Edit tour

Windows Analysis Report
MqN5lD3LGo.exe

Overview

General Information

Sample name:	MqN5lD3LGo.exe renamed because original name is a hash value
Original sample name:	c6c9f27d335d4e47b5ea12653e806be6.exe
Analysis ID:	1462554
MD5:	c6c9f27d335d4e47b5ea12653e806be6
SHA1:	e53242d463e2c94383ec646e7e04504b96b4d176
SHA256:	514efbae5faa43878c743c3db36f81c25ab5d6da93b879b6e88e7a63b1b19769
Tags:	32exetrojan
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

Machine Learning detection for sample

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

MqN5lD3LGo.exe (PID: 4508 cmdline: "C:\Users\user\Desktop\MqN5lD3LGo.exe" MD5: C6C9F27D335D4E47B5EA12653E806BE6)

conhost.exe (PID: 6576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 4012 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 3536 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 308 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: RegAsm.exe PID: 4012	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Snort Signatures

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/25/24-18:12:57.603058
SID:	2049060
Source Port:	49705
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/25/24-18:12:58.145124
SID:	2046266
Source Port:	50500
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/25/24-18:16:59.942935
SID:	2046269
Source Port:	49705
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: MqN5lD3LGo.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: MqN5lD3LGo.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,

3_2_004C6B00

Source: MqN5lD3LGo.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: MqN5lD3LGo.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000003.00000002.4473702920.0000000001546000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000003.00000002.4473702920.0000000001546000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000CC8CD FindFirstFileExW,	0_2_000CC8CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	3_2_004C6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432022 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_00432022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	3_2_004E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	3_2_004938D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00493B60 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	3_2_00493B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044FC2F FindFirstFileExW,	3_2_0044FC2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,	3_2_004DFF00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	3_2_00431F9C

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.5:49705 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.5:49705
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49705 -> 5.42.67.8:50500

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 5.42.67.8:50500

Source: Joe Sandbox View

IP Address: 5.42.67.8 5.42.67.8

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004C8590 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,freeaddrinfo,WSACleanup,freeaddrinfo,

3_2_004C8590

Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 00000003.00000002.4473702920.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: MqN5lD3LGo.exe, 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: RegAsm.exe	String found in binary or memory: https://ipinfo.io/
Source: MqN5lD3LGo.exe, 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: RegAsm.exe, 00000003.00000002.4473702920.00000000014FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: RegAsm.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000D09FC	0_2_000D09FC
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000C2C20	0_2_000C2C20
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000CBC92	0_2_000CBC92
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000D0DD4	0_2_000D0DD4
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000BFF04	0_2_000BFF04
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000C7782	0_2_000C7782
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004E4BD0	3_2_004E4BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044002D	3_2_0044002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005220D0	3_2_005220D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F60E0	3_2_004F60E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C00A0	3_2_004C00A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004EE170	3_2_004EE170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00508120	3_2_00508120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004A6250	3_2_004A6250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00512260	3_2_00512260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040A2C0	3_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0050A2B0	3_2_0050A2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044036F	3_2_0044036F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004A4320	3_2_004A4320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004BE3C0	3_2_004BE3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F0450	3_2_004F0450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004DE430	3_2_004DE430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004B84D0	3_2_004B84D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004FA480	3_2_004FA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00514550	3_2_00514550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F85F0	3_2_004F85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00490600	3_2_00490600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00452610	3_2_00452610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005486C0	3_2_005486C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004E06D0	3_2_004E06D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004547BF	3_2_004547BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F2820	3_2_004F2820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004A88B0	3_2_004A88B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043C960	3_2_0043C960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00546970	3_2_00546970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043A928	3_2_0043A928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004FA930	3_2_004FA930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F8B40	3_2_004F8B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00500BA0	3_2_00500BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00458BB0	3_2_00458BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004EEC40	3_2_004EEC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00534D40	3_2_00534D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004FAD00	3_2_004FAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00546D20	3_2_00546D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0053AE20	3_2_0053AE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00458E30	3_2_00458E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00506EA0	3_2_00506EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00516EA0	3_2_00516EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004ECF20	3_2_004ECF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F2FD0	3_2_004F2FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D70F0	3_2_004D70F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00493080	3_2_00493080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004371A0	3_2_004371A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005031A0	3_2_005031A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004A9380	3_2_004A9380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D1450	3_2_004D1450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0053F550	3_2_0053F550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042F580	3_2_0042F580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0048F590	3_2_0048F590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004B3600	3_2_004B3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004A3610	3_2_004A3610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004B1630	3_2_004B1630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00547760	3_2_00547760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F7730	3_2_004F7730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004E77E0	3_2_004E77E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00495790	3_2_00495790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005397B0	3_2_005397B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F7960	3_2_004F7960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0047B970	3_2_0047B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004EF9A0	3_2_004EF9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004CBAC0	3_2_004CBAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044DA86	3_2_0044DA86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004A9B50	3_2_004A9B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00493B60	3_2_00493B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004ADB20	3_2_004ADB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0051DBB0	3_2_0051DBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004EFC40	3_2_004EFC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F7C00	3_2_004F7C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00503CC0	3_2_00503CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409C90	3_2_00409C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F9D70	3_2_004F9D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F7D00	3_2_004F7D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00545DE0	3_2_00545DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00541F00	3_2_00541F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C1F20	3_2_004C1F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00501FE0	3_2_00501FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004FFFA0	3_2_004FFFA0

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: String function: 000BA0C0 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00547510 appears 102 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434380 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0041ACE0 appears 104 times

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 308

Source: MqN5lD3LGo.exe, 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamedotnet.exe6 vs MqN5lD3LGo.exe

Source: MqN5lD3LGo.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: MqN5lD3LGo.exe

Static PE information: Section: .data ZLIB complexity 0.9968365897495362

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/6@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_005447E0 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

3_2_005447E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00544A40 GetDiskFreeSpaceW,GetDiskFreeSpaceA,

3_2_00544A40

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004E06D0 CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

3_2_004E06D0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6576:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4508

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\trixyjpd7CYIHOzrD

Jump to behavior

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MqN5lD3LGo.exe, 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: MqN5lD3LGo.exe, 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: MqN5lD3LGo.exe

ReversingLabs: Detection: 73%

Source: RegAsm.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: unknown	Process created: C:\Users\user\Desktop\MqN5lD3LGo.exe "C:\Users\user\Desktop\MqN5lD3LGo.exe"
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 308
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior

Source: MqN5lD3LGo.exe

Static file information: File size 1870848 > 1048576

Source: MqN5lD3LGo.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x194400

Source: MqN5lD3LGo.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: MqN5lD3LGo.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000003.00000002.4473702920.0000000001546000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000003.00000002.4473702920.0000000001546000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

3_2_004CF280

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000B9AAF push ecx; ret		0_2_000B9AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00433F59 push ecx; ret		3_2_00433F6C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004EE170 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_004EE170

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_3-78728

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_3-78729

Found stalling execution ending in API Sleep call

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Stalling execution: Execution stalls by calling Sleep

graph_3-79174

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

3_2_0045DB00

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 3695			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6190			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_3-79221

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_3-79855

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	API coverage: 9.4 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API coverage: 5.9 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4092	Thread sleep count: 3695 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4092	Thread sleep time: -373195s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4092	Thread sleep count: 6190 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4092	Thread sleep time: -625190s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_005449B0 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 005449F1h

3_2_005449B0

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000CC8CD FindFirstFileExW,	0_2_000CC8CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	3_2_004C6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432022 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_00432022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	3_2_004E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	3_2_004938D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00493B60 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	3_2_00493B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044FC2F FindFirstFileExW,	3_2_0044FC2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,	3_2_004DFF00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	3_2_00431F9C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004580D8 VirtualQuery,GetSystemInfo,

3_2_004580D8

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: RegAsm.exe, 00000003.00000002.4473702920.00000000014FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: RegAsm.exe, 00000003.00000002.4473702920.00000000014FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}=
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: RegAsm.exe, 00000003.00000002.4473702920.0000000001563000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RegAsm.exe, 00000003.00000002.4473600885.000000000133C000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}t
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: RegAsm.exe, 00000003.00000002.4473702920.000000000156D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}FKP
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000003.00000002.4473702920.0000000001546000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 00000003.00000002.4473702920.000000000156B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11
Source: RegAsm.exe, 00000003.00000002.4473702920.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe

Code function: 0_2_000BDED3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000BDED3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_004CF280

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000C3A8C mov ecx, dword ptr fs:[00000030h]	0_2_000C3A8C
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000C85C5 mov eax, dword ptr fs:[00000030h]	0_2_000C85C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045DB00 mov eax, dword ptr fs:[00000030h]	3_2_0045DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045DB00 mov eax, dword ptr fs:[00000030h]	3_2_0045DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D6280 mov eax, dword ptr fs:[00000030h]	3_2_004D6280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C86C0 mov eax, dword ptr fs:[00000030h]	3_2_004C86C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C6D80 mov eax, dword ptr fs:[00000030h]	3_2_004C6D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3070 mov ecx, dword ptr fs:[00000030h]	3_2_004D3070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00495790 mov eax, dword ptr fs:[00000030h]	3_2_00495790

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe

Code function: 0_2_000CDAB5 GetProcessHeap,

0_2_000CDAB5

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000BA04B SetUnhandledExceptionFilter,	0_2_000BA04B
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000BA105 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000BA105
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000BDED3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000BDED3
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: 0_2_000B9EEF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000B9EEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00434184 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00434184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00434311 SetUnhandledExceptionFilter,	3_2_00434311
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0043451D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00438A64

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe

Code function: 0_2_007F018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_007F018D

Contains functionality to inject threads in other processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_004CF280

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 10C4008	Jump to behavior

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe

Code function: 0_2_000B9C95 cpuid

0_2_000B9C95

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_000D0033
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: GetLocaleInfoW,	0_2_000CF8CA
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: GetLocaleInfoW,	0_2_000C70FB
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: EnumSystemLocalesW,	0_2_000CF971
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: EnumSystemLocalesW,	0_2_000CF9BC
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: EnumSystemLocalesW,	0_2_000CFA57
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_000CFAE2
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: EnumSystemLocalesW,	0_2_000C6BD5
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: GetLocaleInfoW,	0_2_000CFD35
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000CFE5E
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_000CF6CF
Source: C:\Users\user\Desktop\MqN5lD3LGo.exe	Code function: GetLocaleInfoW,	0_2_000CFF64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	3_2_004E06D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_00452B5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_00452D5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00452E51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00452E06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00452EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00452F77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_004531CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_0044B1B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_004532F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_004533F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_004534CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_0044B734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	3_2_00431D94

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\MqN5lD3LGo.exe

Code function: 0_2_000BA302 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000BA302

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_005447E0 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

3_2_005447E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 4012, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 4012, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	511 Process Injection	12 Virtualization/Sandbox Evasion	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	511 Process Injection	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	36 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MqN5lD3LGo.exe	74%	ReversingLabs	Win32.Trojan.LummaStealer
MqN5lD3LGo.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
http://www.microsoft.	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	MqN5lD3LGo.exe, 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	MqN5lD3LGo.exe, 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	RegAsm.exe, 00000003.00000002.4473702920.00000000014FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.	RegAsm.exe, 00000003.00000002.4473702920.0000000001546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	RegAsm.exe	false	URL Reputation: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	RegAsm.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.67.8	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1462554
Start date and time:	2024-06-25 18:12:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MqN5lD3LGo.exe renamed because original name is a hash value
Original Sample Name:	c6c9f27d335d4e47b5ea12653e806be6.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 82% Number of executed functions: 30 Number of non-executed functions: 156
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: MqN5lD3LGo.exe

Simulations

Behavior and APIs

Time	Type	Description
12:13:13	API Interceptor	1x Sleep call for process: WerFault.exe modified
12:13:29	API Interceptor	1493643x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.42.67.8	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse
	BY1Fwf74x3.exe	Get hash	malicious	RisePro Stealer, Vidar	Browse
	SecuriteInfo.com.Win64.Evo-gen.4435.12354.exe	Get hash	malicious	CryptOne, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	CHA0VZiz8y.exe	Get hash	malicious	CryptOne, Djvu, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Vidar	Browse
	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Get hash	malicious	CryptOne, Djvu, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	WaGiUWSpyO.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse
	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	1n4J6tLgsc.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.92
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.92
	file.exe	Get hash	malicious	Unknown	Browse	5.42.66.10
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.92
	adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93_dump.exe	Get hash	malicious	RedLine	Browse	5.42.65.92
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.92
	DqnftBv2b9.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	5.42.104.211
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	5.42.65.116
	file.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	5.42.65.92
	AgHiy5gaGp.exe	Get hash	malicious	Amadey, PureLog Stealer	Browse	5.42.66.47

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MqN5lD3LGo.exe_75d7bb26b9feea5788cdd196fb86ebec7d54070_4703ef6b_6232b001-d7a8-4b58-a9ee-92c298c63795\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7031833735538131
Encrypted:	false
SSDEEP:	192:PuvH3ALb0yDBFFbhjG1zuiFWZ24IO8r6:WH3ALoyDBftjkzuiFWY4IO8r
MD5:	8EFFC19778CC4CEB675C1B5CEEDD70F7
SHA1:	9EA94C97AB91C6D28CB2D7D0CAD92F87EA65605D
SHA-256:	8EFB9EDA0D319C5A4DB129708687DEDF2C28D1A386DF5E74C04860C3291F022E
SHA-512:	B5F88D19033E01F825D337BBCC59C99B346B7CA032EA37BA9A72A90A7B13D398BA5FE09334EBAECC4DB371B7E171128E874245A2D8CB871BB90934A92E887897
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.8.0.5.5.7.5.9.4.6.7.5.0.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.8.0.5.5.7.6.2.5.9.2.5.9.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.2.3.2.b.0.0.1.-.d.7.a.8.-.4.b.5.8.-.a.9.e.e.-.9.2.c.2.9.8.c.6.3.7.9.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.b.e.b.f.1.f.5.-.6.0.d.3.-.4.a.2.c.-.9.c.6.7.-.0.a.8.d.a.4.0.4.e.9.7.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.q.N.5.l.D.3.L.G.o...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.9.c.-.0.0.0.1.-.0.0.1.4.-.a.e.1.a.-.8.2.8.9.1.a.c.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.8.f.9.5.a.8.a.0.5.4.6.c.a.f.d.b.6.2.0.f.0.3.f.5.2.c.7.6.9.6.0.0.0.0.0.f.f.f.f.!.0.0.0.0.e.5.3.2.4.2.d.4.6.3.e.2.c.9.4.3.8.3.e.c.6.4.6.e.7.e.0.4.5.0.4.b.9.6.b.4.d.1.7.6.!.M.q.N.5.l.D.3.L.G.o...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC180.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Jun 25 16:12:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	47006
Entropy (8bit):	1.8304097743762475
Encrypted:	false
SSDEEP:	192:KUpgnQwPOWdHGV+8K/8EkRDCBrDpupbG4MuwTNoJb:kQwGDUj/ODCBrd0jMuA
MD5:	0C32A9AF45188EA3F61B54999D05442F
SHA1:	334562DBDB899BE74B51141A7286A45FDEC2D3E6
SHA-256:	2788A3A49ED71A8C5F0836AFCB2A9413517267A44E4FB27A9032C89C60FD65FA
SHA-512:	F635B2F17C88270CDB56C37BF82D5420056238E17EE449F9674808BC0C394BDFD978F46F2114C0C2719BBC441AC0C0018033FA861D6474328ED7DD7B05425AC5
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........zf........................X...............R#..........T.......8...........T...........................T...........@...............................................................................eJ..............GenuineIntel............T.............zf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1CF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.706626244168962
Encrypted:	false
SSDEEP:	192:R6l7wVeJo5666YEIISU9YujrgmfnJjS89apr089bIUsfI4m:R6lXJO666YEHSU9YujrgmfnJjSVIHf+
MD5:	7EF2501F4632338FC348882B7421FE1D
SHA1:	30C9A2D3A572EE4291005C37AF29CD75DB258FA1
SHA-256:	38ABB97F297D83DE66F710D6B1EEFB2D0F337BFD0113281C8209ABB00634F630
SHA-512:	26DC8BE284EA2D16D203123FA1F7E8A9A1FF3FF3650D52CC8FD9B5F8EE697F73D78550858801148EC37916BB278E4DB8073932C3AAA57B794A04BC4F0F5C5BE9
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC20F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4635
Entropy (8bit):	4.5185388407303355
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9PMWpW8VYeNYm8M4J7fFb+q8vVVkOBRVd:uIjfYI7Zl7V3MJxuVkOjVd
MD5:	C91C770972935825DD3C8EEE1F49C985
SHA1:	1B94D76C16D51D8623D62A92BB4213A4B27D1E3D
SHA-256:	70BBA580C86ECC658D40FC28DCEE52193FF19033D219B4E87CC8169621EB3F89
SHA-512:	7FEE19F60AC54A3B4D50B53B6A05C7CBCE20EDECF79F50F10780C80169AF699A34574D8D8CE134F0A66A174F4D7EFD2C4E122A9FD62C197D1E2FF16C23B1CCAB
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="383475" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421577314132633
Encrypted:	false
SSDEEP:	6144:NSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNY0uhiTwb:0vloTMW+EZMM6DFyu03wb
MD5:	AC755C0149B41AE4185ADCD68353B26C
SHA1:	A25D3F3712E76A5652EBDCC864501218A7837CC7
SHA-256:	738F38D91930DB1B29F172D4CAF52A4665C84CA785F542CA2D1306B283CDFA3E
SHA-512:	5F876785BFD508F2E9FD9FAC629BF424B4B3CFECD0DFFC4EDCA5A0FB6E8E9DF8FF82DEE708ACE956D53A4D51698CE84CE8016964350EA1B640BFED0B4515824E
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.t...................................................................................................................................................................................................................................................................................................................................................y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\MqN5lD3LGo.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.3248629576173565
Encrypted:	false
SSDEEP:	3:oJCVNV:o8/V
MD5:	2C34338A8C340C46983875A53A889FC3
SHA1:	5EF486E22F88756BE456209030D46D3D94C21952
SHA-256:	511FF7ADE84BB22C9B35B62A64FC4100A1958E8D20CB795031199748A926E507
SHA-512:	61A221F599A577BC988C6CFF3319F214A62F066B5086C7D8841E8B88BC9FB6CC4F93E8E48E25382BB8148C8F26D045AD15A927ACF0742E69E24923A4659FF633
Malicious:	false
Reputation:	low
Preview:	Illkjmuueghu 0

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.948024837182058
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MqN5lD3LGo.exe
File size:	1'870'848 bytes
MD5:	c6c9f27d335d4e47b5ea12653e806be6
SHA1:	e53242d463e2c94383ec646e7e04504b96b4d176
SHA256:	514efbae5faa43878c743c3db36f81c25ab5d6da93b879b6e88e7a63b1b19769
SHA512:	7e00bdac39c89821b776dda372693d29e0e7188f8ef747037b971461af79545908f8fc8c9bbf7a30f1b0cc4ceea45632e91c1093e784002994808c19bd2a7347
SSDEEP:	49152:KWPLwXMkW4itwCBDtixjSzceiLYtV25Mm8eEMMd:tPLPkW4IwcOj6iLYtV+Mw8
TLSH:	6C852300F4908073C562167706E4DFB69A7EB9714B725CDB6BA44FBF4F306C09632A6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.}.@.}.@.}...~.Q.}...x...}...y.V.}..sy.R.}...\|.G.}.@.\|...}..sx...}..s~.X.}..px.A.}..p..A.}.Rich@.}.................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x409aa5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66789839 [Sun Jun 23 21:48:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e4019b337e6aa53400bb9378be49b858

Entrypoint Preview

Instruction
call 00007EFC9CE8270Ah
jmp 00007EFC9CE81CD9h
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007EFC9CE81BC5h
jmp 00007EFC9CE81E42h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [005C69C0h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [005C69C0h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [005C69C0h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x33594	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1ca000	0x21f0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x30a68	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30ac0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x309a8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x28000	0x180	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x251c2	0x25200	ad92eac1a3518c94a50c469e832eda52	False	0.5649134574915825	data	6.636592053866142	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.BSs	0x27000	0xe1d	0x1000	74293e678f0de25bb463c0dccc7904d8	False	0.583740234375	data	6.002868469254389	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0xbe86	0xc000	b0aa40c4aa7dfc2011d6ffe63826f1cd	False	0.41448974609375	data	4.98810951337647	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x34000	0x19534c	0x194400	4d397285c775cfc4554c7ce0ca0071fc	False	0.9968365897495362	data	7.999224560090972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1ca000	0x21f0	0x2200	f4f8da3f2dfcb44938435d58d7a1d96f	False	0.7734375	data	6.553528678280142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
GDI32.dll	Polyline, RectVisible
USER32.dll	OffsetRect
KERNEL32.dll	CreateFileW, HeapSize, SetStdHandle, WaitForSingleObject, CreateThread, VirtualAlloc, FreeConsole, RaiseException, InitOnceBeginInitialize, InitOnceComplete, CloseHandle, GetCurrentThreadId, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, EncodePointer, DecodePointer, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetStringTypeW, GetCPInfo, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, GetProcessHeap, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, HeapFree, HeapAlloc, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, WriteConsoleW

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/25/24-18:12:57.603058	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49705	50500	192.168.2.5	5.42.67.8
06/25/24-18:12:58.145124	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49705	5.42.67.8	192.168.2.5
06/25/24-18:16:59.942935	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49705	50500	192.168.2.5	5.42.67.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 25, 2024 18:12:57.589859962 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:12:57.594804049 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:12:57.594891071 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:12:57.603058100 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:12:57.607947111 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:12:58.145123959 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:12:58.194113016 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:13:01.287981987 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:13:01.292901039 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:13:32.631783962 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:13:32.636841059 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:13:51.444434881 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:13:51.451287031 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:00.835055113 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:00.841197014 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:03.975673914 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:03.980700016 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:07.101018906 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:07.107686996 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:10.241226912 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:10.246524096 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:13.366247892 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:13.371164083 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:16.506866932 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:16.511805058 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:19.647525072 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:19.652843952 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:22.788155079 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:22.793284893 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:25.929023981 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:25.934446096 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:29.053817987 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:29.058727980 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:32.178858042 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:32.183923960 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:35.319411993 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:35.324887991 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:38.460120916 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:38.465010881 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:41.600847006 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:41.608042955 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:44.725697994 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:44.730870962 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:47.866508007 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:47.871398926 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:50.991391897 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:50.996503115 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:54.132021904 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:54.136972904 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:14:57.256982088 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:14:57.261903048 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:00.382127047 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:00.387090921 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:03.522605896 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:03.527616978 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:06.647850037 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:06.652848959 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:09.772627115 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:09.777631044 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:12.913299084 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:12.918267012 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:16.038249016 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:16.043116093 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:19.179094076 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:19.186846972 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:22.305229902 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:22.310864925 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:25.429091930 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:25.434027910 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:28.554105997 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:28.559413910 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:31.679120064 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:31.683969021 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:34.819679022 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:34.825444937 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:37.960181952 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:37.965126038 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:41.100912094 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:41.108592033 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:44.225826025 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:44.230895042 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:47.366687059 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:47.371661901 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:50.491511106 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:50.497765064 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:53.632509947 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:53.824331999 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:56.757078886 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:56.761936903 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:15:59.897741079 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:15:59.903954029 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:03.046962023 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:03.052200079 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:06.163400888 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:06.367072105 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:09.288505077 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:09.298954964 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:12.429179907 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:12.434616089 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:15.554155111 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:15.559185982 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:18.694617033 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:18.700160027 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:21.835403919 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:21.840472937 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:24.976248980 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:24.981411934 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:28.100905895 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:28.105873108 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:31.241559029 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:31.246587038 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:34.366552114 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:34.371695995 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:37.491601944 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:37.496442080 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:40.616661072 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:40.621546984 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:43.757167101 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:43.762044907 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:46.897917032 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:46.907032013 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:50.038639069 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:50.043551922 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:53.163711071 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:53.168991089 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:56.288558960 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:56.293798923 CEST	50500	49705	5.42.67.8	192.168.2.5
Jun 25, 2024 18:16:59.942934990 CEST	49705	50500	192.168.2.5	5.42.67.8
Jun 25, 2024 18:16:59.951035023 CEST	50500	49705	5.42.67.8	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 25, 2024 18:13:16.644701004 CEST	53	57576	1.1.1.1	192.168.2.5

