CBB86904CFA0
                Function 00421A40 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                Download Yara Rule
                APIs
                • SendMessageW.USER32(?,00000418,00000000,?), ref: 00421A73
                • SendMessageW.USER32(?), ref: 00421AA9
                • SendMessageW.USER32(?,00000412,00000000), ref: 00421AD4
                • SendMessageW.USER32(?,00000411,00000001,?), ref: 00421AE1
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: MessageSend
                • String ID:
                • API String ID: 3850602802-0
                • Opcode ID: e154f3616b20d02131f8ac69e930b8d754935b032ca4746cd1b7db9f1f45573e
                • Instruction ID: 056b8dc03bbacfd0d86dd61f933739a328027decfb519111fb1f3285849d17ed
                • Opcode Fuzzy Hash: e154f3616b20d02131f8ac69e930b8d754935b032ca4746cd1b7db9f1f45573e
                • Instruction Fuzzy Hash: 98116A71240304ABE7209F2ACD85F1BBBE8FB84B45F40892DF685965A1C7B1F908CB64
                Function 00421920 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON
                Download Yara Rule
                APIs
                • SendMessageW.USER32(?,0000040D,00000000,00000000), ref: 00421959
                • SendMessageW.USER32(?,00000411,00000000,?), ref: 00421971
                • SendMessageW.USER32(?,00000433,00000000,?), ref: 00421982
                • GetWindowRect.USER32(?,?), ref: 0042199F
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: MessageSend$RectWindow
                • String ID:
                • API String ID: 1944065686-0
                • Opcode ID: 7b2f938d5d4943be965eb0663962e518f7f26e6a711bc9cb0b5819c0799ef7b5
                • Instruction ID: 594fdfbadbf35a74eff55c0d0a36d92e90d8671c7fb2c7794805fcb4d06949e0
                • Opcode Fuzzy Hash: 7b2f938d5d4943be965eb0663962e518f7f26e6a711bc9cb0b5819c0799ef7b5
                • Instruction Fuzzy Hash: 8F112771B016247BDB219F29EC06F9BBB68EF21760F444316FD04662A1D770BA94CBD8
                Function 00401922 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                Download Yara Rule
                APIs
                • SendMessageW.USER32(?,0000040D,00000000,00000000), ref: 00421959
                • SendMessageW.USER32(?,00000411,00000000,?), ref: 00421971
                • SendMessageW.USER32(?,00000433,00000000,?), ref: 00421982
                • GetWindowRect.USER32(?,?), ref: 0042199F
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: MessageSend$RectWindow
                • String ID:
                • API String ID: 1944065686-0
                • Opcode ID: 59de93ffc885d8b3cfd5118fbbd8d5450dd13599d371894dab07d54a46468e35
                • Instruction ID: 976cf0dfd2e6fdd224c174f1518e0448649e182263952f6c5103e505f245c106
                • Opcode Fuzzy Hash: 59de93ffc885d8b3cfd5118fbbd8d5450dd13599d371894dab07d54a46468e35
                • Instruction Fuzzy Hash: D2112770B01224BBDB218F29EC01B9AB764FF21710F444206FD0466161D770E994CBC8
                Function 004E5510 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101threadCOMMON
                Download Yara Rule
                APIs
                • GetCurrentThreadId.KERNEL32 ref: 004E553C
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2405885846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.2405871819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406019635.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406058766.0000000000606000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406076138.0000000000607000.00000008.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406093349.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406109708.000000000062E000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406165226.0000000000641000.00000040.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.0000000000699000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2406204157.00000000006A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_build.jbxd
                Yara matches
                Similarity
                • API ID: CurrentThread
                • String ID: %path_sort%$Dc[
                • API String ID: 2882836952-418770324
                • Opcode ID: 4da7f740f64944a77406cc8cf8fc37ffc635ebb709fc4d4f05e17eb5a452c0a7
                • Instruction ID: 80f9f5d8d4006964c7a56ff0b8deedac7b6fac6e158ca5e25abf240470f13d79
                • Opcode Fuzzy Hash: 4da7f740f64944a77406cc8cf8fc37ffc635ebb709fc4d4f05e17eb5a452c0a7
                • Instruction Fuzzy Hash: 0A41F334A016859FCB10DFA6D814BAEBBF2FF5530AF58419AD801A73A1DB35AC04CF54

                Execution Graph

                Execution Coverage:9.8%
                Dynamic/Decrypted Code Coverage:98.8%
                Signature Coverage:0%
                Total number of Nodes:255
                Total number of Limit Nodes:22