Target ID:	0
Start time:	12:12:55
Start date:	25/06/2024
Path:	C:\Users\user\Desktop\MqN5lD3LGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MqN5lD3LGo.exe"
Imagebase:	0xb0000
File size:	1'870'848 bytes
MD5 hash:	C6C9F27D335D4E47B5EA12653E806BE6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:12:55
Start date:	25/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:12:55
Start date:	25/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:12:55
Start date:	25/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 308
Imagebase:	0x1e0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0.3%
Signature Coverage:	3%
Total number of Nodes:	2000
Total number of Limit Nodes:	52

Executed Functions

Function 007F018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,007F00FF,007F00EF), ref: 007F02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 007F030F
Wow64GetThreadContext.KERNEL32(000000F4,00000000), ref: 007F032D
ReadProcessMemory.KERNELBASE(000000F8,?,007F0143,00000004,00000000), ref: 007F0351
VirtualAllocEx.KERNELBASE(000000F8,?,?,00003000,00000040), ref: 007F037C
WriteProcessMemory.KERNELBASE(000000F8,00000000,?,?,00000000,?), ref: 007F03D4
WriteProcessMemory.KERNELBASE(000000F8,00400000,?,?,00000000,?,00000028), ref: 007F041F
WriteProcessMemory.KERNELBASE(000000F8,?,?,00000004,00000000), ref: 007F045D
Wow64SetThreadContext.KERNEL32(000000F4,00BD0000), ref: 007F0499
ResumeThread.KERNELBASE(000000F4), ref: 007F04A8

Strings

ReadProcessMemory, xrefs: 007F027A
CreateProcessA, xrefs: 007F0241
TerminateProcess, xrefs: 007F038B
GetP, xrefs: 007F020F
ResumeThread, xrefs: 007F02C9
WriteProcessMemory, xrefs: 007F02A0
SetThreadContext, xrefs: 007F02B3
VirtualAllocEx, xrefs: 007F028D
aryA, xrefs: 007F01D3
Load, xrefs: 007F01CB
GetThreadContext, xrefs: 007F0267
VirtualAlloc, xrefs: 007F0254
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 007F02FB
ress, xrefs: 007F0217

Memory Dump Source

Source File: 00000000.00000002.2189758207.00000000007F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_MqN5lD3LGo.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: c3292326410d98d99da4159f2e3343151b0f0e2a3e7f144517251735dfe2070f
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 0DB1D77664024AAFDB60CF68CC80BDA77A5FF88714F158524EA0CEB341D774FA518B94

Function 000D75D0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OffsetRect.USER32(00000000,00000000,00000000), ref: 000D7718
Polyline.GDI32(00000000,00000000,00000000), ref: 000D7739

Strings

size of vector, xrefs: 000D7645
regwgrrwr, xrefs: 000D76A3
dsdsww, xrefs: 000D7630

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: OffsetPolylineRect
String ID: dsdsww$regwgrrwr$size of vector
API String ID: 1418762327-435021585
Opcode ID: d7f1ea7a8883ad3bb1e1dd592cd213499679fc4eaa8f1d32e12d3a93d022424f
Instruction ID: a2c65cb317d8c251195285abc80441497651885895c671133e733043bb59750f
Opcode Fuzzy Hash: d7f1ea7a8883ad3bb1e1dd592cd213499679fc4eaa8f1d32e12d3a93d022424f
Instruction Fuzzy Hash: CC71E0712493809FD314EF28D859BAFBBE0AF84308F58096EF59987392D779D504CB62

Function 000D7AB0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 122
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,000D7C30,00000000,00000000,00000000), ref: 000D7C1F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 000D7C28

Strings

4, xrefs: 000D7B5F
Earth, xrefs: 000D7B12
Own head, xrefs: 000D7AF2

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID: 4$Earth$Own head
API String ID: 1891408510-3926490352
Opcode ID: 384e79e13365fcca30e7663401413bfbec04b194c32b65f7d4d8567de85a4bae
Instruction ID: 45d2245cc8cf003da5e42d62d03c6d9e8c9e3c0fcf823b8407bb5d046995fa78
Opcode Fuzzy Hash: 384e79e13365fcca30e7663401413bfbec04b194c32b65f7d4d8567de85a4bae
Instruction Fuzzy Hash: 4A417F316043405BCB10AF388C46BDFB7D1AF85714F648A5EF5989B287E734DA408762

Function 000D7D50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE(00000000,0000001F), ref: 000D7D8A

Strings

Illkjmuueghu %d, xrefs: 000D7D7D

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ConsoleFree
String ID: Illkjmuueghu %d
API String ID: 771614528-1805681028
Opcode ID: fa90d7689816ab3cce768f16906b4963f7738cdc3b725875a676c74bfdd1a516
Instruction ID: ef1cbc889eb3b6ab99555257623b2b7ced6030998416906ab199da1a2a5855e2
Opcode Fuzzy Hash: fa90d7689816ab3cce768f16906b4963f7738cdc3b725875a676c74bfdd1a516
Instruction Fuzzy Hash: BD01DB75A04704EBDB109B65DC06B9ABBF8EB04720F000627FE18D63C2FB76950046B5

Function 000CA2F4 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C9A3E: GetConsoleOutputCP.KERNEL32(C825D32E,00000000,00000000,00000000), ref: 000C9AA1

WriteFile.KERNEL32(?,00000000,00000000,000C1810,00000000,00000000,00000000,00000000,00000000,?,000C1810,00000000,?,000E3088,00000010,00000000), ref: 000CA45D
GetLastError.KERNEL32(?,000C1810,00000000,?,000E3088,00000010,00000000,00000000,00000000,00000000,00000000), ref: 000CA467

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: abcbccb0ebc976195f0976642ae6d743b863197e3a3f15a5e1ef002a977a88f8
Instruction ID: d4e3d7d920431d110ecf5b5c7cb7d9b3cd4b68da7d13628d5e134c635914685a
Opcode Fuzzy Hash: abcbccb0ebc976195f0976642ae6d743b863197e3a3f15a5e1ef002a977a88f8
Instruction Fuzzy Hash: 28618171A0424DAFDF15CFA8C848FEEBBB9AF4A318F144059F800A7252D375DA45CB62

Function 000C9EF6 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,000CA443,?,00000000,00000000,00000000,00000000,00000000), ref: 000C9F92
GetLastError.KERNEL32(?,000CA443,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,000C1810,00000000,?,000E3088,00000010), ref: 000C9FB8

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: eb91084312b2759bfc3392693126dbeb543b5ffe228dfef7d37ef6cb147d1cc0
Instruction ID: a0946d4cd1e0b5dc285fcf30274e52525d8fe75bc2f3cb7c6e228367e798fbde
Opcode Fuzzy Hash: eb91084312b2759bfc3392693126dbeb543b5ffe228dfef7d37ef6cb147d1cc0
Instruction Fuzzy Hash: 32217135A00219DBCF15CF29DC88AEDB7B9EF49305F1484AEE90AD7211D630DE86CB64

Function 000C74F3 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 000C753F
GetFileType.KERNELBASE(00000000), ref: 000C7551

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 21b5db10e3b02a33544274b6ebd447bcda6b4a0069af77dd87e13b102b090e16
Instruction ID: 87aceb4f5c7a179c3134923c77da4a1ea6d753b085d6c8cef5902c18bfd3cce1
Opcode Fuzzy Hash: 21b5db10e3b02a33544274b6ebd447bcda6b4a0069af77dd87e13b102b090e16
Instruction Fuzzy Hash: 3111A27150CB418AC7744B3E9C88F2E6AD4A75A370B380B1ED5BE861F1C6B0D986DA51

Function 000C663B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,000CE6B3,?,00000000,?,?,000CE954,?,00000007,?,?,000CEE4D,?,?), ref: 000C6651
GetLastError.KERNEL32(?,?,000CE6B3,?,00000000,?,?,000CE954,?,00000007,?,?,000CEE4D,?,?), ref: 000C665C

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: bfb1ae529354327127decadf397b5b007aebf538174ce13465289b9a19d5c407
Instruction ID: b74becf79768a2c995cb0a06ccbe938a1ab54e5373237560b4049e729ebd2ed5
Opcode Fuzzy Hash: bfb1ae529354327127decadf397b5b007aebf538174ce13465289b9a19d5c407
Instruction Fuzzy Hash: 06E08C32100204ABDB212FA0FC08F9E3BA8AB00759F04406AFA0C964A1CA3589D1CBA8

Function 000B8522 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c546512051b9939892528b7729b8b3441245e0164141ba3acf388da5f28dfac
Instruction ID: 63147693314d5fb19fc1a7cc15542ecadb3c0cddf83227c598dd148100554101
Opcode Fuzzy Hash: 9c546512051b9939892528b7729b8b3441245e0164141ba3acf388da5f28dfac
Instruction Fuzzy Hash: 4631633290151AAFCB64DF68C8848EEB7FDBF19310B14916AE501A36A1DB31E944CBA0

Function 000D7C30 Relevance: 1.3, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040), ref: 000D7CC0

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9db7ea8073a89437822192aa8e7580b862d14fb887df84d2e965d7beea381515
Instruction ID: 8963bd0fb0f7eceed6856e16b9024aca3813676e3efede9bf586d600f2700db4
Opcode Fuzzy Hash: 9db7ea8073a89437822192aa8e7580b862d14fb887df84d2e965d7beea381515
Instruction Fuzzy Hash: FE31B571E40748AAD710EF64DC46BEDB7B4AF49300F14425AFA0477283EB746A808775

Non-executed Functions

Function 000D09FC Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1428COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 000D0BE0

Strings

1#QNAN, xrefs: 000D0B0F
1#IND, xrefs: 000D0B01
1#INF, xrefs: 000D0B32
1#SNAN, xrefs: 000D0B08

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: df08674e1e9282235e40f877abafb43c6350b0c48ede6aca0e914587a4cd3c80
Instruction ID: 9c348bcd0fd6d49d2e97418ef6cf5162576f887e839b71eaa9fa175e7661a1bc
Opcode Fuzzy Hash: df08674e1e9282235e40f877abafb43c6350b0c48ede6aca0e914587a4cd3c80
Instruction Fuzzy Hash: ADD20571E082299FDB65CE28DD407EAB7B5EB48305F1445EBD80DE7240EB78AE818F51

Function 000CFE5E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,000D017C,00000002,00000000,?,?,?,000D017C,?,00000000), ref: 000CFEF7
GetLocaleInfoW.KERNEL32(?,20001004,000D017C,00000002,00000000,?,?,?,000D017C,?,00000000), ref: 000CFF20
GetACP.KERNEL32(?,?,000D017C,?,00000000), ref: 000CFF35

Strings

ACP, xrefs: 000CFE7C
OCP, xrefs: 000CFEB2

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2d3aa4cb86d034aaef4619356b30863209df72b7c2cdcb5201125391ef387411
Instruction ID: a8a85e06f7edfc8147118eb81e764d698179efeffdb4f63732f5e4ee8cacbe59
Opcode Fuzzy Hash: 2d3aa4cb86d034aaef4619356b30863209df72b7c2cdcb5201125391ef387411
Instruction Fuzzy Hash: 41219222600102A6E7748F24C905FBF73E7EF51B50B56847CE906D7122EB32DD42D351

Function 000D0033 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000C6350: GetLastError.KERNEL32(?,00000008,000C694F), ref: 000C6354
Part of subcall function 000C6350: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 000C63F6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 000D013F
IsValidCodePage.KERNEL32(00000000), ref: 000D0188
IsValidLocale.KERNEL32(?,00000001), ref: 000D0197
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 000D01DF
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 000D01FE

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 6434d90fe7aa953ddaf033c67c4726ce15b0557fc11f652efad01a8f4021973b
Instruction ID: 0655cd603e50caeae5577117eaf32d48fce5405616cd8b9cea2d7818c21d3436
Opcode Fuzzy Hash: 6434d90fe7aa953ddaf033c67c4726ce15b0557fc11f652efad01a8f4021973b
Instruction Fuzzy Hash: B8516E75A0030AABEB50DFA5DC45FBE77F8EF44700F04442AE919EB291DB709A458B71

Function 000CF6CF Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000C6350: GetLastError.KERNEL32(?,00000008,000C694F), ref: 000C6354
Part of subcall function 000C6350: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 000C63F6

GetACP.KERNEL32(?,?,?,?,?,?,000C4EF0,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 000CF790
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,000C4EF0,?,?,?,00000055,?,-00000050,?,?), ref: 000CF7BB
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 000CF91E

Strings

utf8, xrefs: 000CF88D

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 0155f88504d9863d4cb85fb8fdd27c71360c1726711d6d7baf062dd3b8bf5e94
Instruction ID: bae90ac46386bb425d8223d9dd7dcdadd588f0f6f72992532b264f19941b47b4
Opcode Fuzzy Hash: 0155f88504d9863d4cb85fb8fdd27c71360c1726711d6d7baf062dd3b8bf5e94
Instruction Fuzzy Hash: E471C632604603ABEB24AB74CC46FBE73EAEF44700F14457EFA05D7182EA74D9458762

Function 000C7782 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 000C780F

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c6eacb7953bbba39f711a7e71ff673c16b34cf1b21946f2f6922c52105c3e655
Instruction ID: d0b1e536c15fa4f511097d42d2ff841ca6cb42ee0e79f924542fd6ee17ff6ebc
Opcode Fuzzy Hash: c6eacb7953bbba39f711a7e71ff673c16b34cf1b21946f2f6922c52105c3e655
Instruction Fuzzy Hash: 13B11732A082459FDB15CF68C881FFEBBE5EF95314F14816EE909AB242D6349D05CFA1

Function 000B9EEF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 000B9EFB
IsDebuggerPresent.KERNEL32 ref: 000B9FC7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000B9FE0
UnhandledExceptionFilter.KERNEL32(?), ref: 000B9FEA

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 72601f5a6c477b33b9c5e8b3d7f91af4df1404c211073dbcb33a84bacc407974
Instruction ID: ff5fcbff2fd73e191862d301c2936a4001b5151b6887e4daec2c7e73f1cd864c
Opcode Fuzzy Hash: 72601f5a6c477b33b9c5e8b3d7f91af4df1404c211073dbcb33a84bacc407974
Instruction Fuzzy Hash: 7E31F575D1131C9BDF60EFA4D889BCDBBB8AF08300F1041AAE40DAB250EB759A858F55

Function 000CFAE2 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000C6350: GetLastError.KERNEL32(?,00000008,000C694F), ref: 000C6354
Part of subcall function 000C6350: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 000C63F6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000CFB36
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000CFB80
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000CFC46

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 7c4166dd00803e3555625b6d9337fa2a6b4394f2a5fd7ddada74dbbd9c9c4a85
Instruction ID: 003603f0b4850630a0fb6a82295f074af30314e8000774f3d801ef3baa1f31be
Opcode Fuzzy Hash: 7c4166dd00803e3555625b6d9337fa2a6b4394f2a5fd7ddada74dbbd9c9c4a85
Instruction Fuzzy Hash: 41617F716002079BEB689F28D982FBE77EAEF04314F20807EED05C6586EB34D991CB51

Function 000BDED3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 000BDFCB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 000BDFD5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000001), ref: 000BDFE2

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 07ed5bda2ea875785fecfe6efd552952e5eb1b1908d617ef4e4d4e7a0cc9740d
Instruction ID: 67a75ed54d7ed144727059a14239da947703d0c4837ad47716af2bcce02e8fc2
Opcode Fuzzy Hash: 07ed5bda2ea875785fecfe6efd552952e5eb1b1908d617ef4e4d4e7a0cc9740d
Instruction Fuzzy Hash: 5F31C174902229ABCB61DF24D888BD9BBB8BF08310F5041EAE41CA6251EB709B858F55

Function 000C2C20 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2692ef2465f7c715e646551b9f84a9b96eae746530df55d46b013212d61f18f7
Instruction ID: 596021a3d8fa3a84c42fc0f009ab32cc13b170ea14f3fbb33c9f8194a9429779
Opcode Fuzzy Hash: 2692ef2465f7c715e646551b9f84a9b96eae746530df55d46b013212d61f18f7
Instruction Fuzzy Hash: A4F11B71E002199FDB14CFA8C894BADB7F1EF88314F25826DE815AB785D731AE41CB90

Function 000CBC92 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,000CBC8D,?,?,00000008,?,?,000D4202,00000000), ref: 000CBEBF

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 54e5c190ad7ea94b1658875c02c91b858a525bc0e0fadb0c74e88cc04ffe6a4b
Instruction ID: 892582661bb2859b34d8e675ee643e22a86ea4491b84b2865f0b72c3d632adff
Opcode Fuzzy Hash: 54e5c190ad7ea94b1658875c02c91b858a525bc0e0fadb0c74e88cc04ffe6a4b
Instruction Fuzzy Hash: 31B118316106089FDB64CF28C486FA97BE0FF45364F25865CE99ACF2A1C735E992CB40

Function 000B9C95 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 000B9CAB

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 74072c1f3f17d076d3e513c7d1358f09a269eabb0505bc348e562d5b4176dda2
Instruction ID: 43c5d1703d47ed4b45f5873e3c3557ea4a3be59805624528b4f46644ac275313
Opcode Fuzzy Hash: 74072c1f3f17d076d3e513c7d1358f09a269eabb0505bc348e562d5b4176dda2
Instruction Fuzzy Hash: 3F5181B1A006098FDB58CF5AE8897AEBBF4FB54310F24842AD519EB361D774D944CF50

Function 000CC8CD Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7157ab50b705600cea3a1206a82191ed5efd9262240fa0126aaf4e6d010e85bc
Instruction ID: 6ee60d57fc46b36ba53d788594e5f66c051948447e037d79c17306e2721e1cf7
Opcode Fuzzy Hash: 7157ab50b705600cea3a1206a82191ed5efd9262240fa0126aaf4e6d010e85bc
Instruction Fuzzy Hash: 2541A0B5805219AEDB60DF69CC89EEEBBB8EF45304F1442DDE40DD3201DA359E858F20

Function 000CFD35 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 000C6350: GetLastError.KERNEL32(?,00000008,000C694F), ref: 000C6354
Part of subcall function 000C6350: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 000C63F6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000CFD89

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0b7f843a6b1a88e81c7aa0a7e7f2ab3f2616fa19c5c83b9deef15e69b5d7c895
Instruction ID: aa368396bdd62d2667706292b7028737759363ccfe08765afded01cfcdd9f670
Opcode Fuzzy Hash: 0b7f843a6b1a88e81c7aa0a7e7f2ab3f2616fa19c5c83b9deef15e69b5d7c895
Instruction Fuzzy Hash: 78218072611207ABEB289F25DC42FBE73AAEF44314B10407EFD06DA142EB75ED448B52

Function 000BFF04 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 000C008E

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ae54fa01aa5c856c6d46355344a0445a233b50918a082372f76ae9a58ece7c05
Instruction ID: 8d91ba87978e37b6c564f8bc707d5c09d8e020ab3abe0621a9b79a5641d60688
Opcode Fuzzy Hash: ae54fa01aa5c856c6d46355344a0445a233b50918a082372f76ae9a58ece7c05
Instruction Fuzzy Hash: 46B1C07090060BCBCB788F68C995FFEB7E5AF06304F24462ED996D7292C735A942CB51

Function 000CF9BC Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000C6350: GetLastError.KERNEL32(?,00000008,000C694F), ref: 000C6354
Part of subcall function 000C6350: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 000C63F6

EnumSystemLocalesW.KERNEL32(000CFAE2,00000001,00000000,?,-00000050,?,000D0113,00000000,?,?,?,00000055,?), ref: 000CFA2E

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d81d5758cc4a164c26e85630ca511e28a1b245aeb7126dc988fe4c9457bb8357
Instruction ID: 56ffb361546bf227dbdf3fa7cd960f12bbf699df31f819a2128ec00ab608272e
Opcode Fuzzy Hash: d81d5758cc4a164c26e85630ca511e28a1b245aeb7126dc988fe4c9457bb8357
Instruction Fuzzy Hash: 2911C6766007029FDB189F398891BBEB7D2FF84358B14443DE98B87B41E7756942C740

Function 000CFF64 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 000C6350: GetLastError.KERNEL32(?,00000008,000C694F), ref: 000C6354
Part of subcall function 000C6350: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 000C63F6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,000CFDDF,00000000,00000000,?), ref: 000CFF90

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b7b7f0af24dd6dc5d8abe6c594294bd72b5f6f45f5fb38b916da4f50f50e564a
Instruction ID: 7ead61be412cde94c214da124fba48551da38e609de3ea9daf42f690eb5265da
Opcode Fuzzy Hash: b7b7f0af24dd6dc5d8abe6c594294bd72b5f6f45f5fb38b916da4f50f50e564a
Instruction Fuzzy Hash: B6F086366001276BDB3897258805FBE77A9DF41754F15443DED16A3180DB74EE42C691

Function 000CF8CA Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 000C6350: GetLastError.KERNEL32(?,00000008,000C694F), ref: 000C6354
Part of subcall function 000C6350: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 000C63F6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 000CF91E

Strings

utf8, xrefs: 000CF88D

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 5750c0e2a31426a20dcba89d7af8bc2ffb51477fca5b38341ed20b4c465a02ef
Instruction ID: f578bf2728d0d5adbba2edce7d8c3f1ab270e615bdec9951151983901781fd79
Opcode Fuzzy Hash: 5750c0e2a31426a20dcba89d7af8bc2ffb51477fca5b38341ed20b4c465a02ef
Instruction Fuzzy Hash: 2FF0A472601105ABDB14AB34DC4AFFE33E9DB45710F15007EB607D7242DA79AD058790

Function 000CFA57 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000C6350: GetLastError.KERNEL32(?,00000008,000C694F), ref: 000C6354
Part of subcall function 000C6350: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 000C63F6

EnumSystemLocalesW.KERNEL32(000CFD35,00000001,?,?,-00000050,?,000D00D7,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 000CFAA1

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c4d94c8093f40ca84d4800e9bc8eea9ed1c2a662c6f6ed3ae0f54045a4799e7f
Instruction ID: ea2972be8e5593928223650ec3ec465ed3aa0a2a0917b5d930b23e1eda8ba466
Opcode Fuzzy Hash: c4d94c8093f40ca84d4800e9bc8eea9ed1c2a662c6f6ed3ae0f54045a4799e7f
Instruction Fuzzy Hash: 5BF0C2762003065FDB249F359881F7EBBE6EB80368F05443DFA4A4B691CAB19C028651

Function 000C6BD5 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000C0CB9: EnterCriticalSection.KERNEL32(?,?,000C369F,00000000,000E31C8,0000000C,000C3666,?,?,000C6B9E,?,?,000C64EE,00000001,00000364,?), ref: 000C0CC8

EnumSystemLocalesW.KERNEL32(000C6BC8,00000001,000E33B8,0000000C,000C6FF7,00000000), ref: 000C6C0D

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: c98139a302345b402c6daea0c7df55b2a73cf2fb0c3ac51240c10443dce60520
Instruction ID: b0621a7b6df3359b380ef7251137bbbe548230748d1bd24a9f95e74e716ee24d
Opcode Fuzzy Hash: c98139a302345b402c6daea0c7df55b2a73cf2fb0c3ac51240c10443dce60520
Instruction Fuzzy Hash: 8DF03C32A50304EFD710EF58E846BAC77F0EB45720F10411AF9149B2A1CB754A84CF81