                execution_graph 32483 b01d4c0 32484 b01d502 32483->32484 32485 b01d508 GetModuleHandleW 32483->32485 32484->32485 32486 b01d535 32485->32486 32688 b011190 32689 b01119e 32688->32689 32694 b0111d3 32689->32694 32695 b012e00 32689->32695 32700 b012e10 32689->32700 32690 b010f9c 5 API calls 32691 b0111ec 32690->32691 32694->32690 32696 b012e10 32695->32696 32705 b013a50 32696->32705 32710 b013a60 32696->32710 32697 b012eac 32697->32694 32701 b012e21 32700->32701 32703 b013a50 SetWindowsHookExW 32701->32703 32704 b013a60 SetWindowsHookExW 32701->32704 32702 b012eac 32702->32694 32703->32702 32704->32702 32706 b013a60 32705->32706 32715 b013b00 32706->32715 32718 b013afe 32706->32718 32707 b013a98 32707->32697 32711 b013a71 32710->32711 32713 b013b00 SetWindowsHookExW 32711->32713 32714 b013afe SetWindowsHookExW 32711->32714 32712 b013a98 32712->32697 32713->32712 32714->32712 32721 b013b88 32715->32721 32719 b013b0c 32718->32719 32720 b013b88 SetWindowsHookExW 32718->32720 32719->32707 32720->32719 32722 b013ba6 32721->32722 32725 b013c40 32722->32725 32729 b014068 32725->32729 32733 b014078 32725->32733 32726 b013b0c 32726->32707 32730 b01408c 32729->32730 32737 b013c84 32730->32737 32734 b01408c 32733->32734 32735 b013c84 SetWindowsHookExW 32734->32735 32736 b0140d5 32735->32736 32736->32726 32738 b014158 SetWindowsHookExW 32737->32738 32740 b0140d5 32738->32740 32740->32726 32741 b0159e0 DuplicateHandle 32742 b015a76 32741->32742 32743 4fbd208 32744 4fbd220 32743->32744 32745 4fbd27a 32744->32745 32748 b0d0cd9 32744->32748 32753 b0d0ce8 32744->32753 32749 b0d0d15 32748->32749 32750 b0d0d47 32749->32750 32758 b0d0e70 32749->32758 32763 b0d0e60 32749->32763 32754 b0d0d15 32753->32754 32755 b0d0d47 32754->32755 32756 b0d0e60 2 API calls 32754->32756 32757 b0d0e70 2 API calls 32754->32757 32756->32755 32757->32755 32760 b0d0e84 32758->32760 32759 b0d0f10 32759->32750 32768 b0d0f18 32760->32768 32772 b0d0f28 32760->32772 32765 b0d0e84 32763->32765 32764 b0d0f10 32764->32750 32766 b0d0f18 2 API calls 32765->32766 32767 b0d0f28 2 API calls 32765->32767 32766->32764 32767->32764 32769 b0d0f28 32768->32769 32770 b0d0f39 32769->32770 32775 b0d2432 32769->32775 32770->32759 32773 b0d0f39 32772->32773 32774 b0d2432 2 API calls 32772->32774 32773->32759 32774->32773 32776 b0d243a 32775->32776 32778 b0d24b2 32775->32778 32781 b0d2450 32776->32781 32785 b0d2460 32776->32785 32777 b0d244a 32777->32770 32778->32770 32782 b0d245b 32781->32782 32783 b0d24fa CallWindowProcW 32782->32783 32784 b0d24a9 32782->32784 32783->32784 32784->32777 32786 b0d24a2 32785->32786 32788 b0d24a9 32785->32788 32787 b0d24fa CallWindowProcW 32786->32787 32786->32788 32787->32788 32788->32777 32487 6c00848 32488 6c00852 32487->32488 32501 6c021a0 32487->32501 32489 6c008b9 32488->32489 32506 6c0b18c 32488->32506 32511 6c0b11d 32488->32511 32516 6c0af63 32488->32516 32490 6c0089e 32490->32489 32525 b015320 32490->32525 32529 b0da2f8 32490->32529 32536 b0154ee 32490->32536 32540 b015310 32490->32540 32544 b0156e8 32490->32544 32548 b0da308 32490->32548 32502 6c021c5 32501->32502 32554 6c022b0 32502->32554 32558 6c022a1 32502->32558 32507 6c0b191 32506->32507 32566 b010438 32507->32566 32571 b010448 32507->32571 32508 6c0b21e 32508->32490 32513 6c0b122 32511->32513 32512 6c0b21e 32512->32490 32514 b010438 4 API calls 32513->32514 32515 b010448 4 API calls 32513->32515 32514->32512 32515->32512 32524 6c0af87 32516->32524 32517 6c0b003 32517->32490 32518 6c0b236 32518->32490 32519 6c0b21e 32519->32490 32520 6c0b0ab 32520->32518 32522 b010438 4 API calls 32520->32522 32523 b010448 4 API calls 32520->32523 32522->32519 32523->32519 32524->32517 32590 6c0fc30 32524->32590 32526 b015348 32525->32526 32527 b0155d4 32526->32527 32598 b013d3c 32526->32598 32527->32489 32530 b0da2af 32529->32530 32532 b0da307 32529->32532 32530->32489 32531 b0da3cf 32531->32489 32532->32531 32608 b015f74 32532->32608 32613 b010f9c 32532->32613 32617 b010ef8 32532->32617 32539 b0153a6 32536->32539 32537 b0155d4 32537->32489 32538 b013d3c 4 API calls 32538->32537 32539->32537 32539->32538 32541 b015348 32540->32541 32542 b0155d4 32541->32542 32543 b013d3c 4 API calls 32541->32543 32542->32489 32543->32542 32545 b0156f8 32544->32545 32546 b015715 32545->32546 32547 b013d3c 4 API calls 32545->32547 32546->32489 32547->32546 32549 b0da31d 32548->32549 32550 b0da3cf 32548->32550 32549->32550 32551 b015f74 5 API calls 32549->32551 32552 b010ef8 5 API calls 32549->32552 32553 b010f9c 5 API calls 32549->32553 32550->32489 32551->32549 32552->32549 32553->32549 32555 6c022d7 32554->32555 32557 6c023b4 32555->32557 32562 6c01978 32555->32562 32559 6c022d7 32558->32559 32560 6c01978 CreateActCtxA 32559->32560 32561 6c023b4 32559->32561 32560->32561 32563 6c03340 CreateActCtxA 32562->32563 32565 6c03403 32563->32565 32567 b010448 32566->32567 32576 b013762 32567->32576 32583 b013768 32567->32583 32568 b01048d 32568->32508 32572 b01045a 32571->32572 32574 b013762 4 API calls 32572->32574 32575 b013768 4 API calls 32572->32575 32573 b01048d 32573->32508 32574->32573 32575->32573 32577 b013783 32576->32577 32579 