Function 000CF971 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000C6350: GetLastError.KERNEL32(?,00000008,000C694F), ref: 000C6354
Part of subcall function 000C6350: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 000C63F6

EnumSystemLocalesW.KERNEL32(000CF8CA,00000001,?,?,?,000D0135,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 000CF9A8

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7a2588841d2b7a0d1c92ab6d427e3a88e43c171c572036abeb817c657054d49f
Instruction ID: a5dc8e562af15098efb5c601f0df22790ee0e7f2e0fac435ae3de9e75f6972f0
Opcode Fuzzy Hash: 7a2588841d2b7a0d1c92ab6d427e3a88e43c171c572036abeb817c657054d49f
Instruction Fuzzy Hash: ACF0553A30020667CF149F35D815F7EBFD5EFC2750B0A406DEA0A8B280C6369843C7A0

Function 000C70FB Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,000C5A56,?,20001004,00000000,00000002,?,?,000C5058), ref: 000C712F

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: fea8e22b1ef4220aedc2bfef063ed56e23f14b7ad279b602e195f4b104658576
Instruction ID: 9195330b285c642ed5aaf2b51b5968c2865467c2877a93e82c1466ae530fc19b
Opcode Fuzzy Hash: fea8e22b1ef4220aedc2bfef063ed56e23f14b7ad279b602e195f4b104658576
Instruction Fuzzy Hash: 98E04F75505218BBCF122F61DC09FEE7F69EF44761F088015FD0965161CB368D21ABE0

Function 000BA04B Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A057,000B9916), ref: 000BA050

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 35878dd40727449e780769cb58a5d95d20d905301b1a36c01a1a6aed5738fa0c
Instruction ID: e2b217b683b32c47de295e4778440a7c7f5cd6e2f1b506d9dfa518010af5d0b2
Opcode Fuzzy Hash: 35878dd40727449e780769cb58a5d95d20d905301b1a36c01a1a6aed5738fa0c
Instruction Fuzzy Hash:

Function 000CDAB5 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000CDAB5

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 137b2bac0c190b53edbe2a07ca99991f187fb844152c8597f6fa705cd086f761
Instruction ID: 88fd163e3a5076d7ab9a6bc808beebb0a26f2a63f673f316d68dfbf7e35d7526
Opcode Fuzzy Hash: 137b2bac0c190b53edbe2a07ca99991f187fb844152c8597f6fa705cd086f761
Instruction Fuzzy Hash: DFA00470541701CF57404F357D4D74D3FD557455D17154155D40DC5170DF3445D45F55

Function 000D0DD4 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be8c9aeac7cf8cb0888785fe6c153c98cd036d3724c06c4a810145b4a55ffb7
Instruction ID: df407817308755c269c2cfabb66c4bfd47dfc7102d762e1c6c296d97ce7fbb9d
Opcode Fuzzy Hash: 7be8c9aeac7cf8cb0888785fe6c153c98cd036d3724c06c4a810145b4a55ffb7
Instruction Fuzzy Hash: 32D10871E082289FDB65DF28DC40BE9B7B6EB85351F1441EBD84DA7240DB78AE818F50

Function 000C85C5 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913097a76a2aa3f9716249509b8196a2f4b16ccbac58342a843d0fa289859693
Instruction ID: 20b0048b21142fda5f7337dfa9e794a38b1b1d941f04f2dcdc774a54a94e8930
Opcode Fuzzy Hash: 913097a76a2aa3f9716249509b8196a2f4b16ccbac58342a843d0fa289859693
Instruction Fuzzy Hash: 2EE08C32A11228EBCB25DBCCC904E8EF3ECEB44B00B11409AF501D3101C6B1DE00C7D4

Function 000C3A8C Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2e9a7be51ed71085fad7bcd48806db607c783d97970506649736f56e1902a2
Instruction ID: 648754a034d292c46a9da4cd4860b1ab6b1cbcc8e7c450697a324c88637600aa
Opcode Fuzzy Hash: ad2e9a7be51ed71085fad7bcd48806db607c783d97970506649736f56e1902a2
Instruction Fuzzy Hash: CCC08C35020E0046CE298B1082B1BAC33F4B3D5782F80848CC4430B682CA1E9D83EF02

Function 000B2090 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000B20A5
std::_Lockit::_Lockit.LIBCPMT ref: 000B20BF
std::_Lockit::~_Lockit.LIBCPMT ref: 000B20E0
std::_Lockit::~_Lockit.LIBCPMT ref: 000B2138
std::_Lockit::_Lockit.LIBCPMT ref: 000B217D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000B21CE
__Getctype.LIBCPMT ref: 000B21E5
std::_Facet_Register.LIBCPMT ref: 000B220F
std::_Lockit::~_Lockit.LIBCPMT ref: 000B2228

Strings

bad locale name, xrefs: 000B2237

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 2236780835-1405518554
Opcode ID: 58e47e267114976112245cac9d0c7ad32ea6449fa04feb4cc150232968364659
Instruction ID: 421ea30945693e99e23e7b2ee4ce03e8616713a1488b1ae677c5f9ccec59fae0
Opcode Fuzzy Hash: 58e47e267114976112245cac9d0c7ad32ea6449fa04feb4cc150232968364659
Instruction Fuzzy Hash: 2541C0715043408FC361DF58D884BDBB7E0AFA4B10F15495DF9889B362DB36E946CBA2

Function 000B944A Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 000B9450
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 000B945E
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 000B946F
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 000B9480

Strings

kernel32.dll, xrefs: 000B944B
GetSystemTimePreciseAsFileTime, xrefs: 000B9464
GetTempPath2W, xrefs: 000B9475
GetCurrentPackageId, xrefs: 000B9458

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 8e8e52ce2c519f0980c150180e0a8306c3a90a217322fe75d0c2cd32c7251273
Instruction ID: 5f9275008e14a5a1573ca601831e52da111d5c33ce59b96fa1ecc918467b5e34
Opcode Fuzzy Hash: 8e8e52ce2c519f0980c150180e0a8306c3a90a217322fe75d0c2cd32c7251273
Instruction Fuzzy Hash: 00E08C35992710ABA381AFB4BC0C8857FA8EB047123048067FB0AC2325DF7800448FB0

Function 000BCE32 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 000BCF51
___TypeMatch.LIBVCRUNTIME ref: 000BD05F
_UnwindNestedFrames.LIBCMT ref: 000BD1B1
CallUnexpected.LIBVCRUNTIME ref: 000BD1CC

Strings

csm, xrefs: 000BCEDC
csm, xrefs: 000BCE6F
csm, xrefs: 000BCF88

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: a104103d313a3a9b19f7ba72e911f773d33dcb5a1f822e1183062c0004d83dbb
Instruction ID: 4703ed5147095a59be42c5933a9a465706e6e436d86a8d0831069217ccef219f
Opcode Fuzzy Hash: a104103d313a3a9b19f7ba72e911f773d33dcb5a1f822e1183062c0004d83dbb
Instruction Fuzzy Hash: 1BB14871900209EFDF29DFA8C9819EEBBB6BF14310F14456AE8156B212E731DE51CB92

Function 000CB294 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 000CB50D

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: ca52d48533a7c6e658e772cf5124e9f7e6a8b2b34d1a5937c3ca0c0e69c1fbb0
Instruction ID: 8a3da9e237ebd9dbfe896627d9cc3f2ea07431dfff71860a580690aedacfe556
Opcode Fuzzy Hash: ca52d48533a7c6e658e772cf5124e9f7e6a8b2b34d1a5937c3ca0c0e69c1fbb0
Instruction Fuzzy Hash: 82B1EFB0A04249AFDB15DFA8C882FAEBBF5BF55314F14815DE404AB292C7709D82CF60

Function 000D4514 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00BF5448,00BF5448,?,7FFFFFFF,?,000D47E4,00BF5448,00BF5448,?,00BF5448,?,?,?,?,00BF5448,?), ref: 000D45BA
__alloca_probe_16.LIBCMT ref: 000D4675
__alloca_probe_16.LIBCMT ref: 000D4704
__freea.LIBCMT ref: 000D474F
__freea.LIBCMT ref: 000D4755
__freea.LIBCMT ref: 000D478B
__freea.LIBCMT ref: 000D4791
__freea.LIBCMT ref: 000D47A1

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 969d1fc1bab07b5b7af2065ec4ec3e6826ec1a9cf91ba716393f450d79ad7847
Instruction ID: b8dcdb4c8df5df1e6c6964278cbd2246e55fa78c0e2d712532e4e18b3eec1782
Opcode Fuzzy Hash: 969d1fc1bab07b5b7af2065ec4ec3e6826ec1a9cf91ba716393f450d79ad7847
Instruction Fuzzy Hash: E271B372904745ABDF209F949C82FEE7BE99F4A310F29005AE909A7382D735DC008BB1

Function 000B9120 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 000B9169
__alloca_probe_16.LIBCMT ref: 000B9195
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 000B91D4
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000B91F1
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 000B9230
__alloca_probe_16.LIBCMT ref: 000B924D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000B928F
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 000B92B2

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 3d5454b2bd22a26e18fb437a16790985cab574997f061a8356a445103f62939c
Instruction ID: d5dd9f37c83471b7d7eb25458c0e356a287f42144aef31a7833e90b98a883e48
Opcode Fuzzy Hash: 3d5454b2bd22a26e18fb437a16790985cab574997f061a8356a445103f62939c
Instruction Fuzzy Hash: DA518B7290020ABBEF209FA4CC45FEE7BB9EF45750F148429FE05A6160DB359D10DBA0

Function 000BC900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 000BC937
___except_validate_context_record.LIBVCRUNTIME ref: 000BC93F
_ValidateLocalCookies.LIBCMT ref: 000BC9C8
__IsNonwritableInCurrentImage.LIBCMT ref: 000BC9F3
_ValidateLocalCookies.LIBCMT ref: 000BCA48

Strings

csm, xrefs: 000BC9DD

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9665e11ba4669e1c915ec537962e44bfa148afccb358633ba2e7941e9cbf46ac
Instruction ID: 0af9b7725110ce8d7dac8139e065562be0a332af969a51f344ef332bee0313b9
Opcode Fuzzy Hash: 9665e11ba4669e1c915ec537962e44bfa148afccb358633ba2e7941e9cbf46ac
Instruction Fuzzy Hash: 75419334A00209EBEF10DF68C885EEEBBF5EF45314F148066E819AB392D771DA15CB91

Function 000C6D9E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,C825D32E,?,000C6EAB,?,?,?,00000000), ref: 000C6E5F

Strings

api-ms-, xrefs: 000C6DF5
ext-ms-, xrefs: 000C6E09

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 33f5f87b516f7d0c55dc889cc554ed8271f7c58e2b235dfcef66df6e9f87a679
Instruction ID: d3d2175b59b92cbb65adfea59377c77af7fe653fa073334aa1d785b654c93720
Opcode Fuzzy Hash: 33f5f87b516f7d0c55dc889cc554ed8271f7c58e2b235dfcef66df6e9f87a679
Instruction Fuzzy Hash: ED21D835A01220A7DB719B65DC44F5F3BA9EB41760B25412BFD06AB291DB31ED00C6F0

Function 000BCAC4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000BCABB,000BB083,000B6E89,C825D32E,?,?,?,00000000,000D5C52,000000FF,?,000B57DE,?,?), ref: 000BCAD2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000BCAE0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000BCAF9
SetLastError.KERNEL32(00000000,?,000BCABB,000BB083,000B6E89,C825D32E,?,?,?,00000000,000D5C52,000000FF,?,000B57DE,?,?), ref: 000BCB4B

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 90435c8f257e5040fedf472c2a1220faaee58777d8544c7ebf5ba590081f8a73
Instruction ID: 82fbd47bbc476f6b886c25d7266c2e1a4fdecd372c064da9f0d7c22e3f4bfa14
Opcode Fuzzy Hash: 90435c8f257e5040fedf472c2a1220faaee58777d8544c7ebf5ba590081f8a73
Instruction Fuzzy Hash: 9801283222DA126EF76827757C8EDEF6B84EB01731B24423AF515601E3EF510C009694

Function 000C3AAE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C825D32E,?,?,00000000,000D5E79,000000FF,?,000C3A3E,?,?,000C3A12,00000016), ref: 000C3AE3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000C3AF5
FreeLibrary.KERNEL32(00000000,?,00000000,000D5E79,000000FF,?,000C3A3E,?,?,000C3A12,00000016), ref: 000C3B17

Strings

CorExitProcess, xrefs: 000C3AED
mscoree.dll, xrefs: 000C3ADC

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 397ccd1b2f244dce51774e319f2a70d89933f38946985361f3346217d0ff87a3
Instruction ID: ada0283dfab0902b44b3d228457c9eeb3fbddeea0a505c3abf85e9b64f550b78
Opcode Fuzzy Hash: 397ccd1b2f244dce51774e319f2a70d89933f38946985361f3346217d0ff87a3
Instruction Fuzzy Hash: A601A731A14A19EFDB519B50DC09FAEBBB8FB04B10F00452AFD12A2290DB749904CB60

Function 000C9475 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000C94FC
__alloca_probe_16.LIBCMT ref: 000C95BD
__freea.LIBCMT ref: 000C9624

Part of subcall function 000C762F: HeapAlloc.KERNEL32(00000000,?,?,?,000B94FE,?,?,000B193D,?,?,000D7C5E,?,?), ref: 000C7661

__freea.LIBCMT ref: 000C9639
__freea.LIBCMT ref: 000C9649

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: fb9f8ec860d46d36df379d99f17f1cf8353bab07a205ea6d5e9b94a52c395c04
Instruction ID: 3bb8d98a155f385b590938bf581487d41a2637d90faa6b9bdb4df91cf80a32dd
Opcode Fuzzy Hash: fb9f8ec860d46d36df379d99f17f1cf8353bab07a205ea6d5e9b94a52c395c04
Instruction Fuzzy Hash: D2519E72A01606AFEB659FA4DC89FFF3AE9EB44350F15016CFD08D6291EA71CD1097A0

Function 000B7072 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000B7086
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,?,000B53D4,?,?,?,?,?), ref: 000B70A5
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,?,000B53D4,?,?,?,?,?), ref: 000B70D3
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,?,000B53D4,?,?,?,?,?), ref: 000B712E
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,?,000B53D4,?,?,?,?,?), ref: 000B7145

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 428592d1929d3a21fbfd7b57b40f3481a39326edbd6c34afb0a0ae6aa53a22cb
Instruction ID: 9d616554981693d5e4ee4e64d4bc434bce9efcc77dced6dfe3a541d3150bb0cb
Opcode Fuzzy Hash: 428592d1929d3a21fbfd7b57b40f3481a39326edbd6c34afb0a0ae6aa53a22cb
Instruction Fuzzy Hash: A4412931A08606DFCB60DF6DC9859EAB7F9FF88350B10492AE54AD7640E730E985CB61

Function 000B7C88 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000B7C8F
std::_Lockit::_Lockit.LIBCPMT ref: 000B7C99

Part of subcall function 000B33F0: std::_Lockit::_Lockit.LIBCPMT ref: 000B33FF
Part of subcall function 000B33F0: std::_Lockit::~_Lockit.LIBCPMT ref: 000B341A

codecvt.LIBCPMT ref: 000B7CD3
std::_Facet_Register.LIBCPMT ref: 000B7CEA
std::_Lockit::~_Lockit.LIBCPMT ref: 000B7D0A

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 35ea9ab8da9f26e718fdcde46401f43d1c1211693b442e7ca5468c78f145558d
Instruction ID: 364ad3be9f55ea81ee3c0d27256c5f70a1451f570753cbc0069de4454651350e
Opcode Fuzzy Hash: 35ea9ab8da9f26e718fdcde46401f43d1c1211693b442e7ca5468c78f145558d
Instruction Fuzzy Hash: FE11AF71900215AFCB15EB68D8466EE7BF8EF84720F24050AE809A7382DF74AE01CB91

Function 000B7586 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000B758D
std::_Lockit::_Lockit.LIBCPMT ref: 000B7598
std::_Lockit::~_Lockit.LIBCPMT ref: 000B7606

Part of subcall function 000B76E9: std::locale::_Locimp::_Locimp.LIBCPMT ref: 000B7701

std::locale::_Setgloballocale.LIBCPMT ref: 000B75B3
_Yarn.LIBCPMT ref: 000B75C9

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: db8fc4b7b2c39d9219c9402481d9c6a8c86bb8d01ee0581e8d6dde63088fc46c
Instruction ID: 520342ae85868b56974bc04afb0755f13df55b318f896d457156b5c80c674199
Opcode Fuzzy Hash: db8fc4b7b2c39d9219c9402481d9c6a8c86bb8d01ee0581e8d6dde63088fc46c
Instruction Fuzzy Hash: 45018F75A05611ABD706EB20E8595FD7BB5BFC4740B19400AED0A57382DF38AF42CBE1

Function 000BDBC7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,000BDB78,?,?,00000000,?,?,?,000BDCA2,00000002,FlsGetValue,000DA0D0,FlsGetValue), ref: 000BDBD4
GetLastError.KERNEL32(?,000BDB78,?,?,00000000,?,?,?,000BDCA2,00000002,FlsGetValue,000DA0D0,FlsGetValue,?,?,000BCAE5), ref: 000BDBDE
LoadLibraryExW.KERNEL32(?,00000000,00000000,000E2844,ios_base::failbit set,00000000), ref: 000BDC06

Strings

api-ms-, xrefs: 000BDBEB

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c17fb9004f7b4371656f46653280eec3b8a1e475b18f991e8f6bed09df0dfe32
Instruction ID: fea9a46573ca8952e72f2625f17ae0a82d1d4722977d7c66f74fc8bd79363765
Opcode Fuzzy Hash: c17fb9004f7b4371656f46653280eec3b8a1e475b18f991e8f6bed09df0dfe32
Instruction Fuzzy Hash: FBE01230680209F6FF511B61DD06B597F59AB00B50F108432F90DA80E2EBA6E9549A64

Function 000C9A3E Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(C825D32E,00000000,00000000,00000000), ref: 000C9AA1

Part of subcall function 000CC3CA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,000C961A,?,00000000,-00000008), ref: 000CC476

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 000C9CFC
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 000C9D44
GetLastError.KERNEL32 ref: 000C9DE7

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 241c4d71cb697e7e69c5b1e441c351f4980adc1f4067e942104a489ff4ea2e91
Instruction ID: 8149ba17dff8763773ac62febf87139eb1e6b641793c8fbf23d1b3291159d686
Opcode Fuzzy Hash: 241c4d71cb697e7e69c5b1e441c351f4980adc1f4067e942104a489ff4ea2e91
Instruction Fuzzy Hash: F5D148B5D002589FCB15CFA8D884AEDBBB5FF49310F18852EE856EB352E730A951CB50

Function 000B4740 Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 000B47F6
std::_Throw_Cpp_error.LIBCPMT ref: 000B4801
std::_Throw_Cpp_error.LIBCPMT ref: 000B4905
std::_Throw_Cpp_error.LIBCPMT ref: 000B4910

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 5aa551c2e007ad71110fac8a0eca4de03544fd426d23c165351cf009ee830d3b
Instruction ID: 569b06fce45e0628a825d79030c3f4fd27d5a1f70b753bc0f3e23a5f790065a0
Opcode Fuzzy Hash: 5aa551c2e007ad71110fac8a0eca4de03544fd426d23c165351cf009ee830d3b
Instruction Fuzzy Hash: CE5101718083806BD725BB7498467DABBE89F51300F040D6DF99A12693DBB1E60CC7A3

Function 000BCBDB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 000BCCA2
___AdjustPointer.LIBCMT ref: 000BCCC5
___AdjustPointer.LIBCMT ref: 000BCD61

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 7c9dd6493d377d25b028be2dbbab41bbd17bae535fe16109b6e81f2054247c39
Instruction ID: 7af3571ce33bbe181f7784eafb86ba5c3f17f187bf8e379eee07eca826243205
Opcode Fuzzy Hash: 7c9dd6493d377d25b028be2dbbab41bbd17bae535fe16109b6e81f2054247c39
Instruction Fuzzy Hash: 9A51AD76600606AFFB299F14D841FEA7BA4EF54710F28453DE81A97692E731ED80CB90

Function 000B5B50 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(002782A4,00000000,?,00000000,00000000,?,00000000), ref: 000B5B61
InitOnceComplete.KERNEL32(002782A4,00000000,00000000), ref: 000B5B84

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: InitOnce$BeginCompleteInitialize
String ID:
API String ID: 51270584-0
Opcode ID: d75df0d675b4887a9c39a9199b20fd905fa566d2a31f22deae7e07040912a893
Instruction ID: b46d71823e2290b29cbd66429b08576c6190c12151555ba6734929af410102c7
Opcode Fuzzy Hash: d75df0d675b4887a9c39a9199b20fd905fa566d2a31f22deae7e07040912a893
Instruction Fuzzy Hash: 6531F271A00704EFD710EF64DC06BDAB7A4EF44711F10826AFA19972C2DB31A904CB96

Function 000CC68A Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 000CC3CA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,000C961A,?,00000000,-00000008), ref: 000CC476

GetLastError.KERNEL32 ref: 000CC6EE
__dosmaperr.LIBCMT ref: 000CC6F5
GetLastError.KERNEL32(?,?,?,?), ref: 000CC72F
__dosmaperr.LIBCMT ref: 000CC736

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 67b2cf67d66fe735c8dcacc8c6a488a34642bb67c8549f2fac7f90e3fea3c5ec
Instruction ID: 87a5392f075317718ffd1e3fbd727085ad6515730ae58e12540edb040bbd98b2
Opcode Fuzzy Hash: 67b2cf67d66fe735c8dcacc8c6a488a34642bb67c8549f2fac7f90e3fea3c5ec
Instruction Fuzzy Hash: A6216271604606AFEB64AF65C881FAFB7A9FF043647108A1DF91D97552D730EC409FA0

Function 000C31C4 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053a37a9d1a1356250c21472fc8a780d5149855e5dfcd067ddf705d5c40848bb
Instruction ID: bfee6e9386ffc0f0fdf8913c3baaab30a402489d99e1beffb48ab66556fefb78
Opcode Fuzzy Hash: 053a37a9d1a1356250c21472fc8a780d5149855e5dfcd067ddf705d5c40848bb
Instruction Fuzzy Hash: F4216D72610205AFDF60AF65DC81FAF77A9EF00368710C62DF92597592DB31EE008BA1

Function 000CD620 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000CD628

Part of subcall function 000CC3CA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,000C961A,?,00000000,-00000008), ref: 000CC476

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000CD660
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000CD680

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 936474d25547e5b4261c55cb710b3e4ade798fffac7feba63522d3c4f61a4033
Instruction ID: 0afaedb17bb130d97a537124c526ca09b0c320be6b5e0de73384bc4a4ba4cda0
Opcode Fuzzy Hash: 936474d25547e5b4261c55cb710b3e4ade798fffac7feba63522d3c4f61a4033
Instruction Fuzzy Hash: 0A11C4F65016157F772127769C8AEAF2A9CDF45394710053FF80AD1102FE24DE02D6B4

Function 000D4349 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,000D2B84,00000000,00000001,00000000,00000000,?,000C9E3B,00000000,00000000,00000000), ref: 000D4360
GetLastError.KERNEL32(?,000D2B84,00000000,00000001,00000000,00000000,?,000C9E3B,00000000,00000000,00000000,00000000,00000000,?,000CA3C2,?), ref: 000D436C