b0138bf 32577->32579 32580 b015310 4 API calls 32577->32580 32581 b015320 4 API calls 32577->32581 32582 b0154ee 4 API calls 32577->32582 32578 b0137ec 32578->32568 32579->32568 32580->32578 32581->32578 32582->32578 32584 b013783 32583->32584 32586 b0138bf 32584->32586 32587 b015310 4 API calls 32584->32587 32588 b015320 4 API calls 32584->32588 32589 b0154ee 4 API calls 32584->32589 32585 b0137ec 32585->32568 32586->32568 32587->32585 32588->32585 32589->32585 32591 6c0fc3e 32590->32591 32594 6c0f928 32591->32594 32595 6c0fc58 DeleteFileW 32594->32595 32597 6c0fc45 32595->32597 32597->32520 32599 b013d47 GetCurrentProcess 32598->32599 32601 b015830 GetCurrentThread 32599->32601 32602 b015829 32599->32602 32603 b015866 32601->32603 32604 b01586d GetCurrentProcess 32601->32604 32602->32601 32603->32604 32607 b0158a3 32604->32607 32605 b0158cb GetCurrentThreadId 32606 b0158fc 32605->32606 32606->32527 32607->32605 32609 b015f87 32608->32609 32609->32608 32610 b015fe7 32609->32610 32622 b013e48 32609->32622 32610->32532 32612 b015fc5 32612->32612 32615 b010fa7 32613->32615 32614 b013e48 5 API calls 32616 b015fc5 32614->32616 32615->32614 32616->32616 32619 b010efd 32617->32619 32618 b010f69 32619->32618 32620 b013e48 5 API calls 32619->32620 32621 b015fc5 32620->32621 32621->32621 32623 b013e53 32622->32623 32624 b016834 32623->32624 32627 b0185b1 32623->32627 32632 b018640 32623->32632 32624->32612 32628 b018632 32627->32628 32629 b018685 32628->32629 32637 b0187e0 32628->32637 32643 b0187f0 32628->32643 32629->32624 32634 b018661 32632->32634 32633 b018685 32633->32624 32634->32633 32635 b0187e0 5 API calls 32634->32635 32636 b0187f0 5 API calls 32634->32636 32635->32633 32636->32633 32638 b0187fd 32637->32638 32639 b0156e8 4 API calls 32638->32639 32640 b01882b 32639->32640 32641 b018836 32640->32641 32649 b016c9c 32640->32649 32641->32629 32644 b0187fd 32643->32644 32645 b0156e8 4 API calls 32644->32645 32646 b01882b 32645->32646 32647 b018836 32646->32647 32648 b016c9c 5 API calls 32646->32648 32647->32629 32648->32647 32650 b016ca7 32649->32650 32652 b0188d0 32650->32652 32653 b016cd0 32650->32653 32652->32652 32654 b016cdb 32653->32654 32660 b016ce0 32654->32660 32656 b018917 32664 b01cfa8 32656->32664 32670 b01cfec 32656->32670 32657 b018951 32657->32650 32661 b016ceb 32660->32661 32662 b019c29 32661->32662 32663 b018640 5 API calls 32661->32663 32662->32656 32663->32662 32666 b01cfb2 32664->32666 32665 b01cffd 32665->32657 32666->32665 32676 b01d228 32666->32676 32680 b01d238 32666->32680 32667 b01d03c 32672 b01cff0 32670->32672 32671 b01cffd 32671->32657 32672->32671 32674 b01d228 LoadLibraryExW 32672->32674 32675 b01d238 LoadLibraryExW 32672->32675 32673 b01d03c 32674->32673 32675->32673 32677 b01d238 32676->32677 32683 b01d285 32677->32683 32678 b01d242 32678->32667 32682 b01d285 LoadLibraryExW 32680->32682 32681 b01d242 32681->32667 32682->32681 32684 b01d299 32683->32684 32685 b01d2b4 32683->32685 32684->32685 32686 b01d579 LoadLibraryExW 32684->32686 32687 b01d588 LoadLibraryExW 32684->32687 32685->32678 32686->32685 32687->32685 32789 b01fa38 32790 b01faa0 CreateWindowExW 32789->32790 32792 b01fb5c 32790->32792 32792->32792 32793 b0d4630 32794 b0d4938 32793->32794 32795 b0d4658 32793->32795 32796 b0d4661 32795->32796 32799 b0d39e4 32795->32799 32798 b0d4684 32801 b0d39ef 32799->32801 32800 b0d49bb 32800->32798 32801->32800 32803 b0d3ab8 32801->32803 32804 b0d49f0 OleInitialize 32803->32804 32805 b0d4a54 32804->32805 32805->32800

                Executed Functions

                Function 0B013D32 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 135threadCOMMON
                Download Yara Rule

                Control-flow Graph

                APIs
                • GetCurrentProcess.KERNEL32 ref: 0B015816
                • GetCurrentThread.KERNEL32 ref: 0B015853
                • GetCurrentProcess.KERNEL32 ref: 0B015890
                • GetCurrentThreadId.KERNEL32 ref: 0B0158E9
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: Current$ProcessThread
                • String ID: sgm3
                • API String ID: 2063062207-2060810551
                • Opcode ID: d1afaab82545aa6243c33a62854654343d21da64b17d5cdc2327e76ff07ca513
                • Instruction ID: 8fe3a8fbc152971c75655ac15ba15bf37e9509787d24a880851be822f221108b
                • Opcode Fuzzy Hash: d1afaab82545aa6243c33a62854654343d21da64b17d5cdc2327e76ff07ca513
                • Instruction Fuzzy Hash: A35166B0D01349CFDB48DFAAD948BAEBBF1FF88304F248459E019AB260D7356944CB65
                Function 0B013D3C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132threadCOMMON
                Download Yara Rule

                Control-flow Graph

                APIs
                • GetCurrentProcess.KERNEL32 ref: 0B015816
                • GetCurrentThread.KERNEL32 ref: 0B015853
                • GetCurrentProcess.KERNEL32 ref: 0B015890
                • GetCurrentThreadId.KERNEL32 ref: 0B0158E9
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: Current$ProcessThread
                • String ID: sgm3
                • API String ID: 2063062207-2060810551
                • Opcode ID: b5b9766cb853c7a559fce69089b5e2d31a9b13981344528cb074b43ebbc3ec62
                • Instruction ID: 4c81ad60f46b7c6949d671556b404174b9fd4200bec0ab9e0197b2da55db15f9
                • Opcode Fuzzy Hash: b5b9766cb853c7a559fce69089b5e2d31a9b13981344528cb074b43ebbc3ec62
                • Instruction Fuzzy Hash: 225167B0D01249CFDB48DFAAD948BAEBBF1FF88304F208459E019B7260D7356944CB65
                Function 0B01FA2C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 52 b01fa2c-b01fa9e 54 b01faa0-b01faa6 52->54 55 b01faa9-b01fab0 52->55 54->55 56 b01fab2-b01fab8 55->56 57 b01fabb-b01faf3 55->57 56->57 58 b01fafb-b01fb5a CreateWindowExW 57->58 59 b01fb63-b01fb9b 58->59 60 b01fb5c-b01fb62 58->60 64 b01fba8 59->64 65 b01fb9d-b01fba0 59->65 60->59 66 b01fba9 64->66 65->64 66->66
                APIs
                • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0B01FB4A
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: CreateWindow
                • String ID: sgm3$sgm3
                • API String ID: 716092398-4065736149
                • Opcode ID: c14b0b98bbe0eee34a665b67fee16fc612fe472f828e5400d69166ffde4f0183
                • Instruction ID: bfad588c3cfa4c92ea760e8dd504915f9b4a136e16767342af77d3c9fe572e4c
                • Opcode Fuzzy Hash: c14b0b98bbe0eee34a665b67fee16fc612fe472f828e5400d69166ffde4f0183
                • Instruction Fuzzy Hash: 1051CFB1D003499FDB18CF99C894ADEBBB5FF88310F64856AE819AB210D7749845CF90
                Function 0B01FA38 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 67 b01fa38-b01fa9e 68 b01faa0-b01faa6 67->68 69 b01faa9-b01fab0 67->69 68->69 70 b01fab2-b01fab8 69->70 71 b01fabb-b01fb5a CreateWindowExW 69->71 70->71 73 b01fb63-b01fb9b 71->73 74 b01fb5c-b01fb62 71->74 78 b01fba8 73->78 79 b01fb9d-b01fba0 73->79 74->73 80 b01fba9 78->80 79->78 80->80
                APIs
                • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0B01FB4A
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: CreateWindow
                • String ID: sgm3$sgm3
                • API String ID: 716092398-4065736149
                • Opcode ID: 8143808f39e5e87fdf7b3291248cd7176c30adbef042d60602f869f7161da499
                • Instruction ID: 95c96e4280371318049590998594ce8d9a0e62e405ec61327f8450416d566eb9
                • Opcode Fuzzy Hash: 8143808f39e5e87fdf7b3291248cd7176c30adbef042d60602f869f7161da499
                • Instruction Fuzzy Hash: CE41AEB1D00309DFDB18CF9AD884ADEBBF5BF88310F64852AE819AB210D7759845CF90
                Function 06C0F928 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59fileCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 81 6c0f928-6c0fca2 84 6c0fca4-6c0fca7 81->84 85 6c0fcaa-6c0fcd5 DeleteFileW 81->85 84->85 86 6c0fcd7-6c0fcdd 85->86 87 6c0fcde-6c0fd06 85->87 86->87
                APIs
                • DeleteFileW.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,06C0FC45), ref: 06C0FCC8
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4551944966.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_6c00000_csc.jbxd
                Similarity
                • API ID: DeleteFile
                • String ID: 4'^$sgm3
                • API String ID: 4033686569-1565655794
                • Opcode ID: 010647d2306859bd808af01c297179336c5965ffbb53e9f564d46028b4602d28
                • Instruction ID: 9fc047b4b752a4e3fc8e7cd6b7e8efdb1fa78954784c7c7478c03413c923eeb4
                • Opcode Fuzzy Hash: 010647d2306859bd808af01c297179336c5965ffbb53e9f564d46028b4602d28
                • Instruction Fuzzy Hash: DE2115B5C006599FDB24DF9AC5457AEFBB4EB48620F10812AD928A7240D378A944CFE5
                Function 06C01978 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 176 6c01978-6c03401 CreateActCtxA 179 6c03403-6c03409 176->179 180 6c0340a-6c03464 176->180 179->180 187 6c03473-6c03477 180->187 188 6c03466-6c03469 180->188 189 6c03488 187->189 190 6c03479-6c03485 187->190 188->187 191 6c03489 189->191 190->189 191->191
                APIs
                • CreateActCtxA.KERNEL32(?), ref: 06C033F1
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4551944966.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_6c00000_csc.jbxd
                Similarity
                • API ID: Create
                • String ID: sgm3
                • API String ID: 2289755597-2060810551
                • Opcode ID: f54db73f04c47679ba7fc7589bbb1a66e2f74fabad7fc92e7eba9bb32fce2061
                • Instruction ID: 42fd4ce2fcba19843c1ddc0de77dfb18e0cadf73bf6e924e80dfe31b50638c27
                • Opcode Fuzzy Hash: f54db73f04c47679ba7fc7589bbb1a66e2f74fabad7fc92e7eba9bb32fce2061
                • Instruction Fuzzy Hash: 4841BFB0C0075DDFEB64DFAAC844B9EBBB5BF48704F20806AD409AB251DB756945CFA0