Part of subcall function 000D4332: CloseHandle.KERNEL32(FFFFFFFE,000D437C,?,000D2B84,00000000,00000001,00000000,00000000,?,000C9E3B,00000000,00000000,00000000,00000000,00000000), ref: 000D4342

___initconout.LIBCMT ref: 000D437C

Part of subcall function 000D42F4: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,000D4323,000D2B71,00000000,?,000C9E3B,00000000,00000000,00000000,00000000), ref: 000D4307

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,000D2B84,00000000,00000001,00000000,00000000,?,000C9E3B,00000000,00000000,00000000,00000000), ref: 000D4391

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: edd768627acc43b70170f1e53a3ac49e34de397fa69ef123fbdcbcc3540e5d35
Instruction ID: a12eb51c244e96f81e4d65fa7be79caf60e34d543f58d30d3e708040778109a8
Opcode Fuzzy Hash: edd768627acc43b70170f1e53a3ac49e34de397fa69ef123fbdcbcc3540e5d35
Instruction Fuzzy Hash: 9FF0303A001215FBCF221F95EC0899D3F6AFF083A0B448455FE1896230CA328920AFA1

Function 000CECB6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000C663B: RtlFreeHeap.NTDLL(00000000,00000000,?,000CE6B3,?,00000000,?,?,000CE954,?,00000007,?,?,000CEE4D,?,?), ref: 000C6651
Part of subcall function 000C663B: GetLastError.KERNEL32(?,?,000CE6B3,?,00000000,?,?,000CE954,?,00000007,?,?,000CEE4D,?,?), ref: 000C665C

___free_lconv_mon.LIBCMT ref: 000CECFA

Strings

8l', xrefs: 000CEDA2
dk', xrefs: 000CECCC

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ErrorFreeHeapLast___free_lconv_mon
String ID: 8l'$dk'
API String ID: 4068849827-1236948204
Opcode ID: 781fc13a6db4d55f77c60e6ab488858e17f6ccc392b13b516c38a33e52e3c500
Instruction ID: 149103a97d54cb5456d16064c9aaabebf5121e7cca752ce281b3e6d302581ba2
Opcode Fuzzy Hash: 781fc13a6db4d55f77c60e6ab488858e17f6ccc392b13b516c38a33e52e3c500
Instruction Fuzzy Hash: 053128726007419FEB71AB79D945F9E77E8AF10350F24482DE05AD72A2DB35EC81CB24

Function 000BD1D7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 000BD1FC

Strings

RCC, xrefs: 000BD216
MOC, xrefs: 000BD20E

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dc343ac89ed305fd69420ed4fe1fa8d4c9035403d441081402dd497977cc4283
Instruction ID: 99924aae05db2cd89a36b3be4b5360dc937c8cfc0d623769aac1ee328a9db3df
Opcode Fuzzy Hash: dc343ac89ed305fd69420ed4fe1fa8d4c9035403d441081402dd497977cc4283
Instruction Fuzzy Hash: B4417971900249AFCF16DF98CC81AEEBBB5BF48304F18805AF908A7252E335DA50DF51

Function 000B6F4A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000B6FD2
RaiseException.KERNEL32(?,?,?,?,00000000,00000000), ref: 000B6FF7

Part of subcall function 000BA530: RaiseException.KERNEL32(E06D7363,00000001,00000003,000B9EDD,?,?,?,?,000B9EDD,?,000E273C), ref: 000BA590

Part of subcall function 000BE14B: IsProcessorFeaturePresent.KERNEL32(00000017,000BDED2,?,000BDE41,00000001,00000016,000BE050,?,?,?,?,?,00000000), ref: 000BE167

Strings

csm, xrefs: 000B6F86

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: df2eb1b089ac5f54cba2ee35a226faa1f4fbdeb7deb81032e03fe1bdb6d49c74
Instruction ID: 23d8540aed3abd817b9c4e66cca54b385662256cc8134400679b44d199812df2
Opcode Fuzzy Hash: df2eb1b089ac5f54cba2ee35a226faa1f4fbdeb7deb81032e03fe1bdb6d49c74
Instruction Fuzzy Hash: 06219031D0021CDBCF25EF94D945AEDB7B9EF54710F28001AE409AB251C776AD45CB80

Function 000B5280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 000B52E6
std::_Throw_Cpp_error.LIBCPMT ref: 000B52F1

Part of subcall function 000B7054: ReleaseSRWLockExclusive.KERNEL32(000B54A2,?,000B54AA,00000000,?,?,?,00000006,?,?,?), ref: 000B7068

Strings

v', xrefs: 000B5300

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID: v'
API String ID: 3666349979-459535593
Opcode ID: 5500a90c6bbeb7c657c7a3fb667d8582e470c5c03bb5abe20e85fc42a040c023
Instruction ID: bbba50b9787b201223db01022d5c4c390348a11f3e49040b27c59940dbd92a9e
Opcode Fuzzy Hash: 5500a90c6bbeb7c657c7a3fb667d8582e470c5c03bb5abe20e85fc42a040c023
Instruction Fuzzy Hash: 6201F5315047416FD711EB28DC01BCBBBE4AFA5311F00845AF65C872A2D770E859CB92

Function 000B23C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000B23C5
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000B240A

Part of subcall function 000B7684: _Yarn.LIBCPMT ref: 000B76A3
Part of subcall function 000B7684: _Yarn.LIBCPMT ref: 000B76C7

Strings

bad locale name, xrefs: 000B2418

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 3a58c1b5e662f7f9a7d30bd3a4c93a024be2510da9451e7498aa0d7bb1df52ed
Instruction ID: b6a3e0bfa32eb6d95b99d34a6749fbfa9fc25c27d062543aec7e1e9f3832fba0
Opcode Fuzzy Hash: 3a58c1b5e662f7f9a7d30bd3a4c93a024be2510da9451e7498aa0d7bb1df52ed
Instruction Fuzzy Hash: E9F01760505B408ED370DF398415787BEE0AF29714F048E1EE5CAC7A42E375E508CBA6

Function 000B106D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000B1074

Strings

<i', xrefs: 000B1079
h', xrefs: 000B107E

Memory Dump Source

Source File: 00000000.00000002.2189262775.00000000000B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000000.00000002.2189247892.00000000000B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189284953.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189302259.00000000000E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189453484.000000000027A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b0000_MqN5lD3LGo.jbxd

Similarity

API ID: H_prolog3
String ID: <i'$h'
API String ID: 431132790-1572006799
Opcode ID: 108548eafaaae24ed0eee7b8713c9133da570d655412df0d7773bccfaac90a20
Instruction ID: 075b38f6162f77c3122692a477febdedb3eeef37afb65c144aa07356e85bfe83
Opcode Fuzzy Hash: 108548eafaaae24ed0eee7b8713c9133da570d655412df0d7773bccfaac90a20
Instruction Fuzzy Hash: C2E04F70D91B09EBDB00ABD1CD0F7DD79A4EB00314FA08155A2647B3C2DBFA4A149B66

Analysis Process: RegAsm.exePID: 4012, Parent PID: 4508COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.7%
Total number of Nodes:	789
Total number of Limit Nodes:	13

Executed Functions

Function 004E4BD0 Relevance: 12.7, APIs: 8, Instructions: 714
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004E71E0: GetCurrentProcess.KERNEL32(?), ref: 004E71EF
Part of subcall function 004E71E0: IsWow64Process.KERNEL32(00000000), ref: 004E71F6

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,-005A5B4A,00000000,?,?,00000000,-00585B31), ref: 004E4DF5
RegQueryValueExA.KERNELBASE(00000000,?,00000000,00020019,?,00000400), ref: 004E4EB2
RegCloseKey.ADVAPI32(00000000), ref: 004E4EE1
GetCurrentHwProfileA.ADVAPI32(?), ref: 004E4FCE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 004E562F
MultiByteToWideChar.KERNEL32(0000000F,00000000,?,000000FF,00000000,0000000F), ref: 004E5664
WideCharToMultiByte.KERNEL32(000004E3,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 004E568B
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000), ref: 004E56B9

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide$CurrentProcess$CloseOpenProfileQueryValueWow64
String ID:
API String ID: 1646947450-0
Opcode ID: ae4292a958d13f34842306830b16d1fa5ccb16088a57fb5a98bfde5e58442c07
Instruction ID: c0aba00e6514ac26363e67ac76cfd5322cd72c6070033efa120dba6d155bc681
Opcode Fuzzy Hash: ae4292a958d13f34842306830b16d1fa5ccb16088a57fb5a98bfde5e58442c07
Instruction Fuzzy Hash: 4E7255B0C042599BDB24CFA9C985BEEBBB1BF08304F204199E449B7291DB745B84CFA5

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004C85BA
getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
socket.WS2_32(?,?,?), ref: 004C865D
connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
closesocket.WS2_32(00000000), ref: 004C867D
freeaddrinfo.WS2_32(?,?,?,?,00589328,?,?), ref: 004C868A
WSACleanup.WS2_32 ref: 004C8690
freeaddrinfo.WS2_32(?,?,?,?,00589328,?,?), ref: 004C86A5

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: 52d29ec15fbf37ccd53ab56e21f2e3f1d11727fcf2b6a4206c2cbc59116a4c78
Instruction ID: ffa07009e3086412046aa5b15573dbd5c691e56a3beb11943292ef2f0f62f1de
Opcode Fuzzy Hash: 52d29ec15fbf37ccd53ab56e21f2e3f1d11727fcf2b6a4206c2cbc59116a4c78
Instruction Fuzzy Hash: 9531C1726043009BD7208F25DC48B2BB7E5FB94729F114B1EF9A4922E0D7759C089AA7

Function 0045DB00 Relevance: 7.7, APIs: 5, Instructions: 156
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 0045DB13
GetCursorPos.USER32(?), ref: 0045DB19
Sleep.KERNELBASE(000003E9), ref: 0045DBC8
GetCursorPos.USER32(?), ref: 0045DBCE
Sleep.KERNELBASE(00000001), ref: 0045DC7A

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cursor$Sleep
String ID:
API String ID: 1847515627-0
Opcode ID: 64e1b3b3cfd2bc4f7f18a9e387635337b0495f42438516b07fc99cf1f27a474a
Instruction ID: ab3f96cd0466869246e3b632190b9ed1b666d42f9e689fec286df2e29c35159e
Opcode Fuzzy Hash: 64e1b3b3cfd2bc4f7f18a9e387635337b0495f42438516b07fc99cf1f27a474a
Instruction Fuzzy Hash: E651BB35A04215CFCB25CF58C4D0EAAB7B2EF89705B2A809AD945AF352D735FD49CB80

Function 004C7B00 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000338,0000FFFF,00001006,?,00000008), ref: 004C7BA6
recv.WS2_32(?,00000004,00000002), ref: 004C7BC1
WSAGetLastError.WS2_32 ref: 004C7BC5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 004C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 004C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004C7D00
recv.WS2_32(00000000,?,00000008), ref: 004C7D1B

Part of subcall function 004C8590: WSAStartup.WS2_32 ref: 004C85BA
Part of subcall function 004C8590: getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
Part of subcall function 004C8590: socket.WS2_32(?,?,?), ref: 004C865D
Part of subcall function 004C8590: connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
Part of subcall function 004C8590: closesocket.WS2_32(00000000), ref: 004C867D
Part of subcall function 004C8590: freeaddrinfo.WS2_32(?,?,?,?,00589328,?,?), ref: 004C868A
Part of subcall function 004C8590: WSACleanup.WS2_32 ref: 004C8690

recv.WS2_32(?,00000004,00000008), ref: 004C7E23
__Xtime_get_ticks.LIBCPMT ref: 004C7E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004C7E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004C7EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004C7EB9

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectfreeaddrinfogetaddrinfosocket
String ID:
API String ID: 4125349891-0
Opcode ID: deda763b8fb6066c72b20903b58187ae793f723e7b47fea433c0891846b4f81f
Instruction ID: b3d54dcccad81d83ab75f13ba9899d4b50e1d8608cabcccfb3508871926cac68
Opcode Fuzzy Hash: deda763b8fb6066c72b20903b58187ae793f723e7b47fea433c0891846b4f81f
Instruction Fuzzy Hash: 9EB1AC71D043089BEB10DBA8CC49BAEBBB1BB54314F24025EE815BB2D2D7785D88DF95

Function 00442CD3 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0044298C: CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004429A9

GetLastError.KERNEL32 ref: 00442DE7
__dosmaperr.LIBCMT ref: 00442DEE
GetFileType.KERNELBASE(00000000), ref: 00442DFA
GetLastError.KERNEL32 ref: 00442E04
__dosmaperr.LIBCMT ref: 00442E0D
CloseHandle.KERNEL32(00000000), ref: 00442E2D
CloseHandle.KERNEL32(?), ref: 00442F7A
GetLastError.KERNEL32 ref: 00442FAC
__dosmaperr.LIBCMT ref: 00442FB3

Strings

H, xrefs: 00442F38

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 899e8745e59b9231842c25977fdcfb02482e73fc2f27b2205138a63271f33108
Instruction ID: 5150a9c177428a163fa7fb1c8ad58043a10a64c5935946436f9da82f6cbe0861
Opcode Fuzzy Hash: 899e8745e59b9231842c25977fdcfb02482e73fc2f27b2205138a63271f33108
Instruction Fuzzy Hash: 4EA15832A101149FEF19AF68DC917AE3BB1AB06314F58014EF801EF3A1CB799C56DB59

Function 004C7930 Relevance: 16.9, APIs: 11, Instructions: 351
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004C7ADB
std::_Throw_Cpp_error.LIBCPMT ref: 004C7AEC
setsockopt.WS2_32(00000338,0000FFFF,00001006,?,00000008), ref: 004C7BA6
recv.WS2_32(?,00000004,00000002), ref: 004C7BC1
WSAGetLastError.WS2_32 ref: 004C7BC5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 004C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 004C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004C7D00
recv.WS2_32(00000000,?,00000008), ref: 004C7D1B

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: recv$Cpp_errorThrow_setsockoptstd::_$ErrorLast
String ID:
API String ID: 4262120464-0
Opcode ID: 2742313002d99ebff0b85c726cc7d50e8a722fbe449677251f19bcc81d2f59a3
Instruction ID: f660aa10a7ff82edcf50d97d555a6422b1ffe0091938b4aec26a5e786c81bbb5
Opcode Fuzzy Hash: 2742313002d99ebff0b85c726cc7d50e8a722fbe449677251f19bcc81d2f59a3
Instruction Fuzzy Hash: 80E1ABB1C04348DBDB10DFA8CC89BAEBBB1FB18314F24425EE811AB292D7785944DF95

Function 00448910 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00448B91, 00448B94

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 69644da4761346a259d3ab052aa607ffb6ef80dbee7307f13448c56a9a482b41
Instruction ID: d4d7462daa34083545f9d93f0c5ebf53bf58a01a885379ada905c47cec286c1a
Opcode Fuzzy Hash: 69644da4761346a259d3ab052aa607ffb6ef80dbee7307f13448c56a9a482b41
Instruction Fuzzy Hash: E2B1F4B0A00245AFFB11DF99C881BAE7BB1FF55304F14015EE414AB392CB78AD81CB69

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,0054D15C,00000000,76A923A0,-00589880), ref: 004096A6
GetProcAddress.KERNEL32(00000000,?), ref: 004096B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,0054D15C,00000000,76A923A0,-00589880), ref: 004096C9

Strings

Ws2_32.dll, xrefs: 0040969A

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: d946741ea927b9b060335f299eec8efad25939578b4ebaaa967d5c79e73c84d4
Instruction ID: 188670ed5cfc709ed037a390f66f33add7af100e18449b0941b00ad524943a05
Opcode Fuzzy Hash: d946741ea927b9b060335f299eec8efad25939578b4ebaaa967d5c79e73c84d4
Instruction Fuzzy Hash: 7C02CE70D04298DEDF25CFA4C8907ADBBB0EF59304F24429EE4456B2C6D7781D86CB96

Function 004E6CA0 Relevance: 6.1, APIs: 4, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(?,?,00000006,00000005,00000005,?), ref: 004E6CFC
GetLastError.KERNEL32(?,?,00000006,00000005,00000005,?), ref: 004E6D07
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 3120929ec45ee0086a62fe527d0d8f49284849e7ce8a43a234ec1e7741655826
Instruction ID: 241e2f942859b358e1133ab4bf22632851a161ac9c5554c12c2f2fb0b7350d8e
Opcode Fuzzy Hash: 3120929ec45ee0086a62fe527d0d8f49284849e7ce8a43a234ec1e7741655826
Instruction Fuzzy Hash: DF11CE71A0028496DB205F6A5C08F6A7F60EB22772F64031BD8359B3D4DB3948058759

Function 0045098D Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00450995

Part of subcall function 0044EC55: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0044A862,?,00000000,-00000008), ref: 0044ECB6

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004509CD
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004509ED

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: cdbe965a3b857f3e72026c647ec4ecc001cf0e2e607b2b24cc187a0d78d85926
Instruction ID: 05a916c6faf25a0682dab3744c632e1b74caa3fe19fc9bf69ed868d66b577761
Opcode Fuzzy Hash: cdbe965a3b857f3e72026c647ec4ecc001cf0e2e607b2b24cc187a0d78d85926
Instruction Fuzzy Hash: EB112BF6901719BF77216BB35C89CBF696CEE6839B710002AF801D1243FB29CD0591B9

Function 004E57F0 Relevance: 3.4, APIs: 2, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,00000000,00000000), ref: 004E588F
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004E5B9B

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID:
API String ID: 3487004747-0
Opcode ID: 018ccf5c1a20462e23d10cd8f9ff11fec9c29878673a0d9fff758b044cfa9032
Instruction ID: 009fea26e280c08ebde66711631a2368a09a7ac58c7b38572a32fddf838a6e16
Opcode Fuzzy Hash: 018ccf5c1a20462e23d10cd8f9ff11fec9c29878673a0d9fff758b044cfa9032
Instruction Fuzzy Hash: 81F157B0D002499BDB14CFA8C9957EEBBB1FF08304F24425EE545BB381DB756A84CBA5

Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E55
GetLastError.KERNEL32(?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E5F

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 1fe827fdfe079599b9b1dab25e2b646f0beb01ea40d46a72429d261cc15a62e7
Instruction ID: bfed174018f4c3fae0b74bea86efe9ace0911028d3bee9629bfc5162a0057b67
Opcode Fuzzy Hash: 1fe827fdfe079599b9b1dab25e2b646f0beb01ea40d46a72429d261cc15a62e7
Instruction Fuzzy Hash: 6E1125336042102AF6252236A84677F67499B82738F39061FF918CB2D2DF689C81825D

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00579E30,00432B5E,00000002,00432B5E,00000000,?,?,?,00442626,00000000,?,00432B5E,00000002,00579E30), ref: 00442558
GetLastError.KERNEL32(00432B5E,?,?,?,00442626,00000000,?,00432B5E,00000002,00579E30,00000000,00432B5E,00000000,00579E30,0000000C,0043D61E), ref: 00442565

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0df1753fdbe4f7a704092f8361e7cfb0c7cc0fcadc70f8748e4d2d33b1623b65
Instruction ID: bcffdd1dd92d970d4fbe8e398a8ab980657c5c2bf717c74f1f656664416c076e
Opcode Fuzzy Hash: 0df1753fdbe4f7a704092f8361e7cfb0c7cc0fcadc70f8748e4d2d33b1623b65
Instruction Fuzzy Hash: 9B012632610615BFDF158F69DC1699E3B29EB84334F240209F8019B2E1E6B5ED429BA4

Function 00438E02 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f659cc8a9a49272dc5a8b65b091f37dbf03ca88fa3bd65ce108d20efe530995
Instruction ID: 9663080612542d3e5f9b84a36c3ecf1ef98ea00319430370267f097460dfd66c
Opcode Fuzzy Hash: 9f659cc8a9a49272dc5a8b65b091f37dbf03ca88fa3bd65ce108d20efe530995
Instruction Fuzzy Hash: 2651C670A00204AFDF14DF59C881AAABBA2EF8D328F24915EF8089B352D775DD41CB55

Function 004E7330 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E7483

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 95c2e167186eeb3e7dc9ada3aaf4bef30febac36b32543f012d33ef2061f0272
Instruction ID: 0e53ea78c72a938f7fb02060282791f61ff368934c38134d11baa5cff418869a
Opcode Fuzzy Hash: 95c2e167186eeb3e7dc9ada3aaf4bef30febac36b32543f012d33ef2061f0272
Instruction Fuzzy Hash: BE5159B0D00248DBCB14DF99C981AEEBBB4EF48714F24416DE8047B381D7799E41CBA5

Function 0044AC7F Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0044ACB9

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 8ff9ba0f0c894046871fc86ec0e9a1d79c4c84a1d92275a4dcbeaa53a6bd2b85
Instruction ID: f3143862af3a299983658f939e96efeb3759b05c7c18c303aa6d1d81ce31e1ed
Opcode Fuzzy Hash: 8ff9ba0f0c894046871fc86ec0e9a1d79c4c84a1d92275a4dcbeaa53a6bd2b85
Instruction Fuzzy Hash: 92112A71A0420AAFDF05DF58E94199F7BF5EF48304F04405AF809EB351D670DA25CB69

Function 004E5D00 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(0055D560,00000000,00000000), ref: 004E5D47

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 3d8916a0f3a5560b99d21513aef90176b581373bb7b6b0032725707bac5390a9
Instruction ID: 3af1858aaf6aa964ebdd9f4359c5c99147492c850a3065a18f0c0dee6211d041
Opcode Fuzzy Hash: 3d8916a0f3a5560b99d21513aef90176b581373bb7b6b0032725707bac5390a9
Instruction Fuzzy Hash: A0110EB1D04B449BE3208F28DD0A757BBF0EB00B28F10471EE850573C1E3BA6A4887E2

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040331F

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4c9de15bf43b7906aab7ed6efc04c82af185101d7b74466eda9590404471e6f8
Instruction ID: ac639495c118a2832fc09027b5ebf4fad0cef292c7be368858978faeea3118d5
Opcode Fuzzy Hash: 4c9de15bf43b7906aab7ed6efc04c82af185101d7b74466eda9590404471e6f8
Instruction Fuzzy Hash: 63F024321001009BCB246F61D4565EAB7ECDF28366B50083FFC8DD7292EB3EDA408788

Function 0044B094 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00434B3F,?,?,76A923A0,?,?,00403522,?,?), ref: 0044B0C6

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction ID: 07eaf642519ac51a5bd3283dd2addbb445c80e248ae9cef49388ffb333b33e8c
Opcode Fuzzy Hash: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction Fuzzy Hash: 99E022322006206BFF313AA69C14B5B764CEF413A3F190227EC25A62D1DB3CCC0092EE

Function 0044298C Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004429A9

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9c728ddfee9c54fb3e95c04c245e6250a3a2534adf7d99ecf6cfd652071d74be
Instruction ID: d272b26d39d4c1a932e1863db2ccc44a4dabdf9078851b65b676bd57bd2e36c0
Opcode Fuzzy Hash: 9c728ddfee9c54fb3e95c04c245e6250a3a2534adf7d99ecf6cfd652071d74be
Instruction Fuzzy Hash: 7DD06C3200020DBBDF128F84DC06EDA3BAAFB48754F014000BA1856120C736E861EB90

Non-executed Functions

Function 004E06D0 Relevance: 83.9, APIs: 43, Strings: 3, Instructions: 3428registrytimeprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 004E71E0: GetCurrentProcess.KERNEL32(?), ref: 004E71EF
Part of subcall function 004E71E0: IsWow64Process.KERNEL32(00000000), ref: 004E71F6

Part of subcall function 0044196B: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00441980
Part of subcall function 0044196B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0044199F

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,?,00000000,?,?), ref: 004E0D31
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00020019,?,00000400), ref: 004E0DFD
RegCloseKey.ADVAPI32(00000000), ref: 004E0E32
GetCurrentHwProfileA.ADVAPI32(?), ref: 004E0FCA
GetModuleHandleExA.KERNEL32(00000004,Function_000E5FC0,00000000), ref: 004E14CB
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004E14E3
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,?,?), ref: 004E1E96
RegQueryValueExA.ADVAPI32(?,?,00000000,00020019,?,?), ref: 004E1F62
RegCloseKey.ADVAPI32(?), ref: 004E21E1
GetComputerNameA.KERNEL32(?,00000104), ref: 004E2215
GetUserNameA.ADVAPI32(?,00000104), ref: 004E23B3
GetDesktopWindow.USER32 ref: 004E2456
GetWindowRect.USER32(00000000,?), ref: 004E2464
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 004E25CF
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 004E2A95
LocalAlloc.KERNEL32(00000040), ref: 004E2AA7
GetKeyboardLayoutList.USER32(?,00000000), ref: 004E2AC2
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 004E2AED
LocalFree.KERNEL32(?), ref: 004E2CB0
GetLocalTime.KERNEL32(?), ref: 004E2CC7
GetSystemTime.KERNEL32(?), ref: 004E2EDD
GetTimeZoneInformation.KERNEL32(?), ref: 004E2F00
TzSpecificLocalTimeToSystemTime.KERNEL32(?,?,?), ref: 004E2F25
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 004E333F
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00020019,?,00000400), ref: 004E3491
RegCloseKey.ADVAPI32(00000000), ref: 004E3542
GetSystemInfo.KERNEL32(?), ref: 004E356A
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 004E361D
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004E3731
EnumDisplayDevicesA.USER32(00000000,00000001,?,00000001), ref: 004E3B14
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004E3C53
Process32First.KERNEL32(00000000,00000128), ref: 004E3C6B
Process32Next.KERNEL32(00000000,00000128), ref: 004E3C81
Process32Next.KERNEL32(00000000,?), ref: 004E3D53
CloseHandle.KERNEL32(00000000), ref: 004E3D62
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?), ref: 004E40D6
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004E410D
wsprintfA.USER32 ref: 004E41F0
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?), ref: 004E4213
RegQueryValueExA.ADVAPI32(?,?,00000000,000F003F,?,00000400), ref: 004E4312
RegQueryValueExA.ADVAPI32(?,?,00000000,000F003F,?,00000400), ref: 004E4409
RegCloseKey.ADVAPI32(?), ref: 004E44E5
RegCloseKey.ADVAPI32(00000000), ref: 004E4500

Strings

2.0, xrefs: 004E09C7, 004E0A58
;Yb., xrefs: 004E402D
default24_2, xrefs: 004E0924, 004E09AE

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Time$Close$OpenQueryValue$LocalNameSystem$EnumProcess32$CurrentDevicesDisplayFileHandleInfoKeyboardLayoutListLocaleModuleNextProcessUserWindow$AllocComputerCreateDefaultDesktopFirstFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: 2.0$;Yb.$default24_2
API String ID: 3690012277-1792647087
Opcode ID: 2766509d2dca8154228f778d6e7f3dfafb67fd21fdecd1534a50e8eb966dc40b
Instruction ID: dc7450f610ff8aefedfd2d9d6437dce6e22052c90493d9c27a7ed5ed6746c995
Opcode Fuzzy Hash: 2766509d2dca8154228f778d6e7f3dfafb67fd21fdecd1534a50e8eb966dc40b
Instruction Fuzzy Hash: D093DEB4D0426D8BDB25CF99C981AEEBBB5FF48300F1041AAD909B7351DB345A81CFA5

Function 004E6770 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 350COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8
CreateDirectoryA.KERNEL32(?,00000000,00000005,?), ref: 004E6C55
std::_Throw_Cpp_error.LIBCPMT ref: 004E6C84
std::_Throw_Cpp_error.LIBCPMT ref: 004E6C95

Strings

\*.*, xrefs: 004E6834

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectory
String ID: \*.*
API String ID: 2715195259-1173974218
Opcode ID: ecc08acd5409bd2d2f2bd3c22b3b6aa0d6264b67c78a209e8d4e4319e9b1ebb3
Instruction ID: b2be1bc9108cd25bcd87be18baf4e69fd7455a47ff8891d9a14199d40660ba90
Opcode Fuzzy Hash: ecc08acd5409bd2d2f2bd3c22b3b6aa0d6264b67c78a209e8d4e4319e9b1ebb3
Instruction Fuzzy Hash: 7AE10470C00388DFDB10DFA9C9487EEBBB0FF25315F20425AE454AB292D7746A49DB65

Function 004CF280 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 240injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040,?,00000000), ref: 004CF2F1
WriteProcessMemory.KERNEL32(00000000,00000000,004C81DD,?,00000000), ref: 004CF30D
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 004CF342
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 004CF36B
WriteProcessMemory.KERNEL32(?,00000000,?,00000218,00000000,?,?,?,00589328), ref: 004CF50F
WriteProcessMemory.KERNEL32(?,00000218,004CF5E0,-00000010,00000000,?,?,?,00589328), ref: 004CF531
CreateRemoteThread.KERNEL32(?,00000000,00000000,00000218,00000000,00000000,00000000), ref: 004CF544
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,00589328), ref: 004CF54D

Strings

168, xrefs: 004CF4D3, 004CF4E3
%s|%s, xrefs: 004CF4EF

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$168
API String ID: 2137838514-1703702481
Opcode ID: b88fb1ed2ebfd2a655c4879da0ce9de7ec8f2c0603ef1b71525654192dd42d6d
Instruction ID: 2ab717f03d3c912496b66fb944616d360f792c6fe5d042a247d22025e7d5b78f
Opcode Fuzzy Hash: b88fb1ed2ebfd2a655c4879da0ce9de7ec8f2c0603ef1b71525654192dd42d6d
Instruction Fuzzy Hash: 36B16BB1D002089FDB14CFA4CC95BAEBBB5FF18300F10426DE905BB291D774A984DBA5

Function 004EE170 Relevance: 15.6, APIs: 10, Instructions: 557libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 004EE20C
GetProcAddress.KERNEL32(00000000,?), ref: 004EE300
GetProcAddress.KERNEL32(00000000,?), ref: 004EE3F4
GetProcAddress.KERNEL32(00000000,?), ref: 004EE4E8
GetProcAddress.KERNEL32(00000000,?), ref: 004EE5DC
GetProcAddress.KERNEL32(00000000,?), ref: 004EE65C
GetProcAddress.KERNEL32(00000000,?), ref: 004EE750
GetProcAddress.KERNEL32(00000000,?), ref: 004EE844
GetProcAddress.KERNEL32(00000000,?), ref: 004EE938
GetProcAddress.KERNEL32(00000000,?), ref: 004EEA2C

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: fba17449efcc4fd35a5932faffef4f0bd4510b269c308ba7fc037d24948359eb
Instruction ID: d080ee8d53740b572b5d589773f2606012d6cd0ef2a87b1da31b43526306bc13
Opcode Fuzzy Hash: fba17449efcc4fd35a5932faffef4f0bd4510b269c308ba7fc037d24948359eb
Instruction Fuzzy Hash: 336233B8D0525CEB8B04CFA8D5819DDFBB1BF58310F24919AE855BB351E7306A82EF44

Function 00432022 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,00000000,?,?,00000000,00000000), ref: 004320BA
GetLastError.KERNEL32(?,00000000,00000000), ref: 004320C4
FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 004320DB
GetLastError.KERNEL32(?,00000000,00000000), ref: 004320E6
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 004320F2
___std_fs_open_handle@16.LIBCPMT ref: 004321AB

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 399e9fa649e6a34084e5cc74f8c51f104b45a1f2b4104aba3408bb700d2d57cc
Instruction ID: 7e0e21ba57e1066c6160095fdf5a0f96b949db91fc8e8bea8e80148e62c7c079
Opcode Fuzzy Hash: 399e9fa649e6a34084e5cc74f8c51f104b45a1f2b4104aba3408bb700d2d57cc
Instruction Fuzzy Hash: D971D275A007199FCB24CF28CE84BABB3B8BF09310F145296E954E3390D7B49E85CB95

Function 00409C90 Relevance: 13.9, APIs: 9, Instructions: 356libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 00409D32
GetProcAddress.KERNEL32(?), ref: 00409E3D
GetProcAddress.KERNEL32(?), ref: 00409F36
GetProcAddress.KERNEL32(?), ref: 00409FBB
GetProcAddress.KERNEL32(?), ref: 0040A055
GetProcAddress.KERNEL32(?), ref: 0040A0EF
GetProcAddress.KERNEL32(?), ref: 0040A189
GetProcAddress.KERNEL32(?), ref: 0040A223
FreeLibrary.KERNEL32 ref: 0040A27B

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID:
API String ID: 2449869053-0
Opcode ID: 52f01a4dfbcb3f59218750f5f3945a65c16e243dd72f162a9732142b51316fa4
Instruction ID: 056e7afbc769c29073d59368404efc94fb89f274a412975777f329f96bf9ec8f
Opcode Fuzzy Hash: 52f01a4dfbcb3f59218750f5f3945a65c16e243dd72f162a9732142b51316fa4
Instruction Fuzzy Hash: 372286B8D05218EBCB15CF98D981AEDBBB1FF58310F2081AAD849B7350D7345A85EF45

Function 004534CF Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004535D7
IsValidCodePage.KERNEL32(00000000), ref: 00453615
IsValidLocale.KERNEL32(?,00000001), ref: 00453628
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00453670
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0045368B

Strings

*V, xrefs: 00453534

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: *V
API String ID: 415426439-2897881622
Opcode ID: bb3ee8500ca9cacc625c50b97d6e48ff5c53ad3e39c4a6c01d9da358df15b7ae
Instruction ID: 4a54d826d8e8e5dc964d84ffa3ac1e49b68ae0fe58eca9cd8e7cd24ca5604c7d
Opcode Fuzzy Hash: bb3ee8500ca9cacc625c50b97d6e48ff5c53ad3e39c4a6c01d9da358df15b7ae
Instruction Fuzzy Hash: 4E517471A00209AFDB20DFA5CC41ABF77B8AF05743F14446AED01E7252EB74DA48DB65

Function 005447E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 005447EB
GetVersionExA.KERNEL32(?), ref: 00544810
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00544843
LocalFree.KERNEL32(?), ref: 0054485A
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00544893

Part of subcall function 00545B50: AreFileApisANSI.KERNEL32(00000000,00000000,?,?,?,005448A5), ref: 00545B5C
Part of subcall function 00545B50: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,?,?,?,005448A5), ref: 00545B71
Part of subcall function 00545B50: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 00545B97

Strings

OsError 0x%x (%u), xrefs: 005448AE

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharFormatMessageMultiWide$ApisErrorFileFreeLastLocalVersion
String ID: OsError 0x%x (%u)
API String ID: 807219750-2664311388
Opcode ID: dd207c85fc94544383a517e30f756156e384ee2b8bcde9e9a95a45159a38d464
Instruction ID: 0c2bef24f6b7c7166f87ec92302cb7117f3d967c30a7bda74ece9fcd541a0daa
Opcode Fuzzy Hash: dd207c85fc94544383a517e30f756156e384ee2b8bcde9e9a95a45159a38d464
Instruction Fuzzy Hash: 0D21C832A40208BBEB209F71DC4AFEE7F78FF94755F1000A9F909A2191E7709A05DB61

Function 00452B5A Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetACP.KERNEL32(?,?,?,?,?,?,00447300,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00452C19
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00447300,?,?,?,00000055,?,-00000050,?,?), ref: 00452C50
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00452DB3

Strings

*V, xrefs: 00452B98
utf8, xrefs: 00452D22

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: *V$utf8
API String ID: 607553120-210452255
Opcode ID: 95727e6ef7b94787d777f99e21165c393144e5509e4be2ad3f52f8295ffa9360
Instruction ID: 742b11dcb7ff0b0bfa38c284345f0d68b4d7ce619a9ba0daefdf44cafbbca61f
Opcode Fuzzy Hash: 95727e6ef7b94787d777f99e21165c393144e5509e4be2ad3f52f8295ffa9360
Instruction Fuzzy Hash: F071FA32600602A6D725AF75CD45B6B73A8EF16705F10042FFD05D7283EBF8E94C9699

Function 004532F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00453605,00000002,00000000,?,?,?,00453605,?,00000000), ref: 0045338C
GetLocaleInfoW.KERNEL32(?,20001004,00453605,00000002,00000000,?,?,?,00453605,?,00000000), ref: 004533B5
GetACP.KERNEL32(?,?,00453605,?,00000000), ref: 004533CA

Strings

ACP, xrefs: 00453311
OCP, xrefs: 00453347

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b900ca414d4c4be95a8c6f041d08249478f894891a183a2f82a4edaf5765dc51
Instruction ID: 0023b8279c9b3e3643c8ce07df61025d6c2b7e12d2ffc4f7461f6cfcb2a1a3ae
Opcode Fuzzy Hash: b900ca414d4c4be95a8c6f041d08249478f894891a183a2f82a4edaf5765dc51
Instruction Fuzzy Hash: 8021C432600100A7DB308F54C900A9BB3A6AF50FD3B568466EC06D7312EF36EF49D358

Function 0043C960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction ID: 01dad5c531b3804b6668612822d9feb5b6f7af541a2af8c3bc89036eeee974e8
Opcode Fuzzy Hash: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction Fuzzy Hash: DA023A71E002199BDF14CFA9D9C06AEFBB1FF48314F24926AE919B7380D735A9418B94

Function 004C6000 Relevance: 6.3, APIs: 4, Instructions: 310fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F
FindNextFileA.KERNEL32(00000000,00000010), ref: 004C643F
GetLastError.KERNEL32 ref: 004C644D
FindClose.KERNEL32(00000000), ref: 004C645D

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: ad8232aa6ab48f27d6540ad5b2baad4e23a9261af117df8526272475b3c5b835
Instruction ID: afe6fe270f27518361ed143ef8865d869d8c660e8b4c9bb3a5978c93709ae348
Opcode Fuzzy Hash: ad8232aa6ab48f27d6540ad5b2baad4e23a9261af117df8526272475b3c5b835
Instruction Fuzzy Hash: ACD17CB4C043488FDB24CF98C994BEEBBB1BF45314F14829ED4496B392D7785A84CB59

Function 004938D0 Relevance: 6.2, APIs: 4, Instructions: 207fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,00565EFC,00565EFC,00000002,?,00000001), ref: 0049396F
FindNextFileA.KERNEL32(00000000,00000010), ref: 00493ACF
GetLastError.KERNEL32 ref: 00493ADD
FindClose.KERNEL32(00000000), ref: 00493AED

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: 3687e23493e2d079902dbc910b8d869425b52e72f4e67ce4ca7be239348c82ba
Instruction ID: 59bca9142b2f43e85d8f64eb9617364e40f7e337b3faf31c9dfe380ec3e76daa
Opcode Fuzzy Hash: 3687e23493e2d079902dbc910b8d869425b52e72f4e67ce4ca7be239348c82ba
Instruction Fuzzy Hash: 817124719002448BCF10CF64C8957FEBFB5AB56305F1442AAE441AB382D77A9F89CB64

Function 00434184 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00434190
IsDebuggerPresent.KERNEL32 ref: 0043425C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00434275
UnhandledExceptionFilter.KERNEL32(?), ref: 0043427F

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5e995d56bca3090024ce11201d33d294d56103379e56bdf134d89c0665374a9e
Instruction ID: cc34265599f2dec34f964c3269ec222ae3e40e25564db7ad72de3f36d20b351d
Opcode Fuzzy Hash: 5e995d56bca3090024ce11201d33d294d56103379e56bdf134d89c0665374a9e
Instruction Fuzzy Hash: BB31F6B5D053189BDB20EFA5D9497CDBBB8AF08304F1041AAE40CAB250EB759A84CF59

Function 005449B0 Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 005449CA
GetCurrentProcessId.KERNEL32 ref: 005449E5
GetTickCount.KERNEL32 ref: 005449FA
QueryPerformanceCounter.KERNEL32(?), ref: 00544A11

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CountCounterCurrentPerformanceProcessQuerySystemTickTime
String ID:
API String ID: 4122616988-0
Opcode ID: 2761748a9af697217c0ec141a17cdb9775b7d53fbeab25e478c1a4390fc4254b
Instruction ID: a8b0bf13f8b3a5775aebc3e00f45f95b893848271c39c3c1d8b2d1e40acf56c4
Opcode Fuzzy Hash: 2761748a9af697217c0ec141a17cdb9775b7d53fbeab25e478c1a4390fc4254b
Instruction Fuzzy Hash: 8A110432A007298BDB118FA9DC885EAFBF9FF49225B404536EC49D7215D631A481CBE0

Function 004C6D80 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004C7051
std::_Throw_Cpp_error.LIBCPMT ref: 004C7062

Strings

TgL, xrefs: 004C6D8D

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: TgL
API String ID: 2134207285-3240275877
Opcode ID: 7956ce00cadceb4b4c3302bc76aee270ec69d8d14a187e1f6517270ea90dd876
Instruction ID: e760907e7d40913908c938862d83eeacfb176e41806bca2803ae4695dda398ba
Opcode Fuzzy Hash: 7956ce00cadceb4b4c3302bc76aee270ec69d8d14a187e1f6517270ea90dd876
Instruction Fuzzy Hash: 0891EEB4E04248CFDB04DFA9C881BADBBB1BF58314F18816ED8416B392D779A905CF95

Function 004580D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 004580E9
GetSystemInfo.KERNEL32(?), ref: 00458104

Strings

D, xrefs: 004580F8

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 53f2c066bf0a3f036097ffc709ce78bf8807582e756120d0ec3c2933d4a49f04
Instruction ID: 15e633f26279e9839b0c5b245ad8314628d4ede9c042647a00b0634ca8b556b4
Opcode Fuzzy Hash: 53f2c066bf0a3f036097ffc709ce78bf8807582e756120d0ec3c2933d4a49f04
Instruction Fuzzy Hash: 7201F7336005096BDB24DE29DC05BDE7BBAAFD4325F0CC125ED59E7291EE38D90A8790

Function 00431D94 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,00403E16), ref: 00431DA8
FormatMessageA.KERNEL32(00001300,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00403E16), ref: 00431DCF

Strings

!x-sys-default-locale, xrefs: 00431DA3

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: fcdca3659bb1d2a61432e1cd2d8e2713532a4f3d4bfe03f6844bae0cf60f700d
Instruction ID: 5533b84c20dc3ebd942ff18ae9bc369b32e0f46532b4feac63eb50df4c9c1bd4
Opcode Fuzzy Hash: fcdca3659bb1d2a61432e1cd2d8e2713532a4f3d4bfe03f6844bae0cf60f700d
Instruction Fuzzy Hash: 05F03076210104BFEB189B94DC1ADEB7ABCEB0A395F00411ABA02D6150E2B0AE0097B5

Function 004C6B00 Relevance: 4.7, APIs: 3, Instructions: 204encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004C6B57
LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,00000000,005599AF,000000FF,?,?,00000005), ref: 004C6B86
LocalFree.KERNEL32(?,?), ref: 004C6C82

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: d7d82cbe380403d495b2fd6a7e2a6d2e7fbb054e7ac70c00a231221df97a0296
Instruction ID: 90b6470924ea9a925c498959a8113d32d71e754cc84c5268c76d6fdb8e080973
Opcode Fuzzy Hash: d7d82cbe380403d495b2fd6a7e2a6d2e7fbb054e7ac70c00a231221df97a0296
Instruction Fuzzy Hash: A271A171C002489BDB00DFA8C945BEEFBB4EF14314F14826EE855B3391EB786A45DBA5

Function 00544A40 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00544B20: GetVersionExA.KERNEL32(?), ref: 00544B51
Part of subcall function 00544B20: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00544B76
Part of subcall function 00544B20: GetFullPathNameW.KERNEL32(00000000,00000003,00000000,00000000), ref: 00544B96

Part of subcall function 00545330: GetVersionExA.KERNEL32(?), ref: 00545356

Part of subcall function 00545D90: GetVersionExA.KERNEL32(?), ref: 00545DB4

GetDiskFreeSpaceW.KERNEL32(00000000,?,00000200,?,?), ref: 00544AC9
GetDiskFreeSpaceA.KERNEL32(00000000,?,00000200,?,?), ref: 00544AF6

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Version$DiskFreeFullNamePathSpace
String ID:
API String ID: 4112908208-0
Opcode ID: becd6c03501c24d27a43ccdd940953d2523818c8f4bbaac0c2ad00c18d494839
Instruction ID: f10753ebb869b3640b9ac64d1dc3f7217fc16a68dafdf90303c08a5a8463592c
Opcode Fuzzy Hash: becd6c03501c24d27a43ccdd940953d2523818c8f4bbaac0c2ad00c18d494839
Instruction Fuzzy Hash: 0C21257A980108ABDB21DB699844BFB7BBDFF00308F1400A6E941D7101FB31CE46CBA5

Function 004E90C0 Relevance: 33.7, APIs: 18, Strings: 1, Instructions: 423libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,7591E010,?), ref: 004E92A0
GetProcAddress.KERNEL32(00000000,?), ref: 004E92B0
GetModuleHandleA.KERNEL32(?), ref: 004E93C8
GetProcAddress.KERNEL32(00000000,?), ref: 004E93D2
OpenProcess.KERNEL32(00000040,00000000,?), ref: 004E93DE
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000), ref: 004E944D
CloseHandle.KERNEL32(00000000), ref: 004E9480
CloseHandle.KERNEL32(00000000), ref: 004E94A6
CloseHandle.KERNEL32(00000000), ref: 004E94C6
CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 004E9668
ResetEvent.KERNEL32(00000000), ref: 004E9671
CreateThread.KERNEL32(00000000,00000000,004E97A0,?,00000000,00000000), ref: 004E9695
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 004E96A1
RtlUnicodeStringToAnsiString.NTDLL(?,?,00000001), ref: 004E96E7
CloseHandle.KERNEL32(00000000), ref: 004E9728
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000001), ref: 004E9734
CloseHandle.KERNEL32(00000000), ref: 004E9753
TerminateThread.KERNEL32(14D846FE,00000000), ref: 004E9781

Strings

File, xrefs: 004E94F0

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Handle$Close$Process$AddressCreateCurrentEventModuleProcStringThread$AnsiObjectOpenResetSingleTerminateUnicodeWait
String ID: File
API String ID: 3681783469-749574446
Opcode ID: 5519d313cc11df224254bb5c2ddb9f42228914f8febfa83a914f2ab3983c68cb
Instruction ID: b9b0c17e31d3cfe0bbc2e9151a178c1e78e3251af3666c5291f23336d4f8ce8a
Opcode Fuzzy Hash: 5519d313cc11df224254bb5c2ddb9f42228914f8febfa83a914f2ab3983c68cb
Instruction Fuzzy Hash: 6322D2B4D042599FDB24CF99D981BEEBBB4BF08310F104199E909B7390E7746A81CFA5

Function 004D6790 Relevance: 19.9, APIs: 13, Instructions: 424fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 004D6A20

Part of subcall function 004D6BA0: GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
Part of subcall function 004D6BA0: RmStartSession.RSTRTMGR(?,00000000,?), ref: 004D6C50
Part of subcall function 004D6BA0: RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 004D6C91
Part of subcall function 004D6BA0: RmGetList.RSTRTMGR(?,00000000,?,?,?), ref: 004D6CB9

std::_Throw_Cpp_error.LIBCPMT ref: 004D6B84
std::_Throw_Cpp_error.LIBCPMT ref: 004D6B95
RmShutdown.RSTRTMGR(?,00000001,00000000), ref: 004D6CDA
RmEndSession.RSTRTMGR(?), ref: 004D6CF7
SetLastError.KERNEL32(00000000), ref: 004D6CFE
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D25
GetLastError.KERNEL32(?,?,00000000), ref: 004D6D33
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D47