                Function 06C03334 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 193 6c03334-6c03401 CreateActCtxA 195 6c03403-6c03409 193->195 196 6c0340a-6c03464 193->196 195->196 203 6c03473-6c03477 196->203 204 6c03466-6c03469 196->204 205 6c03488 203->205 206 6c03479-6c03485 203->206 204->203 207 6c03489 205->207 206->205 207->207
                APIs
                • CreateActCtxA.KERNEL32(?), ref: 06C033F1
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4551944966.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_6c00000_csc.jbxd
                Similarity
                • API ID: Create
                • String ID: sgm3
                • API String ID: 2289755597-2060810551
                • Opcode ID: c61af44a6f308b94ee4994cdb613649ddcb4b73ce16ba4a891acd8f274863cef
                • Instruction ID: 2605f9def5520374e33e3fb331d6bf0d230a9e2b58abb5a7a2268281d9ac817b
                • Opcode Fuzzy Hash: c61af44a6f308b94ee4994cdb613649ddcb4b73ce16ba4a891acd8f274863cef
                • Instruction Fuzzy Hash: F441DEB4C0075DCFEB64CFA9C844B9EBBB5BF48304F20846AD409AB255DB756946CFA0
                Function 0B0D2460 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 209 b0d2460-b0d249c 210 b0d254c-b0d256c 209->210 211 b0d24a2-b0d24a7 209->211 218 b0d256f-b0d257c 210->218 212 b0d24a9-b0d24e0 211->212 213 b0d24fa-b0d2532 CallWindowProcW 211->213 219 b0d24e9-b0d24f8 212->219 220 b0d24e2-b0d24e8 212->220 215 b0d253b-b0d254a 213->215 216 b0d2534-b0d253a 213->216 215->218 216->215 219->218 220->219
                APIs
                • CallWindowProcW.USER32(?,?,?,?,?), ref: 0B0D2521
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4554098680.000000000B0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B0D0000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b0d0000_csc.jbxd
                Similarity
                • API ID: CallProcWindow
                • String ID: sgm3
                • API String ID: 2714655100-2060810551
                • Opcode ID: ed1c93bbecd188931e185c6b02fa77fd4acfc49dbcd7fcb6ed90084288e730c1
                • Instruction ID: fd242d3128f8c1ab44b616babb8352d8438e94c082c790f6e24765de2b770474
                • Opcode Fuzzy Hash: ed1c93bbecd188931e185c6b02fa77fd4acfc49dbcd7fcb6ed90084288e730c1
                • Instruction Fuzzy Hash: C64117B5900309CFDB58CF99C448AAABBF5FB88314F24C499D519AB365D374A841CFA0
                Function 0B013C84 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 223 b013c84-b0141a2 226 b0141a4-b0141ac 223->226 227 b0141ae-b0141f5 SetWindowsHookExW 223->227 226->227 231 b0141f7-b0141fd 227->231 232 b0141fe-b01422a 227->232 231->232
                APIs
                • SetWindowsHookExW.USER32(?,00000000,?,?,?,?,?,00000000,00000000,?,0B0140D5,00000000,00000000), ref: 0B0141E8
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: HookWindows
                • String ID: sgm3
                • API String ID: 2559412058-2060810551
                • Opcode ID: daea425f755fd6d2d11baa1e86dd7e046ddef3f5857acf2f7823bfbf2e64541b
                • Instruction ID: d1b3c92f7c8829cc0ef236393edbe58800172ce643374569482dac2be272c9f9
                • Opcode Fuzzy Hash: daea425f755fd6d2d11baa1e86dd7e046ddef3f5857acf2f7823bfbf2e64541b
                • Instruction Fuzzy Hash: 7A2124B5D002099FDB18DFA9C844AAEBBF5FB88310F108429E915A7360D775A904CFA1
                Function 0B014152 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 236 b014152-b0141a2 238 b0141a4-b0141ac 236->238 239 b0141ae 236->239 238->239 241 b0141b8-b0141bb 239->241 242 b0141c3-b0141f5 SetWindowsHookExW 241->242 243 b0141f7-b0141fd 242->243 244 b0141fe-b01422a 242->244 243->244
                APIs
                • SetWindowsHookExW.USER32(?,00000000,?,?,?,?,?,00000000,00000000,?,0B0140D5,00000000,00000000), ref: 0B0141E8
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: HookWindows
                • String ID: sgm3
                • API String ID: 2559412058-2060810551
                • Opcode ID: 3240e5a79a62e8898c5295567c4e6bbafcc8797b96f6e3a8ef1d3b6e0717ad3c
                • Instruction ID: 257b81b4f76183c34710f88ca2c03c9e8dc10de4103fef09540e167a29ad06e6
                • Opcode Fuzzy Hash: 3240e5a79a62e8898c5295567c4e6bbafcc8797b96f6e3a8ef1d3b6e0717ad3c
                • Instruction Fuzzy Hash: 9F2135B5D00209DFDB14DFA9C884A9EBBF4FF88310F10842AD519A7360C7759904CFA1
                Function 0B0159D9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 248 b0159d9-b015a74 DuplicateHandle 249 b015a76-b015a7c 248->249 250 b015a7d-b015a9a 248->250 249->250
                APIs
                • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0B015A67
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: DuplicateHandle
                • String ID: sgm3
                • API String ID: 3793708945-2060810551
                • Opcode ID: 50e9aa1d8fdf8d99973192f522b2d6708ab6c919389aec9854f18d87c5f58d6d
                • Instruction ID: 1189fea68053483efb2661e9637e47b816b803d7e3853cba2a63169c2d92dc67
                • Opcode Fuzzy Hash: 50e9aa1d8fdf8d99973192f522b2d6708ab6c919389aec9854f18d87c5f58d6d
                • Instruction Fuzzy Hash: A021E4B5D01249EFDB14CFAAD884AEEBBF4FB48310F14845AE918A7310D375A954CFA4
                Function 0B0159E0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 253 b0159e0-b015a74 DuplicateHandle 254 b015a76-b015a7c 253->254 255 b015a7d-b015a9a 253->255 254->255
                APIs
                • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0B015A67
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: DuplicateHandle
                • String ID: sgm3
                • API String ID: 3793708945-2060810551
                • Opcode ID: 63a4ea6445af12fd7ddb8d0cfb7169d47a052e1337f8c0980edb0c74bbdc7d5b
                • Instruction ID: 09e5403d6da0e891ba94b860fc263cf756f065db4ff3fc28f0bdcadfe538ba13
                • Opcode Fuzzy Hash: 63a4ea6445af12fd7ddb8d0cfb7169d47a052e1337f8c0980edb0c74bbdc7d5b
                • Instruction Fuzzy Hash: E821E4B5D01208DFDB10CFAAD884ADEBBF4EB48310F14845AE918A7310D375A940CFA4
                Function 06C0FC50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60fileCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 258 6c0fc50-6c0fca2 260 6c0fca4-6c0fca7 258->260 261 6c0fcaa-6c0fcd5 DeleteFileW 258->261 260->261 262 6c0fcd7-6c0fcdd 261->262 263 6c0fcde-6c0fd06 261->263 262->263
                APIs
                • DeleteFileW.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,06C0FC45), ref: 06C0FCC8
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4551944966.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_6c00000_csc.jbxd
                Similarity
                • API ID: DeleteFile
                • String ID: sgm3
                • API String ID: 4033686569-2060810551
                • Opcode ID: a102e6f5b4c9708129cb0b928fd13b8abb0fb726b3c7a2d60adffd5a8f121508
                • Instruction ID: 3ec9a08280801df903d54db945c071289cbc6dc4a490e75b372ccc9734940a36
                • Opcode Fuzzy Hash: a102e6f5b4c9708129cb0b928fd13b8abb0fb726b3c7a2d60adffd5a8f121508
                • Instruction Fuzzy Hash: A92135B1C00619DFDB24DFAAC445BEEFBB4EF48710F10812AD818A7250D338A941CFA4
                Function 0B01D741 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57libraryCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 266 b01d741-b01d745 267 b01d753-b01d788 266->267 268 b01d747-b01d751 266->268 269 b01d790-b01d7bf LoadLibraryExW 267->269 270 b01d78a-b01d78d 267->270 268->267 271 b01d7c1-b01d7c7 269->271 272 b01d7c8-b01d7e5 269->272 270->269 271->272
                APIs
                • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0B01D5C1,00000800,00000000,00000000), ref: 0B01D7B2
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: LibraryLoad
                • String ID: sgm3
                • API String ID: 1029625771-2060810551
                • Opcode ID: cdc0bd188cf979f7ca4dfa23c64c693f43c5440f8c39dcbba60d69679bb55294
                • Instruction ID: e8d96ae6d8a0bcf9e0b2760fc99498d3f4ae9589e7a5d1911b7601b6c5ef034a
                • Opcode Fuzzy Hash: cdc0bd188cf979f7ca4dfa23c64c693f43c5440f8c39dcbba60d69679bb55294
                • Instruction Fuzzy Hash: AD2117B6D002498FDB18CF9AD484ADEFBF5EB88320F10852AD569A7210C379A545CFA5
                Function 0B01C398 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55libraryCOMMON
                Download Yara Rule
                APIs
                • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0B01D5C1,00000800,00000000,00000000), ref: 0B01D7B2
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: LibraryLoad
                • String ID: sgm3
                • API String ID: 1029625771-2060810551
                • Opcode ID: 833c7869c705b89ea87fdfbc090274a98ec10a79f885ecb298944132c5be25a7
                • Instruction ID: e412f3e307115753b3cd39b47c2e2b07ce660324a7fcfa6bcbe7075e9a989248
                • Opcode Fuzzy Hash: 833c7869c705b89ea87fdfbc090274a98ec10a79f885ecb298944132c5be25a7
                • Instruction Fuzzy Hash: F31114B6D002098FDB18CF9AC444A9EFBF4EB88720F10852AD529A7200D379A544CFA4
                Function 0B01D4B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON
                Download Yara Rule
                APIs
                • GetModuleHandleW.KERNELBASE(00000000), ref: 0B01D526
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: HandleModule
                • String ID: sgm3
                • API String ID: 4139908857-2060810551
                • Opcode ID: 9e4106aae8072351d6efaf467afdaf80ac6ed770eb9945fcdfc7a3117693d0d0
                • Instruction ID: fb4d812e16ef48087432a42f3ee210cd4aa46f6222bec29efc26702f03e2ad58
                • Opcode Fuzzy Hash: 9e4106aae8072351d6efaf467afdaf80ac6ed770eb9945fcdfc7a3117693d0d0
                • Instruction Fuzzy Hash: E31112B5C00249CFDB14CF9AD444ADEFBF0AB88324F14856AD459A7211C379A506CFA1
                Function 0B01D4C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                Download Yara Rule