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CopyErrorFileLast$Cpp_errorSessionThrow_std::_$ListRegisterResourcesShutdownStart
String ID:
API String ID: 3293558552-0
Opcode ID: 4ad8c97d16258963b69530f00f5a19583fa6f8cd08bbe9ec6ea1fbea8f4f1102
Instruction ID: 506ad45c425b60783e5a35b13f18b7e09e4e0bf61d875f697530398146ac6994
Opcode Fuzzy Hash: 4ad8c97d16258963b69530f00f5a19583fa6f8cd08bbe9ec6ea1fbea8f4f1102
Instruction Fuzzy Hash: 0102BCB1C00249DBCB10DFA4C955BEEBBB5FF14314F14426AE805B7381EB786A49CBA5

Function 004EEA40 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 148memorystringCOMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 004EEA65
CharNextA.USER32 ref: 004EEA85
CharNextA.USER32 ref: 004EEAA5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EEAD6
lstrlenA.KERNEL32(?,00000000,00000000,00000003,00000000), ref: 004EEB52
GetProcessHeap.KERNEL32(00000008,?,00000000,00000000,00000003,00000000), ref: 004EEB6E
HeapAlloc.KERNEL32(00000000), ref: 004EEB71
lstrcpynA.KERNEL32(00000000,?,?), ref: 004EEB7E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004EEBA9
HeapFree.KERNEL32(00000000), ref: 004EEBAC

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36, xrefs: 004EEB8E

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$CharNext$Process$AllocFreeUnothrow_t@std@@@__ehfuncinfo$??2@lstrcpynlstrlen
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36
API String ID: 2305228968-2732702261
Opcode ID: 423986ca5e1177f672ef3d58246459128f5a16203a5f76b509fb2a383bcfa813
Instruction ID: 66e08b66e62082d9c79a605ab5b022e87f42821b87c70d6f65fc34b32a61c15c
Opcode Fuzzy Hash: 423986ca5e1177f672ef3d58246459128f5a16203a5f76b509fb2a383bcfa813
Instruction Fuzzy Hash: F1414976D003449FCF10CFAB9C80AAABBB5FF69302B08016BEA05B7351E7755D059B64

Function 004579E3 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0045734F), ref: 004579FC

Strings

log10, xrefs: 00457A3E, 00457A4D
pow, xrefs: 00457A9A, 00457B44, 00457B91
log, xrefs: 00457A59, 00457A68
acos, xrefs: 00457B32
`-@, xrefs: 00457AC6, 00457B70, 00457BB6
sqrt, xrefs: 00457B3B
exp, xrefs: 00457A7B, 00457AE0
asin, xrefs: 00457B29

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: DecodePointer
String ID: `-@$acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3628989360
Opcode ID: 4c17630f5161de399ffce6b570c60365a2c89c55b52a7f760b39540bf94f5387
Instruction ID: bbf143f63b3841ec77cfacb8c6df481a799db6acf17f433172942b25d65e7ef2
Opcode Fuzzy Hash: 4c17630f5161de399ffce6b570c60365a2c89c55b52a7f760b39540bf94f5387
Instruction Fuzzy Hash: 1651B370808A0ACBCF109F58F84C1BEBFB1FB05309F154166D851A7266C7799A2DCB4D

Function 0041A060 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0041A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A0E7
__Getctype.LIBCPMT ref: 0041A1C5
std::_Facet_Register.LIBCPMT ref: 0041A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A223

Strings

PG@, xrefs: 0041A1BF
PD@, xrefs: 0041A19A
E@, xrefs: 0041A1AE

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: PD@$PG@$E@
API String ID: 1102183713-4120405683
Opcode ID: cf66166f52ff7971b600a3250f2a29593a1149a421a208e93fab5363b0ce8f21
Instruction ID: b372b58ab1bb25eec4b44a09b7f8f3aef2cc67a410616163416d5e42c3dffe19
Opcode Fuzzy Hash: cf66166f52ff7971b600a3250f2a29593a1149a421a208e93fab5363b0ce8f21
Instruction Fuzzy Hash: 6E51BAB0D01245DFCB11CF98C9457AEBBF0FB14714F14825ED855AB391DB78AA88CB92

Function 004E5DB0 Relevance: 15.2, APIs: 10, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 004E5E2B
SetupDiEnumDeviceInfo.SETUPAPI(00000000,00000000,00000000), ref: 004E5E3E
LocalAlloc.KERNEL32(00000040,0000001C), ref: 004E5E73
SetupDiEnumDeviceInterfaces.SETUPAPI(?,00000000,0055D560,00000000,00000000), ref: 004E5E91
GetModuleHandleExA.KERNEL32(00000004,004E5FC0,?), ref: 004E5FD6

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocDeviceEnumLocalSetup$HandleInfoInterfacesModule
String ID:
API String ID: 2253831631-0
Opcode ID: fadfa1ac60673d3e458d1915a7e98f7ba4584b72fe7d50eb1e1fd26e6b005db2
Instruction ID: 9ece1d8e53d7ac8d60b2bb6ddbf2ef81f89b1d867ae8a09947e2396971ddc2c4
Opcode Fuzzy Hash: fadfa1ac60673d3e458d1915a7e98f7ba4584b72fe7d50eb1e1fd26e6b005db2
Instruction Fuzzy Hash: AB61BCB1900349AFEB10CFA5CD09BAEBFB5FF14305F24025AE90067291D3B96A44DBA5

Function 004D6BA0 Relevance: 15.2, APIs: 10, Instructions: 164fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
RmStartSession.RSTRTMGR(?,00000000,?), ref: 004D6C50
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 004D6C91
RmGetList.RSTRTMGR(?,00000000,?,?,?), ref: 004D6CB9
RmShutdown.RSTRTMGR(?,00000001,00000000), ref: 004D6CDA
RmEndSession.RSTRTMGR(?), ref: 004D6CF7
SetLastError.KERNEL32(00000000), ref: 004D6CFE
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D25
GetLastError.KERNEL32(?,?,00000000), ref: 004D6D33
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D47

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$CopyFileSession$ListRegisterResourcesShutdownStart
String ID:
API String ID: 304452573-0
Opcode ID: f2e0f649d8c451cb188e662d2111ed80fd4b92e16dc5a70a42fc26eb44908162
Instruction ID: cca443e56f4e81c83c2dc89493b37bcb85ee1d7da0cfa031959f485395bd6110
Opcode Fuzzy Hash: f2e0f649d8c451cb188e662d2111ed80fd4b92e16dc5a70a42fc26eb44908162
Instruction Fuzzy Hash: 6051C172D01219ABCB21CF94DC55BEEBBB8EB04320F10026AE804B3390D7396E05CBA4

Function 004377C6 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

___TypeMatch.LIBVCRUNTIME ref: 004379F3
CatchIt.LIBVCRUNTIME ref: 00437A44
_UnwindNestedFrames.LIBCMT ref: 00437B45
CallUnexpected.LIBVCRUNTIME ref: 00437B60

Strings

csm, xrefs: 00437870
csm, xrefs: 00437803
PU, xrefs: 004378DC
csm, xrefs: 0043791C

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwind
String ID: PU$csm$csm$csm
API String ID: 944608866-2352073648
Opcode ID: bfdbdb9048f87fb98bf27686f7ec8788dee97e91e92dadc6c49aef564bf08e9e
Instruction ID: 3ab07074fa5cec17866f911e521d745307128fc3ecc03719d0b843171535b798
Opcode Fuzzy Hash: bfdbdb9048f87fb98bf27686f7ec8788dee97e91e92dadc6c49aef564bf08e9e
Instruction Fuzzy Hash: 2DB18EB1808209DFDF25EFA5C8819AEBB75FF18314F14615BE8406B302D739EA51CB99

Function 004E4720 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 291registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32(80000002,?,?,0001FFFF,00000001,?,00000104,?,?,?), ref: 004E4A70
GetComputerNameExA.KERNEL32(00000002,?,00000104,?,?,?,?,?,?), ref: 004E4ADC
LsaOpenPolicy.ADVAPI32(00000000,00587684,00000001,?), ref: 004E4B35
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 004E4B48
LsaFreeMemory.ADVAPI32(?), ref: 004E4B76
LsaClose.ADVAPI32(?), ref: 004E4B7F

Strings

;Yb., xrefs: 004E49C7
%wZ, xrefs: 004E4B65

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$;Yb.
API String ID: 762890658-2876608990
Opcode ID: 1f6fa3f1279af543b2d0416b495f84695c810df1c81b970ccc0f6ebddc05bc25
Instruction ID: db120a3af714b361d6db134a28a940fef9e0d4b71911d12d67c4190411436b99
Opcode Fuzzy Hash: 1f6fa3f1279af543b2d0416b495f84695c810df1c81b970ccc0f6ebddc05bc25
Instruction Fuzzy Hash: 1EE101B4D0425A8FDB14CF98C985BEEBBB4BF08304F2041AAE949B7341D7745A85CFA5

Function 0041D260 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041D28A
std::_Lockit::_Lockit.LIBCPMT ref: 0041D2AC
std::_Lockit::~_Lockit.LIBCPMT ref: 0041D2D4
__Getcoll.LIBCPMT ref: 0041D39F
std::_Facet_Register.LIBCPMT ref: 0041D3E4
std::_Lockit::~_Lockit.LIBCPMT ref: 0041D40E

Strings

@A, xrefs: 0041D399
PD@, xrefs: 0041D385

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID: @A$PD@
API String ID: 1184649410-3602166583
Opcode ID: 3f72e526092bf99e7447afaa4f0b7c5784614eb7b5b41a98088833437af13145
Instruction ID: c0da35fc40401e56e1a2e1b6a9e91288cb6dff343535c30909133d457a6d594b
Opcode Fuzzy Hash: 3f72e526092bf99e7447afaa4f0b7c5784614eb7b5b41a98088833437af13145
Instruction Fuzzy Hash: DD51BAB1C01209DFDB01DF99C9447AEBBF0FF55318F24805AE8156B381C779AA49CB92

Function 004335D8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004335DE
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 004335EC
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 004335FD
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 0043360E

Strings

kernel32.dll, xrefs: 004335D9
GetTempPath2W, xrefs: 00433603
GetCurrentPackageId, xrefs: 004335E6
GetSystemTimePreciseAsFileTime, xrefs: 004335F2

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: fa32ac99bed3163b7218575a0872144807cc5232e4a06349f6b146d66b29aa24
Instruction ID: 4ac6349005adf47651da35ec4b9228104ef97a4851d7f02e7f823555ada55313
Opcode Fuzzy Hash: fa32ac99bed3163b7218575a0872144807cc5232e4a06349f6b146d66b29aa24
Instruction Fuzzy Hash: ACE0B672951310ABC7249BB0BC2D9663EB8FA296637404056FC02E21A0EBB05949ABB4

Function 00544CF0 Relevance: 13.6, APIs: 9, Instructions: 88sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00545330: GetVersionExA.KERNEL32(?), ref: 00545356

GetVersionExA.KERNEL32(?), ref: 00544D33
DeleteFileW.KERNEL32(00000000), ref: 00544D52
GetFileAttributesW.KERNEL32(00000000), ref: 00544D59
GetLastError.KERNEL32 ref: 00544D66
Sleep.KERNEL32(00000064), ref: 00544D7C
DeleteFileA.KERNEL32(00000000), ref: 00544D85
GetFileAttributesA.KERNEL32(00000000), ref: 00544D8C
GetLastError.KERNEL32 ref: 00544D99
Sleep.KERNEL32(00000064), ref: 00544DAF

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastSleepVersion
String ID:
API String ID: 1421123951-0
Opcode ID: 644f3411c4d85681ded29085f2f8665f8d90dbdf3f2b9961fa3a9f7b4629f182
Instruction ID: e8ec0c6fce3b273d326ef0f9b2b3730986ab63f4275b785bb0a08d323dc610f1
Opcode Fuzzy Hash: 644f3411c4d85681ded29085f2f8665f8d90dbdf3f2b9961fa3a9f7b4629f182
Instruction Fuzzy Hash: 6221DB32D403149FCB20AB74AC8D6FD7BB4FB69339F100655E91AD31A0EA304985AB52

Function 004372D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00437307
___except_validate_context_record.LIBVCRUNTIME ref: 0043730F
_ValidateLocalCookies.LIBCMT ref: 00437398
__IsNonwritableInCurrentImage.LIBCMT ref: 004373C3
_ValidateLocalCookies.LIBCMT ref: 00437418

Strings

csm, xrefs: 004373AD
`-@, xrefs: 004373DC

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: `-@$csm
API String ID: 1170836740-3738301566
Opcode ID: a837c65dc98bc53f7a591b5dada66322cfdf011b0ab20b220170fbbfaeea83fd
Instruction ID: bde692452db8eba3752ab90a3e7788ac0719a0bf92b2230e47b89eff8dfd02fd
Opcode Fuzzy Hash: a837c65dc98bc53f7a591b5dada66322cfdf011b0ab20b220170fbbfaeea83fd
Instruction Fuzzy Hash: B041F8709042099FCF20DF59C885A9FBBA4BF08328F14905BFC54AB392D739E905DB95

Function 0041C430 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0041C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0041C4A4
std::_Facet_Register.LIBCPMT ref: 0041C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0041C5C4

Strings

E@, xrefs: 0041C562
PD@, xrefs: 0041C54E

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: E@$PD@
API String ID: 459529453-4103272508
Opcode ID: 4956459445cc7cc7d841703dbe2ed42e033006db9883af498c412f7626095107
Instruction ID: e4bc83ced0ac359faa997fd18d4eeb760fe14de2594101695cc0fd15b6690fbc
Opcode Fuzzy Hash: 4956459445cc7cc7d841703dbe2ed42e033006db9883af498c412f7626095107
Instruction Fuzzy Hash: C351EFB0900255EFDB11CF58C991BAEBBF0FB10314F24415EE846AB381D7B9AA45CB95

Function 004EDED0 Relevance: 12.2, APIs: 8, Instructions: 165networkCOMMON

Download Yara Rule

APIs

InternetSetOptionA.WININET(00000000,00000006,?,00000004), ref: 004EDF20
GetLastError.KERNEL32 ref: 004EE015
InternetQueryOptionA.WININET(00000000,0000001F,80000000,?), ref: 004EE040

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InternetOption$ErrorLastQuery
String ID:
API String ID: 3980908186-0
Opcode ID: a1ac1e88c949714abb61e8a63101dbc767da60d4252146e236756bc9d4aa2743
Instruction ID: 9490229386b8f910ac67b310a4b2a15fa60c532261df57d9535cab47ed46c7f4
Opcode Fuzzy Hash: a1ac1e88c949714abb61e8a63101dbc767da60d4252146e236756bc9d4aa2743
Instruction Fuzzy Hash: B951BE75D40319ABEB20CF95DC8ABEEBBB4EB08B11F14415AEE11BB380D7745A05CB94

Function 00545560 Relevance: 12.1, APIs: 8, Instructions: 141filesleepCOMMON

Download Yara Rule

APIs

LockFile.KERNEL32(00000000,40000000,00000000,00000001,00000000), ref: 005455C3
Sleep.KERNEL32(00000001), ref: 005455D1
GetLastError.KERNEL32 ref: 005455E8
UnlockFile.KERNEL32(00000000,40000000,00000000,?,00000000), ref: 00545633

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: File$ErrorLastLockSleepUnlock
String ID:
API String ID: 3015003838-0
Opcode ID: fe5b5dd74c13ed604590905c3a68f9743d06f085f038e564466f01a9403e7b73
Instruction ID: 85acfabea7dd4ab1116a46d77ec5fdacabbf57290cd153e1b380d28a3a3316b2
Opcode Fuzzy Hash: fe5b5dd74c13ed604590905c3a68f9743d06f085f038e564466f01a9403e7b73
Instruction Fuzzy Hash: 9741D431B01B14ABDB308F24DD957EEBB66FB54729F618125ED08AB392E7719C408BD0

Function 004EDB30 Relevance: 12.1, APIs: 8, Instructions: 128memorystringCOMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 004EDB55
CharNextA.USER32 ref: 004EDB6C
CharNextA.USER32 ref: 004EDB85
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EDBB6
lstrlenA.KERNEL32(?,00000000,00000000,00000003,00000000), ref: 004EDC32
GetProcessHeap.KERNEL32(00000008,?,00000000,00000000,00000003,00000000), ref: 004EDC48
HeapAlloc.KERNEL32(00000000), ref: 004EDC4F
lstrcpynA.KERNEL32(00000000,?,?), ref: 004EDC5C

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CharNext$Heap$AllocProcessUnothrow_t@std@@@__ehfuncinfo$??2@lstrcpynlstrlen
String ID:
API String ID: 1659885099-0
Opcode ID: 5902d60186420a28bcfe0593f279e262339d39e86a68ea558966eb630272322d
Instruction ID: 9156e0b6da00d8c97823f7767c754a9362769a51dfd7e715744df6f0419fd9af
Opcode Fuzzy Hash: 5902d60186420a28bcfe0593f279e262339d39e86a68ea558966eb630272322d
Instruction Fuzzy Hash: 9C416A35D007849FCB208F6E9C806AABBF9EF69312B150197E845F7311E7B49C45DB58

Function 0044BB66 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044BBEC

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction ID: d7b9d7273cbfac5d15a556f8c8651b9033d93685d5a38535419dded3191b9e75
Opcode Fuzzy Hash: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction Fuzzy Hash: D5B14672D006559FEB158F24CC81BEBBBA5EF59310F2441ABE904AB382D778D901C7E9

Function 00545050 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00545061
GetVersionExA.KERNEL32(?), ref: 00545085
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 005450B7
LocalFree.KERNEL32(?), ref: 005450CE
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00545106

Part of subcall function 00545B50: AreFileApisANSI.KERNEL32(00000000,00000000,?,?,?,005448A5), ref: 00545B5C
Part of subcall function 00545B50: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,?,?,?,005448A5), ref: 00545B71
Part of subcall function 00545B50: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 00545B97

Strings

OsError 0x%x (%u), xrefs: 00545121

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharFormatMessageMultiWide$ApisErrorFileFreeLastLocalVersion
String ID: OsError 0x%x (%u)
API String ID: 807219750-2664311388
Opcode ID: 0d4010ca04ec75710d5123f11d165840ae7251f1f65bebee6710aad968807722
Instruction ID: 40d3e820988b70ea56f320253a2c5dfb69695040fa1f8efb038979f2cda04def
Opcode Fuzzy Hash: 0d4010ca04ec75710d5123f11d165840ae7251f1f65bebee6710aad968807722
Instruction Fuzzy Hash: 9621A476A00308BBDB20AB719C4AFDE7FB8FB55795F1000A5F909E3291E7709E05D661

Function 0044B37E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0044B48D,?,?,00000000,00000001,?,?,0044B6B7,00000022,FlsSetValue,00561B88,00561B90,00000001), ref: 0044B43F

Strings

ext-ms-, xrefs: 0044B3E9
api-ms-, xrefs: 0044B3D5

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 033630484f002e070c94113c7b6ef7f262f68e90d70309fdd043a749aa00ed93
Instruction ID: e3d7dbf8d3e43151f67a2d3675c4fcd7809fc0c9af6198dcb17880ded4e1cd5b
Opcode Fuzzy Hash: 033630484f002e070c94113c7b6ef7f262f68e90d70309fdd043a749aa00ed93
Instruction Fuzzy Hash: A2212B36A01220A7E7319F619C45A6B7768EB51761F140112FC06A7392D734ED05D6D9

Function 00458023 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0045809E,00458247), ref: 0045803A
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00458050
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00458065

Strings

KERNEL32.DLL, xrefs: 00458035
AcquireSRWLockExclusive, xrefs: 0045804A
ReleaseSRWLockExclusive, xrefs: 0045805A

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: b8fd12eac23ddbaee97a23d952f9025b2fd48530103b998c3f924386a52c0e98
Instruction ID: 9d8da08feb674b7e1defcd418174b7d342a7e101b9a5f06a55684ee540db6b02
Opcode Fuzzy Hash: b8fd12eac23ddbaee97a23d952f9025b2fd48530103b998c3f924386a52c0e98
Instruction Fuzzy Hash: C6F0A4316807129B5B715E755C9827736DCAA11B53716003EDF01F32E2FE18CC4EA795

Function 00443633 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,93D55659,?,?,00000000,00551365,000000FF,?,0044360F,?,?,004435E3,00000016), ref: 00443668
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044367A
FreeLibrary.KERNEL32(00000000,?,00000000,00551365,000000FF,?,0044360F,?,?,004435E3,00000016), ref: 0044369C

Strings

mscoree.dll, xrefs: 00443661
`-@, xrefs: 0044368B
CorExitProcess, xrefs: 00443672

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$`-@$mscoree.dll
API String ID: 4061214504-3731901874
Opcode ID: 66c557226bdf84cfe892202a4e2d9d598a1facfa92736b92f61228ad13b2a6bb
Instruction ID: 11f561727bfec435161e86ab51d2faaed74d5e09c0b89d0474703e999051cdf2
Opcode Fuzzy Hash: 66c557226bdf84cfe892202a4e2d9d598a1facfa92736b92f61228ad13b2a6bb
Instruction Fuzzy Hash: 5601A232A44715AFDB219F44DC19BAFBBB8FB14B52F014526E812E27E0DB749A04CA94

Function 00455EBC Relevance: 9.2, APIs: 6, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,0045618C,00000000,00000000,?,00000001,?,?,?,?,00000001,?), ref: 00455F62
__freea.LIBCMT ref: 004560F7
__freea.LIBCMT ref: 004560FD
__freea.LIBCMT ref: 00456133
__freea.LIBCMT ref: 00456139
__freea.LIBCMT ref: 00456149

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __freea$Info
String ID:
API String ID: 541289543-0
Opcode ID: 3cb777db59429bfc891b253d5559c1e8fbc0b96e17397612565c1f741eb4a6a0
Instruction ID: 72db6a5fbbb72ca24a21522075f010f93cbc1b36e5ad4b1d6eb8cbe60aa301df
Opcode Fuzzy Hash: 3cb777db59429bfc891b253d5559c1e8fbc0b96e17397612565c1f741eb4a6a0
Instruction Fuzzy Hash: D1711572900A05ABDF209F648C51BBFB7B69F49316F66015BED04A7383E63CDC098799

Function 00433369 Relevance: 9.2, APIs: 6, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 004333F4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00433480
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004334EB
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00433507
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0043356A
CompareStringEx.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00433587

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 4a3eeb56bd7ee9fe1909d18e68262bb2fe5fda54b12eb40b7425b1e554b148b6
Instruction ID: 4b04ae3b393bc6533ba77a97e4ab0e5e3051f7f3fd8f9b1f1052972f8d3aefbf
Opcode Fuzzy Hash: 4a3eeb56bd7ee9fe1909d18e68262bb2fe5fda54b12eb40b7425b1e554b148b6
Instruction Fuzzy Hash: 8871C272D00215ABEF219F64CC45BEF7BB5AF1D726F14205BE850A7291D73C9E048BA8

Function 004330A9 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 004330F2
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0043315D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0043317A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004331B9
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00433218
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0043323B

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 5f4a82ba7d014fa06e8216ae2bfd85b34b40225c1761d69da73e76adef6768e6
Instruction ID: 2e7ff44e5bd3fd254f9cef1b25620d319a510a0ee994d159d64b8617f2502457
Opcode Fuzzy Hash: 5f4a82ba7d014fa06e8216ae2bfd85b34b40225c1761d69da73e76adef6768e6
Instruction Fuzzy Hash: 5E51E172500206ABEF205F65CC45FAB7BB9EF48B46F24456AF910D6250D738CE00DB68