                APIs
                • GetModuleHandleW.KERNELBASE(00000000), ref: 0B01D526
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553929644.000000000B010000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B010000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b010000_csc.jbxd
                Similarity
                • API ID: HandleModule
                • String ID: sgm3
                • API String ID: 4139908857-2060810551
                • Opcode ID: 053e4ff0cf6cc4aac3efd1ca4b8001d952d24961b2bbf9f65dc2d863b3b44529
                • Instruction ID: 1b23eb53d458f83dad58ef6cd4a6d934b67c2170c1509771151720198bad2417
                • Opcode Fuzzy Hash: 053e4ff0cf6cc4aac3efd1ca4b8001d952d24961b2bbf9f65dc2d863b3b44529
                • Instruction Fuzzy Hash: CD110FB6C002498FDB14DF9AD444A9EFBF4AB88324F10896AD428A7210C379A545CFA5
                Function 0B0D3AB8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46comCOMMON
                Download Yara Rule
                APIs
                • OleInitialize.OLE32(00000000), ref: 0B0D4A45
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4554098680.000000000B0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B0D0000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b0d0000_csc.jbxd
                Similarity
                • API ID: Initialize
                • String ID: sgm3
                • API String ID: 2538663250-2060810551
                • Opcode ID: a189ba4bcf9ea16a9c588dfa2a602a0b7e9c5fb07fb6857dd29c6ade94a6ae40
                • Instruction ID: 8250a1bbe8d4d33a95cafec16f80dbf2a84b8ec2ba0ab31acdfba0d3a8a5eb67
                • Opcode Fuzzy Hash: a189ba4bcf9ea16a9c588dfa2a602a0b7e9c5fb07fb6857dd29c6ade94a6ae40
                • Instruction Fuzzy Hash: 2D1133B5900348CFCB20DF9AD448B9EBBF8EB48220F208459D519A7340C378A944CFA9
                Function 0B0D49EA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46comCOMMON
                Download Yara Rule
                APIs
                • OleInitialize.OLE32(00000000), ref: 0B0D4A45
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4554098680.000000000B0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B0D0000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_b0d0000_csc.jbxd
                Similarity
                • API ID: Initialize
                • String ID: sgm3
                • API String ID: 2538663250-2060810551
                • Opcode ID: 9616d5eec8d8f5b990b2733bb72be05e1796452c73e341488a3663b45fdd7d99
                • Instruction ID: 7fb9cac0181ca7b817075791909b5af95d104d994a4e31275cc7f4129cdf60a0
                • Opcode Fuzzy Hash: 9616d5eec8d8f5b990b2733bb72be05e1796452c73e341488a3663b45fdd7d99
                • Instruction Fuzzy Hash: 9B1100B59003488FDB20DFAAD488BDEBFF4EB49320F24845AD558A7350C379A544CFA5
                Function 0ABC0048 Relevance: 1.7, Strings: 1, Instructions: 426COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553857696.000000000ABC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABC0000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_abc0000_csc.jbxd
                Similarity
                • API ID:
                • String ID: ?
                • API String ID: 0-1684325040
                • Opcode ID: 6c7c677365a8aae2d18569e1f3331debfde3ef89f08851e3bcb066f102c37351
                • Instruction ID: 72084dd4d998ff3df1d028d537de55d84bbca8371910fd43e49ee029507deb12
                • Opcode Fuzzy Hash: 6c7c677365a8aae2d18569e1f3331debfde3ef89f08851e3bcb066f102c37351
                • Instruction Fuzzy Hash: 3FF18030B00209DFEB15EBA5C844A6EBBB6FF88300F148069E5569B396EB35DD41DF51
                Function 06C0FC28 Relevance: 1.5, APIs: 1, Instructions: 49fileCOMMON
                Download Yara Rule
                APIs
                • DeleteFileW.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,06C0FC45), ref: 06C0FCC8
                Memory Dump Source
                • Source File: 00000003.00000002.4551944966.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_6c00000_csc.jbxd
                Similarity
                • API ID: DeleteFile
                • String ID:
                • API String ID: 4033686569-0
                • Opcode ID: 9fc646e9a0e942bb070a08f8d1ab493d38b2400b3d732d21865eec5d80b149f4
                • Instruction ID: a3059362f746f7e331249100acedac19f95531d5ec894f9e84a580101bf4c3b2
                • Opcode Fuzzy Hash: 9fc646e9a0e942bb070a08f8d1ab493d38b2400b3d732d21865eec5d80b149f4
                • Instruction Fuzzy Hash: 8811E1B2C05215CFDB24DF95D4563AEBBB0EF44310F11414AC819A7681D7389A84CBE1
                Function 0ABC0000 Relevance: 1.5, Strings: 1, Instructions: 248COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000003.00000002.4553857696.000000000ABC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABC0000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_abc0000_csc.jbxd
                Similarity
                • API ID:
                • String ID: ?
                • API String ID: 0-1684325040
                • Opcode ID: 6f78c92dc620a1eeef2829b192609f2585c7e071f9a273d80a68d00f1b5b3629
                • Instruction ID: 0ec3f13aa43a3dd343664514e7b9d7757d99bf43e050295987c3abb473402628
                • Opcode Fuzzy Hash: 6f78c92dc620a1eeef2829b192609f2585c7e071f9a273d80a68d00f1b5b3629
                • Instruction Fuzzy Hash: 26912630B00706DFEB15EB69C850B6EBBB6FF85304F1441AAD502DB3A2EA75DD019B52
                Function 00C8D4D8 Relevance: .1, Instructions: 75COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000003.00000002.4550916468.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_c8d000_csc.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 9ed183769561532f713d372b201ba981d8fbcb7953c3f6a08a5db7f2a986cc15
                • Instruction ID: 00d38276fe12b3bbbc111d50fefcb4fd33465dc55988b3f75c9721bdfca7d698
                • Opcode Fuzzy Hash: 9ed183769561532f713d372b201ba981d8fbcb7953c3f6a08a5db7f2a986cc15
                • Instruction Fuzzy Hash: 712128B2504204EFDB05EF14D9C0B16BF65FB9831CF20816EE90A4B296C336D956CBA6
                Function 00C8D3EC Relevance: .1, Instructions: 75COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000003.00000002.4550916468.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_c8d000_csc.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 4b5635e2036c07ac125025df4f5cafcf0a5e17f1d2d888aa980619a2358c8c9c
                • Instruction ID: ce2685d2f2356b5e29169c8f044de5860140bf5c22400cce023bc674e507a0c0
                • Opcode Fuzzy Hash: 4b5635e2036c07ac125025df4f5cafcf0a5e17f1d2d888aa980619a2358c8c9c
                • Instruction Fuzzy Hash: D6212572504204EFDB04EF14D9C0B26BF65FBD4328F20C569E90A4B296C336E856CBA5
                Function 04FBD208 Relevance: .1, Instructions: 72COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000003.00000002.4551168758.0000000004FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FBD000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_4fbd000_csc.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 82952b7a7f259f99a5f4596f464f1e3f9e735ff8b7a0cdd951cdea626875a256
                • Instruction ID: a9d5d63ac345a3aa68fafd9b524dde02f6d1a7263c44fa10d0c72522b271d38c
                • Opcode Fuzzy Hash: 82952b7a7f259f99a5f4596f464f1e3f9e735ff8b7a0cdd951cdea626875a256
                • Instruction Fuzzy Hash: BA217972A00284DFEB04DF15D5C4B55BB65FB85314F20C5ADE9894B242C377E407CBA2
                Function 00C8D4D3 Relevance: .1, Instructions: 56COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000003.00000002.4550916468.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_c8d000_csc.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: c4163f8a738b895e3a03195f577c6e99c6dcd9217d130c51c8e43b8f667961e3
                • Instruction ID: 01fb4e2fbcecab0dc712a36c86fbf9bd936ad5444c67239f98a59f078f415fa0
                • Opcode Fuzzy Hash: c4163f8a738b895e3a03195f577c6e99c6dcd9217d130c51c8e43b8f667961e3
                • Instruction Fuzzy Hash: C011E6B6504240DFCB15DF14D5C4B16BF71FB94318F24C6AADC0A4B256C33AD956CBA1
                Function 00C8D3E7 Relevance: .1, Instructions: 56COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000003.00000002.4550916468.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_c8d000_csc.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: c4163f8a738b895e3a03195f577c6e99c6dcd9217d130c51c8e43b8f667961e3
                • Instruction ID: 713854eecbc6a136cd88094eb00e20115e7603fd34202f6cbdd0e44ab9bda6de
                • Opcode Fuzzy Hash: c4163f8a738b895e3a03195f577c6e99c6dcd9217d130c51c8e43b8f667961e3
                • Instruction Fuzzy Hash: DA112672404240DFCB05DF00D5C0B16BF72FB94324F24C5A9D8090B656C33AE956CBA1
                Function 04FBD203 Relevance: .1, Instructions: 53COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000003.00000002.4551168758.0000000004FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FBD000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_3_2_4fbd000_csc.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 266c387f8ae13a1d97c860eeb2b613950a144f769af30e4a24cccb1e8c5eac3e
                • Instruction ID: 1b2de0f1417621fb1c2bf6c85597e5a435bf17b582682d384502bc251bec2e24
                • Opcode Fuzzy Hash: 266c387f8ae13a1d97c860eeb2b613950a144f769af30e4a24cccb1e8c5eac3e
                • Instruction Fuzzy Hash: 7811DD75904284CFDB05CF10D5C4B55BFA1FB85314F28C6AEDC494B256C33AE40ACBA2