Function 0044520B Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00445385
__freea.LIBCMT ref: 004453A1

Strings

am/pm, xrefs: 00445403
9WD, xrefs: 004455E4
a/p, xrefs: 00445467

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __freea
String ID: 9WD$a/p$am/pm
API String ID: 240046367-3195321850
Opcode ID: d269768e122446cddcc54ca1bb0353446874435394a7fafcda5843a2fd319884
Instruction ID: eb6553218dede8ec3b22f7d8591de804fd90c34fa4c0505c2e4821a80c18f7d5
Opcode Fuzzy Hash: d269768e122446cddcc54ca1bb0353446874435394a7fafcda5843a2fd319884
Instruction Fuzzy Hash: 6BC1EC31900A06EBEF249F68C895ABFB7B1FF05700F55404BE805AB356D3789D42CB9A

Function 004D6D90 Relevance: 9.1, APIs: 6, Instructions: 101COMMON

Download Yara Rule

APIs

RmStartSession.RSTRTMGR(?,00000000,?), ref: 004D6DDE
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 004D6E20
RmGetList.RSTRTMGR(?,?,?,?,?), ref: 004D6E48
RmShutdown.RSTRTMGR(?,00000001,00000000), ref: 004D6E69
RmEndSession.RSTRTMGR(?), ref: 004D6E9C
SetLastError.KERNEL32(00000000), ref: 004D6EA3

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Session$ErrorLastListRegisterResourcesShutdownStart
String ID:
API String ID: 3915309458-0
Opcode ID: 35964b7dd5ed9eaca30dcc906b780c94db694ea61ce3b36c4f9fa18b6ac6bce6
Instruction ID: 29e6430877ba3f7b480c4ad8311182fb53b3682ab34aef7614a715581ba20f86
Opcode Fuzzy Hash: 35964b7dd5ed9eaca30dcc906b780c94db694ea61ce3b36c4f9fa18b6ac6bce6
Instruction Fuzzy Hash: 42316076C01219AFDB21DF94CC55BEFBBB8EF18310F01422AF911A3290DB795A448BE1

Function 00437458 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0043744F,0043599C,00434361), ref: 00437466
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00437474
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043748D
SetLastError.KERNEL32(00000000,0043744F,0043599C,00434361), ref: 004374DF

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1f7d8f03dc5d5ed9cbe3f3a50d497af2707fd42e27fe0bf67e220eaf0f6c3ecd
Instruction ID: 2a60fb784f2f832ea5b73717e43a0c16eb42b58da7a2c3196cfaa8111b53b8ed
Opcode Fuzzy Hash: 1f7d8f03dc5d5ed9cbe3f3a50d497af2707fd42e27fe0bf67e220eaf0f6c3ecd
Instruction Fuzzy Hash: F401F57210C7116EE63027756C8A6172B84DB693BAF30633FF894512F1FE195C04628C

Function 0043756F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00437636
___AdjustPointer.LIBCMT ref: 00437659
___AdjustPointer.LIBCMT ref: 004376F5

Strings

`-@, xrefs: 004375CE

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AdjustPointer
String ID: `-@
API String ID: 1740715915-3781167437
Opcode ID: 9c49ec1216cd10a1b8dcded1df3eff29d3c2c71fb51b80305b9040516556d7e1
Instruction ID: 05bfd451ac5aa057a102673f7c5ee37241370c5a2d72e881bccf1d550ae62a18
Opcode Fuzzy Hash: 9c49ec1216cd10a1b8dcded1df3eff29d3c2c71fb51b80305b9040516556d7e1
Instruction Fuzzy Hash: CE5125F1608A02AFDB388F19C852BBB77A5EF08324F14542FE881472A1D739EC50CB58

Function 00545140 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?), ref: 00545190
GetTempPathW.KERNEL32(000000E6,?,?), ref: 005451B9

Strings

>, xrefs: 00545298
%s\etilqs_, xrefs: 0054525A

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: PathTempVersion
String ID: %s\etilqs_$>
API String ID: 261301950-2315843240
Opcode ID: ce0a7f2363ab7b7d7abc17a902d21cc4fb793d200454f9d166eb27a7e0bd6095
Instruction ID: d7a7f50afb807603cb5ab0f28f8cfab7bdc2795ddb654ce58a8a7a184e52c6c9
Opcode Fuzzy Hash: ce0a7f2363ab7b7d7abc17a902d21cc4fb793d200454f9d166eb27a7e0bd6095
Instruction Fuzzy Hash: 8D516B31D086989FE722CB798C457FABFA4BF16308F4809D6D58492083E6B48F85D761

Function 00432729 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00432730
std::_Lockit::_Lockit.LIBCPMT ref: 0043273B
std::_Lockit::~_Lockit.LIBCPMT ref: 004327A9

Part of subcall function 0043288C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004328A4

std::locale::_Setgloballocale.LIBCPMT ref: 00432756

Strings

`-@, xrefs: 00432778, 0043279C

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID: `-@
API String ID: 677527491-3781167437
Opcode ID: 8a5613631ec3d916f95b396eb7cc43f12c5d676d84142dd5ef1a29976cc47206
Instruction ID: 335728d06f8999c9367bb6f0cb93ad347570f0e44e9dcbef2930aaa8ccdcd417
Opcode Fuzzy Hash: 8a5613631ec3d916f95b396eb7cc43f12c5d676d84142dd5ef1a29976cc47206
Instruction Fuzzy Hash: 9D01FC35A006109BC70AFB20CC5157D7BB0FF98790F44250EE81163391CFB8AE06DB89

Function 00544DE0 Relevance: 7.7, APIs: 5, Instructions: 208fileCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00544EA3
CreateFileW.KERNEL32(00000000,C0000000,00000003,00000000,7FFFFFFD,00000000,00000000), ref: 00544ED3
CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,7FFFFFFD,00000000,00000000), ref: 00544EDB

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CreateFile$Version
String ID:
API String ID: 1715692615-0
Opcode ID: e626251a24768bde3cf7646f34f6a4eca0d0342c2a8e3f24f44f168cd5caa3e2
Instruction ID: 79d633e4ecdcec58b4cab98b7c2eef95a221f739213a781545a85cef4e7b8ca8
Opcode Fuzzy Hash: e626251a24768bde3cf7646f34f6a4eca0d0342c2a8e3f24f44f168cd5caa3e2
Instruction Fuzzy Hash: 9961BC75604302AFD720CF24D845BAABBE8FF84318F04492DF999C6291E735C959CB92

Function 004E9A70 Relevance: 7.7, APIs: 5, Instructions: 181memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,7591E010,?), ref: 004E9BEE
GetProcAddress.KERNEL32(00000000,?), ref: 004E9BF9
GetProcessHeap.KERNEL32 ref: 004E9C04
HeapAlloc.KERNEL32(00000000,00000000,00010000), ref: 004E9C1E
HeapAlloc.KERNEL32(?,00000000,00010000), ref: 004E9C57

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Alloc$AddressHandleModuleProcProcess
String ID:
API String ID: 349456774-0
Opcode ID: 13763fb7ed65d7034848c90db75977a8d0748b960893ffa14e62b2712247cb23
Instruction ID: d3ba1316c3404c5ffc03a5be9701c45b2826e37c75856fc641be7cc60fa5c5e8
Opcode Fuzzy Hash: 13763fb7ed65d7034848c90db75977a8d0748b960893ffa14e62b2712247cb23
Instruction Fuzzy Hash: CF81F0B5D04229ABDB14CF9AD884AAEFBB4FF48311F10856AE924B7350E7746A01CF54

Function 00432BC8 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00432BDC
AcquireSRWLockExclusive.KERNEL32(00000008), ref: 00432BFB
AcquireSRWLockExclusive.KERNEL32(00000008,00000000), ref: 00432C29
TryAcquireSRWLockExclusive.KERNEL32(00000008,00000000), ref: 00432C84
TryAcquireSRWLockExclusive.KERNEL32(00000008,00000000), ref: 00432C9B

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 8f089e7040faa662b45679f060ee1b8a0f0adfff173fd46cb89089840a213128
Instruction ID: ee0d2db44a198d3d02c1eb3b1b0ff5a364ec90963e300245c4d31640e9e12550
Opcode Fuzzy Hash: 8f089e7040faa662b45679f060ee1b8a0f0adfff173fd46cb89089840a213128
Instruction Fuzzy Hash: B2415931900A0ADFCB20DF65CA8096EB3B4FF0C311F20692BD446D7650D7B8E986DB69

Function 00544B20 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00545330: GetVersionExA.KERNEL32(?), ref: 00545356

GetVersionExA.KERNEL32(?), ref: 00544B51
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00544B76
GetFullPathNameW.KERNEL32(00000000,00000003,00000000,00000000), ref: 00544B96
GetFullPathNameA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00544BAF
GetFullPathNameA.KERNEL32(00000000,00000003,00000000,00000000), ref: 00544BE1

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FullNamePath$Version
String ID:
API String ID: 495861893-0
Opcode ID: def506589b02ed86a2d83c6155d8a90f1111383d037ff91711d2ded9672cc6f4
Instruction ID: d9a042031f5a76925af0b002eaae0799fce7b88889afc6fe8005c9c8c5fb2dd0
Opcode Fuzzy Hash: def506589b02ed86a2d83c6155d8a90f1111383d037ff91711d2ded9672cc6f4
Instruction Fuzzy Hash: 55213FB25406146BEB206F719C86FEF3B68EF51309F000078F90956252EA38DD49C7A6

Function 0048F4D0 Relevance: 7.6, APIs: 5, Instructions: 69processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0048F4E3
Process32First.KERNEL32(00000000,?), ref: 0048F506
Process32Next.KERNEL32(00000000,00000128), ref: 0048F551
CloseHandle.KERNEL32(00000000), ref: 0048F55C
CloseHandle.KERNEL32(00000000), ref: 0048F572

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 6029d90057008e46b8e5c5277aed6df356708134237ca5f417d9c8706b6c6cea
Instruction ID: bc177564cbddbd99672fb84a339279b73cca850227e520494dfef4c47b8580b0
Opcode Fuzzy Hash: 6029d90057008e46b8e5c5277aed6df356708134237ca5f417d9c8706b6c6cea
Instruction Fuzzy Hash: 6411E6326001146BD7306F34AC986BFB7B9EB19325F1405BAE848C3352E7268C4E8765

Function 00406180 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 353COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00406587

Strings

)@, xrefs: 00406581
", ", xrefs: 004063D8
: ", xrefs: 004063AE

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@$", "$: "
API String ID: 4194217158-2520320562
Opcode ID: 8a991d6cc43cc05af2141aeae52dd0db046d74c20a293c61a820b5870d9df492
Instruction ID: 193815703dc37f45cda184aa0d75e7307a57ae547af4f9c577389d6cf834964f
Opcode Fuzzy Hash: 8a991d6cc43cc05af2141aeae52dd0db046d74c20a293c61a820b5870d9df492
Instruction Fuzzy Hash: 85D1E370D00205DFCB14DFA8C945AAEBBF5FF44304F10462EE456A7381DB78AA55CB99

Function 00407350 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0040750C
___std_exception_destroy.LIBVCRUNTIME ref: 00407522

Strings

)@, xrefs: 00407502, 0040751C
[json.exception., xrefs: 004073A1

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@$[json.exception.
API String ID: 4194217158-3378332251
Opcode ID: 74f1ced649a80f54c74698f2e3f1ef80366f2fbaef409b1663f26043a5eac72a
Instruction ID: d1fd1ad00dbeab1566b73d8112c34bc80c76f551163e59ed82d928a5322bc1a2
Opcode Fuzzy Hash: 74f1ced649a80f54c74698f2e3f1ef80366f2fbaef409b1663f26043a5eac72a
Instruction Fuzzy Hash: 8C51CFB1C046489BD710DFA8C905B9EBBB4FF15318F14426EE850A73C2E7B86A44C7A5

Function 00407B10 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00407CAC
___std_exception_destroy.LIBVCRUNTIME ref: 00407CC2

Strings

p|@, xrefs: 00407C2A
)@, xrefs: 00407CA2, 00407CBC

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@$p|@
API String ID: 4194217158-2759249158
Opcode ID: fbc67c62691b4d29c16fb41b2f6209782dee4ae52023c44201ea77ed1986cddc
Instruction ID: 2d5fa3d367423be86db8b91485125f203ee18fb15550ca5d49c40f7a3d1822d9
Opcode Fuzzy Hash: fbc67c62691b4d29c16fb41b2f6209782dee4ae52023c44201ea77ed1986cddc
Instruction Fuzzy Hash: 0051D3B1C052489BDB00DF98D9457DEFBF4EF19318F10426EE814A7381E7B96A44C7A5

Function 00437B6B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00437B90
CatchIt.LIBVCRUNTIME ref: 00437C76

Strings

RCC, xrefs: 00437BAA
MOC, xrefs: 00437BA2

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 2197aaef782f375f8d87615206ae6fe603a672c81450030c01d2018f2b0bfa53
Instruction ID: 1ed06b6d49ca92b7e67ab75acb14d1b1cdaab090b09ce00a5d54d3623121de76
Opcode Fuzzy Hash: 2197aaef782f375f8d87615206ae6fe603a672c81450030c01d2018f2b0bfa53
Instruction Fuzzy Hash: C1416AB1900209AFDF25DF94CD81AEEBBB5FF4C304F14A05AF944A7251D339A950DB54

Function 00404900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040499F

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,76A923A0,?,00431D09,?,005799D8,76A923A0,?,76A923A0,-00589880), ref: 0043525B

Strings

ios_base::failbit set, xrefs: 00404828, 00404941
ios_base::badbit set, xrefs: 00404937, 00404962
ios_base::eofbit set, xrefs: 00404946

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-1866435925
Opcode ID: 5e8fcf04681b5496c91e096f1d273a5343178b8940b0c322b64de4dd1df32f3c
Instruction ID: 99c94d1e80f512c720ba00148ae48faeb0acee82eabb402b7e5943aa58dcc262
Opcode Fuzzy Hash: 5e8fcf04681b5496c91e096f1d273a5343178b8940b0c322b64de4dd1df32f3c
Instruction Fuzzy Hash: AC119CF2844644ABCB10DF688C03BAB37C8E744715F04463EFE58972C1EB399800C79A

Function 00438587 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00438538,00000000,?,00588904,?,?,?,004386DB,00000004,InitializeCriticalSectionEx,0055F640,InitializeCriticalSectionEx), ref: 00438594
GetLastError.KERNEL32(?,00438538,00000000,?,00588904,?,?,?,004386DB,00000004,InitializeCriticalSectionEx,0055F640,InitializeCriticalSectionEx,00000000,?,00438322), ref: 0043859E
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 004385C6

Strings

api-ms-, xrefs: 004385AB

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c947551068fc5aa78d1c4ecff25818d243fe134ebcecfa929017a310edce328a
Instruction ID: c90ef5146fc35b23aa789d7ef59479731dd43e4d0f257fa83e9710a47c69997d
Opcode Fuzzy Hash: c947551068fc5aa78d1c4ecff25818d243fe134ebcecfa929017a310edce328a
Instruction Fuzzy Hash: 51E0D871280308B7EF301F60DC06B1A7F65AB10B41F100035F90CA85F0EB65E954A959

Function 00425757 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00425787
___std_exception_destroy.LIBVCRUNTIME ref: 0042579E

Strings

)@, xrefs: 00425780, 00425796
l, xrefs: 004257A6

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@$l
API String ID: 4194217158-531593656
Opcode ID: a4528b05e6746526d62e84ebb445939fb61f2aaef993a3223180bb5120b50cba
Instruction ID: 43fda41a344adde0c0e2112745b19999f63c5ee1cff445b37cb15900c05139ed
Opcode Fuzzy Hash: a4528b05e6746526d62e84ebb445939fb61f2aaef993a3223180bb5120b50cba
Instruction Fuzzy Hash: BAF0F9A0C052C8DEDB01CBA8C9557CDBFB56F15308F14409AD444A7282E7B96B0CD763

Function 00425654 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00425680
___std_exception_destroy.LIBVCRUNTIME ref: 00425697

Strings

)@, xrefs: 00425679, 0042568F
x, xrefs: 0042569F

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@$x
API String ID: 4194217158-91598277
Opcode ID: 6c5c37cb81e8ac0a1486ed869cf1e333a176143b923977886202bd8eddd9186c
Instruction ID: 10c3b930f4cf49af9ee2bef6b48737f2413326e6bf4895110f1bc2a9c90c91f1
Opcode Fuzzy Hash: 6c5c37cb81e8ac0a1486ed869cf1e333a176143b923977886202bd8eddd9186c
Instruction Fuzzy Hash: 28F0DAA1C09288E9DF41DBE4C5087CDBFB56F15309F24409AD848A7242E7B8670CD767

Function 0048F070 Relevance: 6.3, APIs: 4, Instructions: 334processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0048F19C
Process32First.KERNEL32(00000000,?), ref: 0048F1C2
Process32Next.KERNEL32(00000000,00000128), ref: 0048F211
CloseHandle.KERNEL32(00000000), ref: 0048F227

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 0d951179c317006dddf831d143819256e2710197f3f27043bc004d2e793115e6
Instruction ID: fbe0c60eb3c239f6b217fe84070aebb3c7b1e9daf40031a0165cf74cf1030098
Opcode Fuzzy Hash: 0d951179c317006dddf831d143819256e2710197f3f27043bc004d2e793115e6
Instruction Fuzzy Hash: ADD1BF71D002098BDB14DFA8C9857EEFBF5EF44304F24456AD805A7381E779AE88CBA5

Function 00448E9F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(93D55659,00000000,00000000,?), ref: 00448F02

Part of subcall function 0044EC55: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0044A862,?,00000000,-00000008), ref: 0044ECB6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00449154
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0044919A
GetLastError.KERNEL32 ref: 0044923D

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d46c0870a8277536d77cd1fa32924c999241811f2f15ebdbc3735bbe4b8907ba
Instruction ID: b6f9ea87837ca93654473fd2bae4ec290e60b55bc3ade45d2d9d29a5185f0d60
Opcode Fuzzy Hash: d46c0870a8277536d77cd1fa32924c999241811f2f15ebdbc3735bbe4b8907ba
Instruction Fuzzy Hash: 70D1BC75D00249AFDF14CFA8C880AAEBBB5FF09304F28456AE856EB351D734AD45CB54

Function 004E97A0 Relevance: 6.2, APIs: 4, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 004E98CE
GetProcAddress.KERNEL32(00000000,?), ref: 004E98DA
CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 004E9A55
SetEvent.KERNEL32(00000000), ref: 004E9A5C

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Event$AddressCreateHandleModuleProc
String ID:
API String ID: 2341598627-0
Opcode ID: d8f616207016ccd70649815b0a46d34ccb6368db7b539dbf58b9823ea8322156
Instruction ID: 94e94f94aa147367d366308f7bbda68d1ba073eefd2343970e9372381d670d86
Opcode Fuzzy Hash: d8f616207016ccd70649815b0a46d34ccb6368db7b539dbf58b9823ea8322156
Instruction Fuzzy Hash: 88819AB490C3829FC304CF59C48195AFBE5AFA8390F10891EF89587361E775D989CF96

Function 00443A09 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c28dd970ee9f985723d01587f791f28dc943c9d51e1efde8fb113aa15fde7f1a
Instruction ID: 3ce7a0f6481a0f72d6256d3f2a6e49e06ee9a16ea2b7f0bfddf77237ab23de3e
Opcode Fuzzy Hash: c28dd970ee9f985723d01587f791f28dc943c9d51e1efde8fb113aa15fde7f1a
Instruction Fuzzy Hash: 8F412872A40744AFF7149F39C841B5ABBA9EB48B11F10812FF051EB381D779EA408788

Function 004E55A0 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 004E562F
MultiByteToWideChar.KERNEL32(0000000F,00000000,?,000000FF,00000000,0000000F), ref: 004E5664
WideCharToMultiByte.KERNEL32(000004E3,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 004E568B
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000), ref: 004E56B9

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 667af2e2a61abff60a43f7d208c8c753e65e9722df59284470c0eff5b9583b61
Instruction ID: 1f69569aec08140b5ab3c0a9b620ac8cfa37dccc0484cb5d57b15f637e29afd9
Opcode Fuzzy Hash: 667af2e2a61abff60a43f7d208c8c753e65e9722df59284470c0eff5b9583b61
Instruction Fuzzy Hash: ED41E271900345ABEF218F75CC09FAE7BB4AF45715F10025AF414BB2D1D7B99A04CBA9

Function 0044F9EC Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0044EC55: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0044A862,?,00000000,-00000008), ref: 0044ECB6

GetLastError.KERNEL32 ref: 0044FA50
__dosmaperr.LIBCMT ref: 0044FA57
GetLastError.KERNEL32(?,?,?,?), ref: 0044FA91
__dosmaperr.LIBCMT ref: 0044FA98

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: f69f264f3a3445fa5257163de56fc3005cb7e945df64431326a0965baf165f71
Instruction ID: 175cdc1e371479ca6662e8932d27d2c7f0366fb1f46f3a828fcae8f7a9953d28
Opcode Fuzzy Hash: f69f264f3a3445fa5257163de56fc3005cb7e945df64431326a0965baf165f71
Instruction Fuzzy Hash: 4A21D731A00605AFFB20EF66D88086BB7A9EF54368715843FF81DA7250D738EC598B59

Function 00545330 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00545356

Part of subcall function 00545D20: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,00545385), ref: 00545D36

AreFileApisANSI.KERNEL32 ref: 00545392
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 005453AB
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000), ref: 005453D1

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide$ApisFileVersion
String ID:
API String ID: 928063719-0
Opcode ID: cddb1f359b989beb9fa67faf323006f07cde4dd9abd9fb615a423bdc0bd7c05d
Instruction ID: ee91a8a6a0c0fee7022a5c8999e7185e4bdf2e494df521b14be47994331aebc0
Opcode Fuzzy Hash: cddb1f359b989beb9fa67faf323006f07cde4dd9abd9fb615a423bdc0bd7c05d
Instruction Fuzzy Hash: 22113F72E407142BE7305F786C8AFAF37ACEB55769F100265F909E62C1FAB44D489391

Function 00443734 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b057469d9bc5f69e0f8b611fad5c821e03d6bc773c10b2b7f28a1d317aa21b2f
Instruction ID: b5fe3350cd15eea0aaf87c65c2f18f4f52b92c45156554196b4f926f22b003f4
Opcode Fuzzy Hash: b057469d9bc5f69e0f8b611fad5c821e03d6bc773c10b2b7f28a1d317aa21b2f
Instruction Fuzzy Hash: 6621F6F1200205AFFB20AF76CC8186BB7A9FF4076A710C51BF95987250DB39EE518769

Function 00545920 Relevance: 6.1, APIs: 4, Instructions: 76fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,?,00000000), ref: 00545949
GetLastError.KERNEL32 ref: 00545956
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 0054598E
GetLastError.KERNEL32 ref: 005459BF

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLast$PointerWrite
String ID:
API String ID: 2977825765-0
Opcode ID: 1950966d951f8c867560627456bbde13738b7accb01c1cd70c58ef6c62dd0c24
Instruction ID: 582698eb55b2eaae6c7c0c5214501257d254c964c7943da035f428691071258d
Opcode Fuzzy Hash: 1950966d951f8c867560627456bbde13738b7accb01c1cd70c58ef6c62dd0c24
Instruction Fuzzy Hash: 0E219F33600609EBDB208FA8D884BDABBB8FB44375F144166ED18D7281E631DD04DBA0

Function 005459E0 Relevance: 6.1, APIs: 4, Instructions: 66fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 005459FF
GetLastError.KERNEL32 ref: 00545A0A
ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00545A32
GetLastError.KERNEL32 ref: 00545A3C

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID:
API String ID: 2170121939-0
Opcode ID: 540eb84cac6ede58d3537ff1f38c1a90d22693d8cdf9cf0c6dadd44eecfb50f4
Instruction ID: 6ceb55c3a65a62e15609471827d2f6869488a49b85fb46b58a4ba310ad65ed5c
Opcode Fuzzy Hash: 540eb84cac6ede58d3537ff1f38c1a90d22693d8cdf9cf0c6dadd44eecfb50f4
Instruction Fuzzy Hash: 6D119172600209ABCB108FA9EC45BDABBA8FF14375F004266FD1CC72A0E771D8609BD1

Function 00545770 Relevance: 6.1, APIs: 4, Instructions: 61fileCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?), ref: 00545797
LockFileEx.KERNEL32(?,00000001,00000000,000001FE,00000000,?,00000000,?), ref: 005457DB
LockFile.KERNEL32(?,?,00000000,00000001,00000000,00000000,?), ref: 00545818
GetLastError.KERNEL32 ref: 00545824

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileLock$ErrorLastVersion
String ID:
API String ID: 1561719237-0
Opcode ID: 47948f3ac46128f688e1d1758b7c43b77088cf2001bc0b658931b0abdcadf5d0
Instruction ID: 771d51dfa285cbb2dd74062f629081d2be7cfc554bc2a81a6f00ae30f739e82a
Opcode Fuzzy Hash: 47948f3ac46128f688e1d1758b7c43b77088cf2001bc0b658931b0abdcadf5d0
Instruction Fuzzy Hash: DB110171A00715EFF7208B64DC0ABAABBB5FF14314F004165F909E72D0EBB49D448B90

Function 00431F0C Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000400,?,?,?,?,00000000,00000000), ref: 00431F29
GetLastError.KERNEL32 ref: 00431F35
WideCharToMultiByte.KERNEL32(?,00000000,?,?,?,?,00000000,00000000), ref: 00431F5B
GetLastError.KERNEL32 ref: 00431F67

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 35e7bea43bf35a340b569ac256c958a5570a5f93565d5de543f4fdf7da8372b1
Instruction ID: 5e8341cea1a57eda6e9d4b8ca3b7a39c6f892c49641055c0ca5066718be154a8
Opcode Fuzzy Hash: 35e7bea43bf35a340b569ac256c958a5570a5f93565d5de543f4fdf7da8372b1
Instruction Fuzzy Hash: C901FF36600255BBCF221FA1DC08D9B3E36EBD97A1F104015FE1556230C7318866E7B5

Function 005458C0 Relevance: 6.0, APIs: 4, Instructions: 35fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 005458DF
GetLastError.KERNEL32 ref: 005458EA
SetEndOfFile.KERNEL32(?), ref: 005458F7
GetLastError.KERNEL32 ref: 00545901

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLast$Pointer
String ID:
API String ID: 1697706070-0
Opcode ID: 99ed1c69f56f5325abe80c91d58b6415e30b45006e4dec00d143e7c5daf9e1c0
Instruction ID: 8fd75b374af1164205c64c99f3da373fde227693c6e20ab0659c9ae24c58912b
Opcode Fuzzy Hash: 99ed1c69f56f5325abe80c91d58b6415e30b45006e4dec00d143e7c5daf9e1c0
Instruction Fuzzy Hash: BFF03032514708EFDB209FA4EC05AAA7BB8FB15735F104656F82DC62A0E731D924AB91

Function 00456D32 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,0043D547,00000000,00000000,?,00453DCE,00000000,00000001,?,?,?,00449291,?,00000000,00000000), ref: 00456D49
GetLastError.KERNEL32(?,00453DCE,00000000,00000001,?,?,?,00449291,?,00000000,00000000,?,?,?,0044986B,00000000), ref: 00456D55

Part of subcall function 00456D1B: CloseHandle.KERNEL32(FFFFFFFE,00456D65,?,00453DCE,00000000,00000001,?,?,?,00449291,?,00000000,00000000,?,?), ref: 00456D2B

___initconout.LIBCMT ref: 00456D65

Part of subcall function 00456CDD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00456D0C,00453DBB,?,?,00449291,?,00000000,00000000,?), ref: 00456CF0

WriteConsoleW.KERNEL32(00000000,00000000,0043D547,00000000,?,00453DCE,00000000,00000001,?,?,?,00449291,?,00000000,00000000,?), ref: 00456D7A

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6d252f6c85546040703605b5d122fbb434f3c9b6b34be8e7cd3f73b3df330617
Instruction ID: b582005f90f2c4d159ccd48a3422ceca8e6e351b7b3b67145bbef734a6de3f3c
Opcode Fuzzy Hash: 6d252f6c85546040703605b5d122fbb434f3c9b6b34be8e7cd3f73b3df330617
Instruction Fuzzy Hash: F4F01C37500518BBCF221FD1DC18A8A3F76EB583A2B814415FE0D96231D6328928EB94

Function 00481BC0 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00481BC4
GetCurrentProcessId.KERNEL32 ref: 00481BCC
SetEvent.KERNEL32 ref: 00481BE9
WaitForSingleObject.KERNEL32(000000FF), ref: 00481BF7

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Current$EventObjectProcessSingleThreadWait
String ID:
API String ID: 977356572-0
Opcode ID: 145f1463f0330e510467377b19718f6381c7c9cc9e72a15fcc7b338b6b78320b
Instruction ID: 43167ce624a0f5263368e741b5dc2b465bdabedb5219c12b94d6a200efc4dfb2
Opcode Fuzzy Hash: 145f1463f0330e510467377b19718f6381c7c9cc9e72a15fcc7b338b6b78320b
Instruction Fuzzy Hash: 3FE01A72004315DFD7109F64EC1C855BBB5FB293227148221F9099B3B0E6318989EBA5

Function 004C7070 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 325fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004E74C0: __fread_nolock.LIBCMT ref: 004E7609

DeleteFileA.KERNEL32(?), ref: 004C70EB

Strings

default24_2, xrefs: 004C7171, 004C718A
168, xrefs: 004C7135, 004C714E

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: DeleteFile__fread_nolock
String ID: 168$default24_2
API String ID: 3901365830-313377091
Opcode ID: 1161ed511266ea5b36fdda2c25c8167c5bb02b9ddc66b7669f310dbba728992d
Instruction ID: 994a29ed8d939f73133b05733742be9ed0c6bb819da8c78882f75ca7b06cd161
Opcode Fuzzy Hash: 1161ed511266ea5b36fdda2c25c8167c5bb02b9ddc66b7669f310dbba728992d
Instruction Fuzzy Hash: 7CE18AB4D00249CBCB04CFA8C945BAEBBB1BF48304F24419DE9056B392DB78AE45CF95

Function 00408F20 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 272libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,?,?,?,?,00000004,00000000), ref: 004091C8
GetProcAddress.KERNEL32(00000000,?), ref: 004091D3

Strings

Ws2_32.dll, xrefs: 004091BF

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Ws2_32.dll
API String ID: 1646373207-3093949381
Opcode ID: ea9167e3bcfed1d29222b40259f4286497e10de2dd63420951b2f22a9489b711
Instruction ID: cb5ead6240095672237fdab8273f91d80b82b8d73d4ae51f565ea22395c8577a
Opcode Fuzzy Hash: ea9167e3bcfed1d29222b40259f4286497e10de2dd63420951b2f22a9489b711
Instruction Fuzzy Hash: E7C16A70E01214DFCB24CFA8C84579EBBB0BF08714F24859EE955AB392D779AD01CB95

Function 00406B10 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406CF0
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406D3E

Strings

., xrefs: 00406D10

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 8de97e0557b89d418490575b2115c1d7852bdd46763aabdbcc61db0957447ddc
Instruction ID: 06e113195c9c995bb1126ed1958f592d786724859c69b2563011d6ef3baaff07
Opcode Fuzzy Hash: 8de97e0557b89d418490575b2115c1d7852bdd46763aabdbcc61db0957447ddc
Instruction Fuzzy Hash: 6A91D071A00625ABCB34DF18C4846AAB7B4FF05324F01026AE856A77D0D739FDA5CBD9

Function 004036E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00403819
___std_exception_destroy.LIBVCRUNTIME ref: 004038F0

Strings

)@, xrefs: 004037ED, 004038EA

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: )@
API String ID: 2970364248-4120265097
Opcode ID: ed1ac0f14267c2b8626e9d784d9228836504f476972db074cc70cf608e0aac1a
Instruction ID: 269ef50febfdc4b1c22cf7239a576f40f0b19685bcb009e1facc48eb6157c32a
Opcode Fuzzy Hash: ed1ac0f14267c2b8626e9d784d9228836504f476972db074cc70cf608e0aac1a
Instruction Fuzzy Hash: DD6169B1C00248DBDB10DF98C945B9EFFB5FF19324F14825EE814AB282D7B95A44CBA5

Function 004047F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040499F

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,76A923A0,?,00431D09,?,005799D8,76A923A0,?,76A923A0,-00589880), ref: 0043525B

Strings

ios_base::failbit set, xrefs: 00404828
ios_base::badbit set, xrefs: 00404937, 00404962

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 1903096808-1240500531
Opcode ID: 037fbcf792b1db2df9f4c70af3e1ac54ab8959b344865e02de195616cc3e88a6
Instruction ID: 59789774a96eacd1a5b8f49c51d8e497543063f0a2ed12b155596828dbf76f3a
Opcode Fuzzy Hash: 037fbcf792b1db2df9f4c70af3e1ac54ab8959b344865e02de195616cc3e88a6
Instruction Fuzzy Hash: E84124B2C00244ABCB04DF68C845BAEBBB8FB49710F14826EF554A73C1D7795A00CBA5

Function 0044EA2E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 151fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(00000000,?,00000000,?,?,?,?,?,!,D,0044EA1C,?,?,!,D,?,00000000,?), ref: 0044EB7A
GetLastError.KERNEL32(?,?,?,?,!,D,0044EA1C,?,?,!,D,?,00000000,?), ref: 0044EB84

Strings

!,D, xrefs: 0044EA30

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLast
String ID: !,D
API String ID: 734332943-2387483618
Opcode ID: 6a1e7ac7384b4bb6329048eea8c26e09b822db16cd26105a02b1221d47aee58a
Instruction ID: 1e1ef3cad634bc89b09ed5b2214d0c7337f84d15d2fc9132cafc43e0310a1cdb
Opcode Fuzzy Hash: 6a1e7ac7384b4bb6329048eea8c26e09b822db16cd26105a02b1221d47aee58a
Instruction Fuzzy Hash: FB511971900685AAFB14CF67CC85B9E7B70FF04328F14021BF516A2281D779E891DBA9

Function 004D65F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D676A
std::_Throw_Cpp_error.LIBCPMT ref: 004D677B

Strings

UaJ, xrefs: 004D65FD

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: UaJ
API String ID: 2134207285-2144978721
Opcode ID: 71bc9411bda081ba2c6ca070473d6e11764a2e135bc835127b003db35da83e39
Instruction ID: 177bb7d1701b8dda1f5a90c4ee3be826f8175b366ab48e47effb054e9b4aa952
Opcode Fuzzy Hash: 71bc9411bda081ba2c6ca070473d6e11764a2e135bc835127b003db35da83e39
Instruction Fuzzy Hash: 6441F2B1E002058BC720DF68995136EBBA1BB94314F19072FE815673D1EB79EA04C795

Function 004E6270 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 004E6290
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 004E62BD

Strings

image/png, xrefs: 004E62D2

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: EncodersGdipImage$Size
String ID: image/png
API String ID: 864223233-2966254431
Opcode ID: e7fc661bbe40e167e968ce4b4834ac07952c6a2874a5ff204e6fe5eb7edf3d15
Instruction ID: e08145eb1897d221235e8b13ede795c589c6d842b6ab703e07584c42203d8d4f
Opcode Fuzzy Hash: e7fc661bbe40e167e968ce4b4834ac07952c6a2874a5ff204e6fe5eb7edf3d15
Instruction Fuzzy Hash: 99216D72E00104ABDB10AFA6DC816AFB7B8FF34395F1201F6ED05A7351E7369A44C295

Function 00404040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004040C4

Strings

bad locale name, xrefs: 004040E6

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 0039d2d2ea2786ef81fe116e8b864d57793cf36a19fa060d6cb0c255b1586cee
Instruction ID: 65c2995a4cce64452fc0e082f9126f7f9302ed92d60cad1113ce5137d9e79936
Opcode Fuzzy Hash: 0039d2d2ea2786ef81fe116e8b864d57793cf36a19fa060d6cb0c255b1586cee
Instruction Fuzzy Hash: DB112670805B84EED321CF69C50474BBFF0AF25714F10868DD09597781D3B9A604CB95

Function 00416590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004165C9
___std_exception_copy.LIBVCRUNTIME ref: 004165FC

Strings

)@, xrefs: 004165BA, 004165ED

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_copy
String ID: )@
API String ID: 2659868963-4120265097
Opcode ID: ec459901e9a8c12f2536e06f4ce64afd8286d8aca2aa337d2d7da09c98386d96
Instruction ID: 79ebb971947c26e29da123751e765caa72f3f100f47198c89106861aa63fe252
Opcode Fuzzy Hash: ec459901e9a8c12f2536e06f4ce64afd8286d8aca2aa337d2d7da09c98386d96
Instruction Fuzzy Hash: F0112EB6910649EBCB11CF99C980B86FBF8FF09724F10876AE82497641E774A5448BA0

Function 004327B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004327C2
std::_Lockit::~_Lockit.LIBCPMT ref: 0043281E

Strings

`-@, xrefs: 004327E9, 00432803

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: `-@
API String ID: 593203224-3781167437
Opcode ID: 0fa848a44c73a6aeeb21660fd2b14f5aaf999c273a66810f0e0171f36124b769
Instruction ID: 083d3c1e84ca2e980ab4dd45ca0d837cc41164b3fcfcb6a28aec5d987169874b
Opcode Fuzzy Hash: 0fa848a44c73a6aeeb21660fd2b14f5aaf999c273a66810f0e0171f36124b769
Instruction Fuzzy Hash: 2A019231600214AFCB15EB19C995E5E77B8EF88754F05409AE8019B3A1DFB0EE44CB60

Function 00404C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GdipCloneImage.GDIPLUS(?,00000000,?,?,?,000000FF), ref: 00404C4C
GdipAlloc.GDIPLUS(00000010,?,?,?,000000FF), ref: 00404C5B

Strings

`K@, xrefs: 00404C75

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Gdip$AllocCloneImage
String ID: `K@
API String ID: 3021075589-3536307564
Opcode ID: 6e910720078c30621a47b6eca49d96a116425349966641e16d2adddba9b4a4fa
Instruction ID: 8747f557437175caeb58756454adc5b6b8cc0decca9fbbd4afccec21ee9e9ac9
Opcode Fuzzy Hash: 6e910720078c30621a47b6eca49d96a116425349966641e16d2adddba9b4a4fa
Instruction Fuzzy Hash: C0112DB1905749DFDB10CF98D904BAABBF8FB48720F10866AE829D37D0D7749900CB91

Function 00404CB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GdipDisposeImage.GDIPLUS(FFFFFFFF,?,?,?,0054C48D,000000FF), ref: 00404CDF
GdipFree.GDIPLUS(?,?,?,?,0054C48D,000000FF), ref: 00404CF1

Strings

`K@, xrefs: 00404CD9

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Gdip$DisposeFreeImage
String ID: `K@
API String ID: 1950503971-3536307564
Opcode ID: 3316c4455565ac62ed6a26cea9d7150bfba2d0e3f41cbf1825aecc5a329bdf6e
Instruction ID: 7ba4187510c4fdb2f2599f15a6424d96657f10c150e71c31b65947a42bc49c9a
Opcode Fuzzy Hash: 3316c4455565ac62ed6a26cea9d7150bfba2d0e3f41cbf1825aecc5a329bdf6e
Instruction Fuzzy Hash: 7201F472A00614ABC720CF48ED01B99BBA8FB19B21F00472FFC11A37C0C7B919108BD5

Function 00407A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00407ACC
___std_exception_destroy.LIBVCRUNTIME ref: 00407AE2

Strings

)@, xrefs: 00407AC2, 00407ADC

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@
API String ID: 4194217158-4120265097
Opcode ID: 93267da127a396356cd2fdbad952cd532b26063f3bf799b654b12ef89a692989
Instruction ID: 39a61349d826cdb48b27ae0f58ab52f56d337699a51a428b07672872488508ae
Opcode Fuzzy Hash: 93267da127a396356cd2fdbad952cd532b26063f3bf799b654b12ef89a692989
Instruction Fuzzy Hash: FE01A2B2C04744ABC711DF98CD0178DFFF8EB09715F10466BE814A3380E3B8660487A5

Function 00407C70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00407CAC
___std_exception_destroy.LIBVCRUNTIME ref: 00407CC2

Strings

)@, xrefs: 00407CA2, 00407CBC

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@
API String ID: 4194217158-4120265097
Opcode ID: cad3be967c840cba8baab123a4240524b2ea9f27ee00b0363261d2d3a2957baf
Instruction ID: b31235e20b660ddbb30c99c001b11998604f696d918c6d2dbba64f62e05318ed
Opcode Fuzzy Hash: cad3be967c840cba8baab123a4240524b2ea9f27ee00b0363261d2d3a2957baf
Instruction Fuzzy Hash: 3F0162B2C44748ABC711DF98DD01B89FFF8EB09715F10466BE814A3781E3B9AA0487A5

Function 00404B60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GdipDisposeImage.GDIPLUS(?,?,?,Function_0014BFE0,000000FF), ref: 00404B84
GdipFree.GDIPLUS(?,?,?,Function_0014BFE0,000000FF), ref: 00404B96

Strings

`K@, xrefs: 00404B7E

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Gdip$DisposeFreeImage
String ID: `K@
API String ID: 1950503971-3536307564
Opcode ID: 62ee0daa599b9b00a0c4ce88fb3d390fe4e594f946ea023ffe489846956dd575
Instruction ID: bd97fcbd8bdc5b644a2ca526311264c36a05ae446e09af96bb23667ce14d71f1
Opcode Fuzzy Hash: 62ee0daa599b9b00a0c4ce88fb3d390fe4e594f946ea023ffe489846956dd575
Instruction Fuzzy Hash: ADF0F672A44654ABD3218F08DC02F95B7E8FB19B10F00466BFC01A3780D7BA68108AD9

Function 0044B52D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,00000000,?,-00000008,?,-00000008,?,?,00456130,?,?,-00000008,?,-00000008), ref: 0044B57F

Strings

`-@, xrefs: 0044B55B
0aE, xrefs: 0044B53E

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CompareString
String ID: 0aE$`-@
API String ID: 1825529933-1472567772
Opcode ID: d0df0ea43047c73f5029be752bfe14cefc264b458c3f39c7a470d4df90d53397
Instruction ID: e44343d96fe236ab9219cb5f9cc943518e3960d7194e1eed57cc779ab2011060
Opcode Fuzzy Hash: d0df0ea43047c73f5029be752bfe14cefc264b458c3f39c7a470d4df90d53397
Instruction Fuzzy Hash: CDF0B83200021ABBCF126F90EC08ADE3F26EB483A4F058011FA1825130C736C972AB95

Function 00407550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0040758C
___std_exception_destroy.LIBVCRUNTIME ref: 004075A2

Strings

)@, xrefs: 00407582, 0040759C

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@
API String ID: 4194217158-4120265097
Opcode ID: c858c6ed78de8a3b5ee1cba1accddd2d2891f2392b50b006f97d08456e2954ad
Instruction ID: 78ccdeb9fbba2d16b6cd524d5c99d9dbf264c3e6aa85c375e1d072593ce1236d
Opcode Fuzzy Hash: c858c6ed78de8a3b5ee1cba1accddd2d2891f2392b50b006f97d08456e2954ad
Instruction Fuzzy Hash: 12F01DB2805748EFC721DF98D901789FFF8FB09728F50466AE865A3780E77466048BA5

Function 00407A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00407A5C
___std_exception_destroy.LIBVCRUNTIME ref: 00407A72

Strings

)@, xrefs: 00407A52, 00407A6C

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@
API String ID: 4194217158-4120265097
Opcode ID: 9ee8fa866bcea9d2c14fc14309fcadf8facde4318e0e6bb098ed358a1a235593
Instruction ID: 96290d15a7b89a27e7413382239de33ac52fdad5c525fa7f0e86a9c1871ea130
Opcode Fuzzy Hash: 9ee8fa866bcea9d2c14fc14309fcadf8facde4318e0e6bb098ed358a1a235593
Instruction Fuzzy Hash: 68F012B1805744DFC711DF98C90178DFFF8FB05728F50466AE855A3780E7B5660487A5

Function 0043361D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00433077,?,?,?,?,004C7E2F), ref: 00433655
GetSystemTimeAsFileTime.KERNEL32(?,93D55659,00000000,?,00551382,000000FF,?,00433077,?,?,?,?,004C7E2F), ref: 00433659

Strings

`-@, xrefs: 0043364F

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: `-@
API String ID: 743729956-3781167437
Opcode ID: a70e229828252f114f3dcb939b169fb3f53d7191ad82fa45b454faadf805d98c
Instruction ID: 3e04e591088ee8cc2650925c1d28f2227fba881fd4e87dc1a7d03300bd93dc66
Opcode Fuzzy Hash: a70e229828252f114f3dcb939b169fb3f53d7191ad82fa45b454faadf805d98c
Instruction Fuzzy Hash: 73F0A032904A54EFCB118F44DC11B59BBA8F708B21F004626EC12A3790DB34A9049F94

Function 0044B7F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000016,00000001,004389D2,00000001,00000016,00438BE1,?,?,?,?,?,00000000), ref: 0044B834

Strings

`-@, xrefs: 0044B824
InitializeCriticalSectionEx, xrefs: 0044B804

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$`-@
API String ID: 2593887523-3269949891
Opcode ID: 1f2253b5c78e33ee57fe7f30907939316c5faef6f9275bf3e632fad4f43c2f0e
Instruction ID: 5bcc12c1b0658f8dc7434a33690804c70bb56e7eadbb0958c8ec10a8e9d05d13
Opcode Fuzzy Hash: 1f2253b5c78e33ee57fe7f30907939316c5faef6f9275bf3e632fad4f43c2f0e
Instruction Fuzzy Hash: BDE09236581318BBCB212F92DC06DAE7F25EB24BA2F048022FD1956161C7768821BBD9

Function 0044B5DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0044B612

Strings

`-@, xrefs: 0044B608
FlsAlloc, xrefs: 0044B5EE

Memory Dump Source

Source File: 00000003.00000002.4473420194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$`-@
API String ID: 2773662609-4156633630
Opcode ID: cb3d3b1705c4ad86f1f38207f7089225cebdf7df6536ef5bae3d846ce8807c5c
Instruction ID: f97a85a86a778de88566526de1fe8fa57bb386988dde2a496b9568b12ff0cd72
Opcode Fuzzy Hash: cb3d3b1705c4ad86f1f38207f7089225cebdf7df6536ef5bae3d846ce8807c5c
Instruction Fuzzy Hash: DAE0CD3258031477961036916C16DAA7D14D750BA3F050033F904522619A95891066DF

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MqN5lD3LGo.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MqN5lD3LGo.exe_75d7bb26b9feea5788cdd196fb86ebec7d54070_4703ef6b_6232b001-d7a8-4b58-a9ee-92c298c63795\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC180.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1CF.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC20F.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
MqN5lD3LGo.exe

Function 007F018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 000D75D0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 210
COMMON

Function 000D7AB0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 122
synchronizationthreadCOMMON

Function 000D7D50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
COMMON

Function 000CA2F4 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 000C9EF6 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 000C74F3 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 000C663B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 000B8522 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 000D7C30 Relevance: 1.3, APIs: 1, Instructions: 94
memoryCOMMON